Server Side Request Forgery (SSRF)

whoogle_search is vulnerable to Server Side Request Forgery (SSRF). The vulnerability is due to not sanitizing user-supplied data from the location variable in the window endpoint which passes the same user supplied input to send method within request.py. This can be exploited to send crafted GET requests to internal and external resources on behalf of the server leading to Server Side Request Forgery (SSRF). The same SSRF vulnerability also exists in the element method in app/routes.py which does not validate/sanitize user-controlled src_type and element_url variables.