Add local domains support. Fixes #168. Fixes #446

Author: dansup

app/Services/SanitizeService.php

@@ -234,6 +234,7 @@ public function isLocalObject($url): bool
      * - Blocks localhost/private/reserved IPs (IPv4/IPv6)
      * - Optionally verifies DNS and blocks records resolving to private/reserved IPs
      * - Normalizes IDNs to ASCII (punycode) when possible
+     * - Allows configured local domains (same-server instances)
      *
      * @param  string|array  $input
      * @return string|false Normalized safe URL or false
@@ -273,8 +274,34 @@ public function url($input, bool $verifyDns = false, bool $bypassAppHost = true)
         }
 
         $host = strtolower($parts['host']);
-        if ($bypassAppHost && $host === $this->localDomain()) {
-            return $input;
+
+        $isTrustedLocal = false;
+        if ($bypassAppHost) {
+            $trustedDomains = $this->getTrustedLocalDomains();
+            foreach ($trustedDomains as $trustedDomain) {
+                if ($host === $trustedDomain) {
+                    $isTrustedLocal = true;
+                    break;
+                }
+            }
+        }
+
+        if ($isTrustedLocal) {
+            $path = $parts['path'] ?? '';
+            if ($path !== '' && strpos($path, '\\') !== false) {
+                return false;
+            }
+
+            $authority = (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false) ? '['.$host.']' : $host;
+            $query = isset($parts['query']) ? '?'.$parts['query'] : '';
+            $fragment = isset($parts['fragment']) ? '#'.$parts['fragment'] : '';
+            $normalized = 'https://'.$authority.$path.$query.$fragment;
+
+            if (! filter_var($normalized, FILTER_VALIDATE_URL)) {
+                return false;
+            }
+
+            return $normalized;
         }
 
         $isIpv4 = filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
@@ -325,6 +352,23 @@ public function url($input, bool $verifyDns = false, bool $bypassAppHost = true)
         return $normalized;
     }
 
+    /**
+     * Get list of trusted local domains (same-server instances)
+     */
+    private function getTrustedLocalDomains(): array
+    {
+        $domains = [$this->localDomain()];
+
+        $configDomains = config('loops.local_domains');
+        if ($configDomains) {
+            $additional = array_map('trim', explode(',', $configDomains));
+            $additional = array_filter($additional, fn ($d) => $d !== '');
+            $domains = array_merge($domains, $additional);
+        }
+
+        return array_unique(array_map('strtolower', $domains));
+    }
+
     private function idnToAscii(string $host)
     {
         if (preg_match('/[^\x20-\x7E]/', $host)) {

config/loops.php

@@ -85,4 +85,16 @@
         'enabled' => env('LOOPS_HEALTH_ENDPOINT_ENABLED', false),
         'secret' => env('LOOPS_HEALTH_ENDPOINT_SECRET'),
     ],
+
+    /*
+    |--------------------------------------------------------------------------
+    | Local Domains (Same-Server Instances)
+    |--------------------------------------------------------------------------
+    |
+    | Comma-separated list of domains hosted on the same server that should
+    | be allowed to federate even if they resolve to localhost/private IPs.
+    | Useful for multi-instance setups on a single server.
+    |
+    */
+    'local_domains' => env('LOOPS_LOCAL_DOMAINS', ''),
 ];