add download utils

lib/download_utils.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module DownloadUtils
+  LOCALHOSTS = %w[0.0.0.0 127.0.0.1 localhost].freeze
+
+  UnableToDownload = Class.new(StandardError)
+
+  module_function
+
+  def call(url)
+    uri = Addressable::URI.parse(url)
+
+    if Docuseal.multitenant?
+      raise UnableToDownload, "Error loading: #{uri.display_uri}. Only HTTPS is allowed." if uri.scheme != 'https'
+
+      if uri.host.in?(LOCALHOSTS)
+        raise UnableToDownload, "Error loading: #{uri.display_uri}. Can't download from localhost."
+      end
+    end
+
+    resp = conn.get(uri.display_uri.to_s)
+
+    raise UnableToDownload, "Error loading: #{uri.display_uri}" if resp.status >= 400
+
+    resp
+  end
+
+  def conn
+    Faraday.new do |faraday|
+      faraday.response :follow_redirects
+    end
+  end
+end

lib/submitters/normalize_values.rb

@@ -11,7 +11,6 @@ module Submitters
     UnknownFieldName = Class.new(BaseError)
     InvalidDefaultValue = Class.new(BaseError)
     UnknownSubmitterName = Class.new(BaseError)
-    UnableToDownload = Class.new(BaseError)
 
     TRUE_VALUES = ['1', 'true', true, 'TRUE', 'True', 'yes', 'YES', 'Yes'].freeze
     FALSE_VALUES = ['0', 'false', false, 'FALSE', 'False', 'no', 'NO', 'No'].freeze
@@ -185,12 +184,7 @@ module Submitters
 
       return blob if blob
 
-      uri = Addressable::URI.parse(url)
-      resp = conn.get(uri.display_uri.to_s)
-
-      raise UnableToDownload, "Error loading: #{uri.display_uri}" if resp.status >= 400
-
-      data = resp.body
+      data = DownloadUtils.call(url).body
 
       checksum = Digest::MD5.base64digest(data)
 
@@ -215,11 +209,5 @@ module Submitters
 
       nil
     end
-
-    def conn
-      Faraday.new do |faraday|
-        faraday.response :follow_redirects
-      end
-    end
   end
 end