From ea4d09fb5ccba12ed774fcf7c913edfa1e6a851a Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Thu, 2 Jul 2026 06:00:40 +0200
Subject: auto: 2026-07-02_06:00 changes

---
 modules/core/module-manager.js | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'modules/core/module-manager.js')

diff --git a/modules/core/module-manager.js b/modules/core/module-manager.js
index 8cecc4d..4723bff 100644
--- a/modules/core/module-manager.js
+++ b/modules/core/module-manager.js
@@ -36,6 +36,11 @@
             }
             async loadModuleFromURL(url) {
                 try {
+                    // Security: block cross-origin URLs for module loading
+                    if (url && url.match(/^https?:\/\//) && !url.startsWith(window.location.origin)) {
+                        this.terminal.print(`⚠️ Security: only same-origin URLs allowed for module loading`, 'error');
+                        return false;
+                    }
                     this.terminal.print(`Loading module from ${url}...`, 'info');
                     const response = await fetch(url);
                     if (!response.ok) throw new Error(`HTTP ${response.status}`);
-- 
cgit v1.2.3