Principle:Langgenius Dify SecurityValidation
| Knowledge Sources | Dify |
|---|---|
| Domains | Frontend, Security, Validation |
| Last Updated | 2026-02-12 07:00 GMT |
Overview
Dify applies security-focused URL validation for redirect targets and network address classification, preventing protocol-based XSS attacks and unauthorized access to internal network resources.
Description
The utils/urlValidation.ts module provides two complementary security validation functions. The validateRedirectUrl function ensures that redirect target URLs use only safe protocols (http: or https:), preventing javascript:, data:, vbscript:, and other dangerous protocol schemes that could execute arbitrary code in the user's browser context. The function uses the URL constructor for parsing, which also catches malformed URLs that might bypass simpler string-based checks.
The isPrivateOrLocalAddress function provides network address classification by checking hostnames against known private and local address patterns. It covers IPv4 private ranges defined in RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), the IPv4 link-local range (169.254.0.0/16), localhost variants (localhost, 127.0.0.1, ::1), and mDNS/Bonjour-style .local domains. The function parses IP octets numerically to correctly evaluate range membership rather than relying on string prefix matching, which could be bypassed by carefully crafted hostnames.
Together, these functions form a security validation layer that protects against two distinct attack vectors: open redirect attacks (where an attacker crafts a URL that redirects users to a malicious site or executes code via protocol handlers) and SSRF attacks (where internal network resources are accessed through user-supplied URLs). The validation is designed to be called at input boundaries, before URLs are stored, transmitted to the backend, or used in redirects, providing early rejection of malicious input.
Usage
Use this principle when:
- Implementing OAuth callback URL validation or any redirect-based authentication flow
- Validating URLs entered by users in configuration forms before persisting or using them
- Classifying network addresses for security policy enforcement (e.g., allowing or blocking private network access)
Theoretical Basis
This principle applies Input Validation as defined by OWASP's security practices, specifically the Allow-list approach for redirect protocols and the Deny-list approach for network addresses. The use of the browser's URL constructor for parsing follows the Parse, Don't Validate principle, leveraging a well-tested parser rather than custom string manipulation that might miss edge cases. The combination of protocol validation and address classification implements Layered Security Controls where multiple independent checks must all pass for a URL to be accepted.