Skip to content

fix: check deny list in webscrappers#6559

Merged
0xi4o merged 2 commits into
mainfrom
fix/flowise-394
Jul 15, 2026
Merged

fix: check deny list in webscrappers#6559
0xi4o merged 2 commits into
mainfrom
fix/flowise-394

Conversation

@0xi4o

@0xi4o 0xi4o commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request integrates checkDenyList into the Cheerio, Playwright, and Puppeteer document loaders to prevent unauthorized URL access. However, the review highlights critical security concerns regarding Server-Side Request Forgery (SSRF) and DNS rebinding, as checking only the initial URL does not prevent bypasses via HTTP redirects. For Cheerio, the reviewer suggests overriding CheerioWebBaseLoader.prototype.scrape to use secureFetch. For Playwright and Puppeteer, which execute in separate browser processes, the reviewer recommends implementing network-level isolation or configuring a secure forward proxy to block intranet access.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread packages/components/nodes/documentloaders/Cheerio/Cheerio.ts Outdated
Comment thread packages/components/nodes/documentloaders/Playwright/Playwright.ts
Comment thread packages/components/nodes/documentloaders/Puppeteer/Puppeteer.ts
@0xi4o 0xi4o merged commit 6c989ec into main Jul 15, 2026
7 checks passed
@0xi4o 0xi4o deleted the fix/flowise-394 branch July 15, 2026 07:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants