nsrb/jerapah-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sandbox): allow localhost in axios URL screening

Browse Source 
Self-hosted automation targets often run on localhost or loopback
addresses, so keep blocking private/metadata hosts but stop blocking
localhost, 127.x.x.x, and .localhost names.

Co-authored-by: Nasyarobby Putra <nasyarobby@gmail.com>
This commit is contained in:
Cursor Agent
2026-08-14 05:01:45 +00:00
co-authored by nsrb
parent 8c9673444f
commit b181bd3414
1 changed files with 0 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
script-sandbox.js
-10
View File
@@ -188,15 +188,6 @@ function createConsole(logger) {
function isBlockedHostname(hostname) {
const host = hostname.toLowerCase().replace(/\.$/, "");
if (
host === "localhost" ||
host === "0.0.0.0" ||
host === "[::]" ||
host === "[::1]" ||
host.endsWith(".localhost")
) {
return true;
}
if (host === "metadata.google.internal" || host === "metadata.goog") {
return true;
@@ -214,7 +205,6 @@ function isBlockedHostname(hostname) {
const [a, b] = octets;
if (a === 10) return true;
if (a === 127) return true;
if (a === 0) return true;
if (a === 169 && b === 254) return true;
if (a === 172 && b >= 16 && b <= 31) return true;