Allow List

[Nick (ingalls)]

This pull request enhances the SSRF-safe URL validation system by introducing an explicit allow-list mechanism, allowing callers to specify trusted origins or hostnames that should bypass SSRF checks. This is particularly useful for permitting known internal endpoints in secure environments. The changes also propagate this feature through the public API and its consumers.

SSRF-safe URL validation enhancements:

• Added a safeUrlAllow option to the FetchInit interface in lib/fetch.ts, enabling callers to specify a list of allowed origins or hostnames that bypass SSRF checks.
• Updated the main fetch implementation in lib/fetch.ts to pass the safeUrlAllow option to the isSafeUrl check for both the initial request and any redirects, ensuring consistent allow-list enforcement. [1] [2] [3]
• Extended the isSafeUrl function in lib/safeurl.ts to accept a new SafeUrlOptions parameter, implementing logic to immediately allow URLs matching any entry in the provided allow-list.

Public API updates:

• Exported the new SafeUrlOptions type from the package entry point (index.ts) for external use.