GHSA-23hp-j76v-pcwj: 
Rust vulnerability analysis and mitigation

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery (SSRF) or local file disclosure. HTTP::fetch and Webpage::from_url passed URLs to libcurl without restricting the initial URL scheme or destination IP address. Redirects were followed without checking whether the new destination was internal. Depending on how the application uses the response, an attacker could:

• Cause requests to internal or link-local services, such as http://127.0.0.1 or http://169.254.169.254.
• Read local files accessible to the application process using a direct file:// URL, if the application exposes the fetched content. Starting in 2.1.0, HTTP::fetch and Webpage::from_url reject non-HTTP(S) URLs and destinations that resolve to non-public IP addresses, including after redirects. Applications that intentionally fetch trusted internal resources or use other URL schemes can opt in to the previous behavior with HTTP::fetch_unrestricted or Webpage::from_url_unrestricted.