Fix an issue where attackers could use the Nextjs image endpoint to redirect to any URL.

2026-09-16 07:35:16 +00:00 · 2024-05-14 10:56:12 +01:00
1 changed files with 9 additions and 0 deletions
@@ -39,6 +39,15 @@ module.exports = withSentryConfig(

        assetPrefix: process.env.GITBOOK_ASSETS_PREFIX,
        poweredByHeader: false,
+
+        images: {
+            remotePatterns: [
+                {
+                    protocol: 'https',
+                    hostname: '*.gitbook.io',
+                }
+            ]
+        }
    },
    {
        silent: true,