[thinhnx128]

Summary

Hardens the @arakoodev/edgechains scraper module (Cheerio, AutoPlayWriteWebPageScrapper, Playwright, and goToLink) against Server-Side Request Forgery (CWE-918), local protocol disclosure (CWE-22), and orphaned Chromium browser processes (CWE-404):

1. Protocol & SSRF Guard (src/utils/url-validator.ts):
   • Introduces assertSafeScraperUrl(url, options) and isBlockedScraperHost(hostname).
   • Restricts scraper targets to http: and https: protocols (blocking file://, javascript:, data:, ftp:).
   • Blocks loopback (127.0.0.0/8, ::1, localhost), RFC1918 private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), carrier-grade NAT (100.64.0.0/10), IPv6 link-local/unique-local (fe80::/10, fc00::/7, IPv4-mapped ::ffff:), and cloud metadata endpoints (169.254.169.254, 100.100.100.200, metadata.google.internal) by default.
   • Provides opt-in { allowPrivateNetworks: true } for trusted local testing environments.
2. Playwright Lifecycle Cleanup (CWE-404):
   • Validates target URLs before calling chromium.launch() in AutoPlayWriteWebPageScrapper.getContent() and Playwright.call().
   • Wraps page navigation and extraction in try { ... } finally { await browser.close(); } so headless Chromium instances are never leaked on navigation timeouts or DOM errors.
3. Unit Tests (src/tests/cheerio.test.ts):
   • Adds unit test assertions verifying that file:///etc/passwd, http://169.254.169.254/latest/meta-data/, and http://127.0.0.1:8080 are deterministically blocked.

[thinhnx128]

I have read the Arakoo CLA Document and I hereby sign the CLA

[thinhnx128]

Closing this to reduce review load — it wasn't requested by the maintainers. Thanks for your time; happy to reopen if it's useful.