Function validateExternalUrl

apps/sim/lib/core/security/input-validation.ts:699–776

(
  url: string | null | undefined,
  paramName = 'url',
  options: { allowHttp?: boolean } = {}
)

 * ```
 */
export function validateExternalUrl(
  url: string | null | undefined,
  paramName = 'url',
  options: { allowHttp?: boolean } = {}
): ValidationResult {
  if (!url || typeof url !== 'string') {
    return {
      isValid: false,
      error: `${paramName} is required and must be a string`,
    }
  }

  let parsedUrl: URL
  try {
    parsedUrl = new URL(url)
  } catch {
    return {
      isValid: false,
      error: `${paramName} must be a valid URL`,
    }
  }

  const protocol = parsedUrl.protocol
  const hostname = parsedUrl.hostname.toLowerCase()

  const cleanHostname =
    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname

  let isLocalhost = cleanHostname === 'localhost'
  if (ipaddr.isValid(cleanHostname)) {
    const processedIP = ipaddr.process(cleanHostname).toString()
    if (processedIP === '127.0.0.1' || processedIP === '::1') {
      isLocalhost = true
    }
  }

  if (isLocalhost && isHosted) {
    return {
      isValid: false,
      error: `${paramName} cannot point to localhost`,
    }
  }

  if (options.allowHttp) {
    if (protocol !== 'https:' && protocol !== 'http:') {
      return {
        isValid: false,
        error: `${paramName} must use http:// or https:// protocol`,
      }
    }
  } else if (protocol !== 'https:' && !(protocol === 'http:' && isLocalhost && !isHosted)) {
    return {
      isValid: false,
      error: `${paramName} must use https:// protocol`,
    }
  }

  if (!isLocalhost && ipaddr.isValid(cleanHostname)) {