From be0b915ae4fda6be8f82f799da3f719e4f7f299f Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 16 Sep 2026 12:36:03 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 lib/runner.js | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/runner.js b/lib/runner.js
index b7f35e50..fff3b93f 100644
--- a/lib/runner.js
+++ b/lib/runner.js
@@ -88,6 +88,22 @@ function runner(options, callback) {
   if (options.url) {
     debug("Fetching remote CSS file: %s", options.url);
 
+    // block SSRF: only allow http(s) URLs and reject localhost / private / link-local addresses
+    var parsedUrl = new (require("url").URL)(options.url);
+    var blockedHostname =
+      /^(localhost|127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|::1)/;
+
+    if (
+      !/^https?:$/.test(parsedUrl.protocol) ||
+      blockedHostname.test(parsedUrl.hostname)
+    ) {
+      var urlErr = new Error(
+        "Fetching from this URL is not allowed: " + options.url,
+      );
+      urlErr.code = analyzer.EXIT_URL_LOADING_FAILED;
+      return callback(urlErr);
+    }
+
     // @see https://www.npmjs.com/package/node-fetch#options
     var agentOptions = {},
       requestOptions = {