From 1e3193366a2ff351e1c5318fb768542311b60c84 Mon Sep 17 00:00:00 2001
From: Neal Shah <30693865+ProgrammerIn-wonderland@users.noreply.github.com>
Date: Tue, 24 Feb 2026 16:11:00 -0500
Subject: [PATCH] dont forward data urls through cors proxy and fix
 core.validation (#2537)

* exempt data urls from using cors proxy

* disallow unlimited use

* make core.validation defined again
---
 src/backend/src/CoreModule.js      | 2 +-
 src/backend/src/util/securehttp.js | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/backend/src/CoreModule.js b/src/backend/src/CoreModule.js
index 702b00c0e..cea0be5df 100644
--- a/src/backend/src/CoreModule.js
+++ b/src/backend/src/CoreModule.js
@@ -79,7 +79,7 @@ const install = async ({ context, services, app, useapi, modapi }) => {
         def('core.fs.selectors', require('./filesystem/node/selectors'));
         def('core.util.stream', require('./util/streamutil'));
         def('web', require('./util/expressutil'));
-        def('core.validation', require('./validation').default);
+        def('core.validation', require('./validation'));
 
         def('core.database', require('./services/database/consts.js'));
 
diff --git a/src/backend/src/util/securehttp.js b/src/backend/src/util/securehttp.js
index e214ae44a..4c33939bd 100644
--- a/src/backend/src/util/securehttp.js
+++ b/src/backend/src/util/securehttp.js
@@ -192,7 +192,8 @@ async function secureAxiosRequest (axios, url, options = {}) {
     };
 
     try {
-        if ( globalThis.global_config.services.secureCorsProxy.url ) {
+        const parsedUrl = new URL(url);
+        if ( parsedUrl.protocol !== 'data:' && globalThis.global_config.services.secureCorsProxy.url ) {
             url = globalThis.global_config.services.secureCorsProxy.url + url;
             if ( ! secureOptions.headers ) {
                 secureOptions.headers = {};
@@ -212,7 +213,7 @@ async function secureAxiosRequest (axios, url, options = {}) {
         }
 
         // Log different information based on URL type
-        const parsedUrl = new URL(url);
+
         if ( parsedUrl.protocol === 'data:' ) {
             // Extract data format from data URL
             const dataFormat = url.split(',')[0].split(':')[1] || 'unknown format';