AI Browser Chat: An analyze-url Route That Fetches Whatever URL It Is Given

This is the second post on my ai-browser-chat repository. I read app/api/blink/analyze-url/route.ts, app/api/blink/search/route.ts, the tts route and lib/blink/client.ts.

What it does

analyze-url takes a url query parameter, passes it to blink.data.extractFromUrl, then asks a model to summarize the result with a 600 token limit. The search route takes q and limit and returns the organic results. The tts route turns up to 4000 characters of text into speech and returns a URL. All three require a signed-in session. The client in lib/blink/client.ts is created with a project id and authRequired set to false.

Where it goes wrong

In the analyze-url route I found no check on the URL before it is passed on: no scheme test, no host allowlist, no length limit. The fetch itself happens inside the Blink SDK, and I do not know what that service blocks on its side, so I am not claiming anything can be reached. The point is narrower. My code does not state what it accepts, and a route that fetches user-supplied URLs should.

The search route does Number(limit) with no upper bound, so a signed-in user chooses how many results to request. The client option authRequired set to false is also easy to misread. It concerns the SDK, while my own routes do their own session check, but a comment would help the next reader.

What I would change

My opinion: parse the URL, allow only http and https, and keep a short list of hosts or at least refuse private address ranges before calling the SDK. Clamp limit to a small number. Both are a few lines each. I have not tested what the SDK does with an internal address, and I would test that before saying anything stronger.