| 111 | } |
| 112 | |
| 113 | bool IsRemoteUrlAllowed(const std::string& url) { |
| 114 | InitializeSecurityConfig(); |
| 115 | |
| 116 | // Debug mode always allows all URLs |
| 117 | if (s_isDebuggable) { |
| 118 | return true; |
| 119 | } |
| 120 | |
| 121 | // Production: first check if remote modules are allowed at all |
| 122 | if (!s_allowRemoteModules) { |
| 123 | return false; |
| 124 | } |
| 125 | |
| 126 | // If no allowlist is configured, allow all URLs (user explicitly enabled remote modules) |
| 127 | if (s_remoteModuleAllowlist.empty()) { |
| 128 | return true; |
| 129 | } |
| 130 | |
| 131 | // Check if URL matches any allowlist prefix |
| 132 | for (const std::string& prefix : s_remoteModuleAllowlist) { |
| 133 | if (UrlStartsWith(url, prefix)) { |
| 134 | return true; |
| 135 | } |
| 136 | } |
| 137 | |
| 138 | return false; |
| 139 | } |
| 140 | |
| 141 | } // namespace tns |
no test coverage detected