fix: avoid loading localhost referrer favicons

Author: Copilot

src/ui/scripts/components/presentations/PresentationIconList.js

@@ -3,6 +3,7 @@ import { createElement as h } from 'react'
 
 import Favicon from '../Favicon.js'
 
+import faviconUrl from '../../../../utils/faviconUrl.js'
 import enhanceUrl from '../../enhancers/enhanceUrl.js'
 import sumByProp from '../../utils/sumByProp.js'
 
@@ -95,7 +96,7 @@ const PresentationIconList = (props) => {
 
         return h(UrlRow, {
           ...commonProps,
-          faviconUrl: new URL('/favicon.ico', item.url).href,
+          faviconUrl: faviconUrl(item.url),
           url: item.url,
         })
       }),

src/utils/faviconUrl.js

@@ -0,0 +1,12 @@
+const localhostRegex = /(^|\.)localhost$/i
+const loopbackRegex = /^127(?:\.\d{1,3}){3}$/
+
+const isLocalHostname = (hostname) => {
+  return localhostRegex.test(hostname) === true || loopbackRegex.test(hostname) === true || hostname === '[::1]'
+}
+
+export default (url) => {
+  if (url == null || isLocalHostname(url.hostname) === true) return
+
+  return new URL('/favicon.ico', url).href
+}

test/utils/faviconUrl.js

@@ -0,0 +1,33 @@
+import test from 'ava'
+
+import faviconUrl from '../../src/utils/faviconUrl.js'
+
+test('return favicon URL for public hostnames', (t) => {
+  const result = faviconUrl(new URL('https://example.com/path'))
+
+  t.is(result, 'https://example.com/favicon.ico')
+})
+
+test('return nothing for localhost hostname', (t) => {
+  const result = faviconUrl(new URL('http://localhost:5173/path'))
+
+  t.is(result, undefined)
+})
+
+test('return nothing for localhost subdomains', (t) => {
+  const result = faviconUrl(new URL('http://app.localhost:5173/path'))
+
+  t.is(result, undefined)
+})
+
+test('return nothing for IPv4 loopback hostname', (t) => {
+  const result = faviconUrl(new URL('http://127.0.0.1:5173/path'))
+
+  t.is(result, undefined)
+})
+
+test('return nothing for IPv6 loopback hostname', (t) => {
+  const result = faviconUrl(new URL('http://[::1]:5173/path'))
+
+  t.is(result, undefined)
+})