fix(link-preview): https-only previews and full-document parsing

waleedlatif1 · waleedlatif1 · commit 3eadb90f8f98 · 2026-07-17T10:05:50.000-07:00
- drop allowHttp: plain-http fetches would reach the URL validator's self-host loopback exception; previews are now explicitly https-only on both server (early null) and client (query never fires for http)
- parse the full capped document instead of truncating at the first &lt;body&gt; substring, which could match inside head scripts/comments and drop metadata
diff --git a/apps/sim/app/api/link-preview/route.ts b/apps/sim/app/api/link-preview/route.ts
@@ -26,13 +26,12 @@ const NEGATIVE_CACHE_TTL_SECONDS = 60 * 60
 const CACHE_KEY_PREFIX = 'link-preview:v1:'
 
 /**
- * Parses preview metadata from the document head. Only the head matters for
- * previews, so the input is truncated at `<body>` before parsing; cheerio
- * handles attribute order, quoting, and entity decoding.
+ * Parses preview metadata from the fetched document (already capped at
+ * MAX_RESPONSE_BYTES); cheerio handles attribute order, quoting, and entity
+ * decoding.
  */
 function parsePreview(html: string): LinkPreview {
-  const bodyIndex = html.search(/<body[\s>]/i)
-  const $ = cheerio.load(bodyIndex === -1 ? html : html.slice(0, bodyIndex))
+  const $ = cheerio.load(html)
 
   const meta = (key: string): string | null => {
     const value = $(`meta[property="${key}"], meta[name="${key}"]`).first().attr('content')
@@ -54,7 +53,6 @@ function parsePreview(html: string): LinkPreview {
 
 async function fetchPreview(url: string): Promise<LinkPreview> {
   const response = await secureFetchWithValidation(url, {
-    allowHttp: true,
     timeout: FETCH_TIMEOUT_MS,
     maxRedirects: MAX_REDIRECTS,
     maxResponseBytes: MAX_RESPONSE_BYTES,
@@ -84,6 +82,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
   if (!parsed.success) return parsed.response
   const { url } = parsed.data.query
 
+  if (!url.startsWith('https://')) {
+    return NextResponse.json({ preview: null })
+  }
+
   const redis = getRedisClient()
   const cacheKey = `${CACHE_KEY_PREFIX}${createHash('sha256').update(url).digest('hex')}`
   if (redis) {
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/external-link.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/chat-content/external-link.tsx
@@ -33,10 +33,12 @@ interface ExternalLinkProps {
  * Favicon + quiet-underline external link with an OG-preview tooltip. The
  * preview query fires when the link renders, so metadata is normally cached
  * (client and server side) before the first hover; the tooltip shows the
- * destination URL until metadata arrives or when the site has none.
+ * destination URL until metadata arrives or when the site has none. Previews
+ * are https-only — plain-http links keep the URL tooltip, since fetching them
+ * server-side would reach the URL validator's self-host loopback exception.
  */
 export function ExternalLink({ href, hostname, children }: ExternalLinkProps) {
-  const { data } = useLinkPreview(href)
+  const { data } = useLinkPreview(href.startsWith('https://') ? href : undefined)
   const preview = data?.preview
 
   return (
