From 47bc0f0f1ca11aa9ec09660bfaaf5b45f06bf009 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Tue, 20 May 2025 17:39:28 +0200
Subject: [PATCH] Add URL validation function to proxy endpoint

---
 lib/galaxy/webapps/galaxy/api/proxy.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/galaxy/webapps/galaxy/api/proxy.py b/lib/galaxy/webapps/galaxy/api/proxy.py
index 4b6b0af694d..a16460fbae1 100644
--- a/lib/galaxy/webapps/galaxy/api/proxy.py
+++ b/lib/galaxy/webapps/galaxy/api/proxy.py
@@ -3,6 +3,7 @@ API Controller to handle remote zip operations.
 """
 
 import logging
+from urllib.parse import urlparse
 
 import httpx
 from fastapi import (
@@ -35,6 +36,16 @@ URLQueryParam: str = Query(
 )
 
 
+def is_valid_url(url: str) -> bool:
+    if url.count("://") != 1:
+        return False  # Ensure there is exactly one scheme
+    try:
+        parsed = urlparse(url)
+        return all([parsed.scheme in ("http", "https"), parsed.netloc])
+    except ValueError:
+        return False
+
+
 @router.cbv
 class FastAPIProxy:
 
@@ -47,6 +58,9 @@ class FastAPIProxy:
         if trans.anonymous:
             raise UserRequiredException("Anonymous users are not allowed to access this endpoint")
 
+        if not is_valid_url(url):
+            raise RequestParameterInvalidException("Invalid URL format.")
+
         validate_uri_access(url, trans.user_is_admin, trans.app.config.fetch_url_allowlist_ips)
 
         headers = {}