Fix SSRF issue

[0x1f]

• Fixed the SSRF security vulnerability, preventing access to private networks and cloud metadata.

[netlify]

✅ Deploy Preview for web-check ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	cf21f6e
🔍 Latest deploy log	https://app.netlify.com/projects/web-check/deploys/6aa012e2db1f0400088fd870
😎 Deploy Preview	https://deploy-preview-274--web-check.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[0x1f]

Conflicts have been resolved by merging upstream master.
The remaining DockerHub check failure appears to be from this fork missing DockerHub credentials, not from the PR changes.

[lissy93]

Thanks @0x1f

But this seems counter-intuitive.
Web-check's entire purpose is to call a URL and show you what came back. That's SSRF by design. But there's literally no valid exploit path anywhere in the code, and every risk is already mitigated with the firewall config options. E.g. set API_BLOCKED_HOSTS to close of accessing of given domains, IPs or CIDR ranges, or just set publicOnlyChecks to prevent any private checks.

[lissy93]

I think this does the opposite of what you meant?

It will block harmless case, and then miss the actual attack, since it's only catching requests made by hostname, whereas attacker is going to use IP.

And I don't think it's wired up correctly to actually be being used, which is probably why the app was still working for you.