Description

This PR adds a security guardrail to the withBase utility. It ensures that if a baseURL is provided, it must use an explicit http:// or https:// protocol.

This prevents potential Server-Side Request Forgery (SSRF) or protocol injection attacks in cases where the baseURL might be derived from untrusted configuration or user input.

Key Changes

• Validates that baseURL starts with http:// or https://.
• Throws a descriptive error if an invalid protocol (like file://) or no protocol is used.

Related Issues

Resolves #564

Checklist

• I have read the contribution guidelines.
• I have added tests to cover these changes.
• All tests passed locally.

Summary by CodeRabbit

• Bug Fixes
  • Fixed URL handling to properly validate base prefix boundaries. The system now correctly checks that matched base prefixes are followed by path boundaries (/, ?, #) or string end, preventing incorrect interpretation of partial-prefix matches.