coinos-server.git/lib/safe-fetch.ts, branch regtest-fulcrumcoinos server — legacy coinos.io backend (Lightning, on-chain, Liquid)https://git.coinos.io/coinos-server.git/atom?h=regtest-fulcrum2026-06-16T06:35:50Zlnurl: SSRF-guard user-supplied URL fetches + validate zap events2026-06-16T06:35:50ZAdam Soltysadam@coinos.io2026-06-16T06:35:50Zurn:sha1:497277ef7b48c86aa2f44b613e0a35a0c3b0c238
The /lnurl/proxy, /decode and /encode handlers fetched an arbitrary
user-supplied URL via got() and returned the body — an unauthenticated
SSRF reaching internal services. Route those fetches through a new
safeGot() that rejects hosts resolving to loopback/private/link-local/
CGNAT/metadata ranges, re-validates on each redirect hop, restricts the
scheme to http(s), and caps timeout + response size. Also validate the
NIP-57 zap request (kind 9734 + signature) before storing it, instead of
trusting the client-supplied event.
These endpoints can't be removed — they back lightning-address/LNURL
parsing and resolution in the wallet UI.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>