Method normalizeDomain

server/src/validator.ts:511–548

(value: string)

  }

  private normalizeDomain(value: string): string {
    let normalized = value.trim().toLowerCase();

    // Strip scheme if present.
    if (normalized.startsWith("https://")) {
      normalized = normalized.slice("https://".length);
    } else if (normalized.startsWith("http://")) {
      normalized = normalized.slice("http://".length);
    }

    // Remove trailing slashes.
    while (normalized.endsWith("/")) {
      normalized = normalized.slice(0, -1);
    }

    // Basic SSRF hardening: disallow obvious local / non-public hosts and raw IPs.
    if (
      normalized === "" ||
      normalized === "localhost" ||
      normalized.endsWith(".localhost") ||
      normalized.endsWith(".local")
    ) {
      return "";
    }

    // Reject IPv4 addresses.
    const ipv4Pattern = /^(?:\d{1,3}\.){3}\d{1,3}$/;
    if (ipv4Pattern.test(normalized)) {
      return "";
    }

    // Reject bracketed IPv6 literals.
    if (normalized.startsWith("[") && normalized.endsWith("]")) {
      return "";
    }

    return normalized;
  }

  private normalizeUrl(value: string): string {
    let normalized = value;