SSRF-确保URL不会引发SSRF漏洞

import java.net.URI;
import java.net.URISyntaxException;
import java.util.regex.Pattern;
import java.util.regex.Matcher;

public class UrlValidator {

    private static final Pattern SAFE_URL_PATTERN = Pattern.compile("^(http|https)://[^/]+/.*$");

    public static boolean isSafeUrl(String url) {
        if (url == null || url.isEmpty()) {
            return false;
        }

        // 基本的 URL 格式验证
        Matcher matcher = SAFE_URL_PATTERN.matcher(url);
        if (!matcher.matches()) {
            return false;
        }

        try {
            URI uri = new URI(url);

            // 检查协议是否为 http 或 https
            if (!"http".equals(uri.getScheme()) && !"https".equals(uri.getScheme())) {
                return false;
            }