Skip to main content

validate_url

feedparser_rs::http::validation

Function validate_url 

Source 
pub fn validate_url(url_str: &str) -> Result<Url>
Expand description

Validates a URL to prevent Server-Side Request Forgery (SSRF) attacks

This function ensures that URLs only point to public, safe destinations. It is the single validation entry point used both before sending the initial request and to re-validate every redirect hop (see crate::http::FeedHttpClient), and shares its rule set with xml:base resolution via crate::util::base_url::is_safe_url.

§Security Checks

  1. Only HTTP and HTTPS schemes are allowed
  2. Private IP ranges are blocked (RFC 1918, RFC 4193)
  3. Localhost and loopback addresses are blocked
  4. Link-local addresses are blocked (169.254.0.0/16)
  5. Cloud metadata endpoints are blocked
  6. Internal domain names are blocked (.local, .internal)

§Errors

Returns FeedError::Http if:

  • The URL is malformed or invalid
  • The URL scheme is not HTTP or HTTPS
  • The URL points to a private IP address, localhost, or internal domain
  • The URL points to a cloud metadata endpoint

§Examples

use feedparser_rs::http::validation::validate_url;

// These are allowed
assert!(validate_url("https://example.com/feed.xml").is_ok());
assert!(validate_url("http://blog.example.org/rss").is_ok());

// These are blocked
assert!(validate_url("http://localhost/").is_err());
assert!(validate_url("http://192.168.1.1/").is_err());
assert!(validate_url("http://169.254.169.254/").is_err());
assert!(validate_url("file:///etc/passwd").is_err());