From 5bafc4aec6bb63d02e06cadc3c5340774e60c12e Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Wed, 23 Sep 2026 23:16:53 +0000
Subject: [PATCH] fix: multi_agent.cwe-918 security vulnerability

Automated security fix generated by OrbisAI Security
---
 src/core/file/infrastructure/adapter/file.store.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/core/file/infrastructure/adapter/file.store.js b/src/core/file/infrastructure/adapter/file.store.js
index f16224cce..e7945232e 100644
--- a/src/core/file/infrastructure/adapter/file.store.js
+++ b/src/core/file/infrastructure/adapter/file.store.js
@@ -10,7 +10,11 @@ export class FileStore {
    * @return {Promise<any>}
    */
   async downloadXlsxFileAndConvertToJson(url) {
-    return fetch(url)
+    const parsedUrl = new URL(url);
+    if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+      throw new Error(`Unsupported protocol for url: ${url}`);
+    }
+    return fetch(parsedUrl)
       .then((res) => res.arrayBuffer())
       .then((buffer) =>
         this.#excelWorkBookToJson(XLSX.read(buffer, { type: 'string', raw: false }))