SSRF and local file disclosure via unvalidated URLs

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::fromurl passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...