Function safeFetch

server/src/utils/url-security.ts:173–197

(
  url: string,
  options?: { headers?: Record<string, string>; maxRedirects?: number; method?: 'GET' | 'HEAD'; signal?: AbortSignal },
)

 * callers receive a Response with no tainted URL flowing to fetch().
 */
export async function safeFetch(
  url: string,
  options?: { headers?: Record<string, string>; maxRedirects?: number; method?: 'GET' | 'HEAD'; signal?: AbortSignal },
): Promise<Response> {
  const parsedUrl = new URL(url);
  await validateFetchUrl(parsedUrl);

  const headers = options?.headers ?? {};
  const maxRedirects = options?.maxRedirects ?? 5;
  const method = options?.method ?? 'GET';
  const signal = options?.signal;

  // URL is validated above by validateFetchUrl (rejects private IPs, link-local, etc).
  let response = await fetch(sanitizeUrl(parsedUrl), { method, headers, redirect: 'manual', signal });

  for (let i = 0; i < maxRedirects && [301, 302, 303, 307, 308].includes(response.status); i++) {
    const location = response.headers.get('location');
    if (!location) throw new Error('Redirect with no Location header');
    // validateRedirectTarget re-validates the resolved hop against the same private-IP rules.
    const redirectUrl = await validateRedirectTarget(location, parsedUrl);
    response = await fetch(sanitizeUrl(redirectUrl), { method, headers, redirect: 'manual', signal });
  }

  return response;
}