refac

src/lib/utils/safeImageUrl.ts

@@ -11,18 +11,20 @@ const PLACEHOLDER_IMAGE = '/favicon.png';
  *   - data:image/* URIs
  *   - Same-origin URLs (starting with WEBUI_BASE_URL)
  *   - Gravatar URLs (https://www.gravatar.com/avatar/)
+ *   - External HTTP(S) URLs when allowExternal is true
  *
- * All other URLs (including arbitrary http(s):// origins) are rejected to
- * prevent client-side IP/UA/Referer leaks to attacker-controlled servers.
+ * All other URLs (including arbitrary http(s):// origins by default) are
+ * rejected to prevent client-side IP/UA/Referer leaks to attacker-controlled servers.
  */
-export function safeImageUrl(url: string): string {
+export function safeImageUrl(url: string, allowExternal = false): string {
 	if (!url || url === '') {
 		return `${WEBUI_BASE_URL}${PLACEHOLDER_IMAGE}`;
 	}
 
 	if (
-		url.startsWith(WEBUI_BASE_URL) ||
+		(WEBUI_BASE_URL && url.startsWith(WEBUI_BASE_URL)) ||
 		url.startsWith('https://www.gravatar.com/avatar/') ||
+		(allowExternal && /^https?:\/\//i.test(url)) ||
 		url.startsWith('data:') ||
 		url.startsWith('/')
 	) {