From acbaa6cfcb585d4adc2856018358d6be43b37bf3 Mon Sep 17 00:00:00 2001
From: Victor Giers <mail@victorgiers.com>
Date: Wed, 7 Jan 2026 23:26:55 +0100
Subject: [PATCH] Add function to check if profile host is allowed

---
 server/src/index.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server/src/index.ts b/server/src/index.ts
index 7226e0b..955d4ff 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -166,6 +166,16 @@ function extractIgMeta(raw: any): EntryRecord['igMeta'] {
   };
 }
 
+function isAllowedProfileHost(urlString: string) {
+  try {
+    const { hostname } = new URL(urlString);
+    const safeHosts = ['instagram.com', 'cdninstagram.com', 'fbcdn.net'];
+    return safeHosts.some((h) => hostname.endsWith(h) || hostname.includes(`.${h}`));
+  } catch {
+    return false;
+  }
+}
+
 async function loadEntries() {
   entryIndex.clear();