Repository: FlowiseAI/Flowise
File: packages/server/src/index.ts (TypeScript)

Code before:
                })
            } catch (e: any) {
                return res.json({ status: 'ERROR', repos: [] })
            }
        })

        // ----------------------------------------
        // Prediction
        // ----------------------------------------

        // Send input message and get prediction result (External)
        this.app.post(
            '/api/v1/prediction/:id',
            upload.array('files'),
            (req: Request, res: Response, next: NextFunction) => getRateLimiter(req, res, next),
            async (req: Request, res: Response) => {
                const chatflow = await this.AppDataSource.getRepository(ChatFlow).findOneBy({
                    id: req.params.id
                })
                if (!chatflow) return res.status(404).send(`Chatflow ${req.params.id} not found`)
                let isDomainAllowed = true
                logger.info(`[server]: Request originated from ${req.headers.origin}`)
                if (chatflow.chatbotConfig) {
                    const parsedConfig = JSON.parse(chatflow.chatbotConfig)
                    // check whether the first one is not empty. if it is empty that means the user set a value and then removed it.
                    const isValidAllowedOrigins = parsedConfig.allowedOrigins[0] !== ''
                    if (parsedConfig.allowedOrigins && parsedConfig.allowedOrigins.length > 0 && isValidAllowedOrigins) {
                        const originHeader = req.headers.origin as string
                        const origin = new URL(originHeader).host
                        isDomainAllowed =
                            parsedConfig.allowedOrigins.filter((domain: string) => {
                                const allowedOrigin = new URL(domain).host
                                return origin === allowedOrigin
                            }).length > 0
                    }
                }

                if (isDomainAllowed) {
                    await this.buildChatflow(req, res, socketIO)
                } else {
                    return res.status(401).send(`This site is not allowed to access this chatbot`)
                }
            }
        )

        // Send input message and get prediction result (Internal)
        this.app.post('/api/v1/internal-prediction/:id', async (req: Request, res: Response) => {
            await this.buildChatflow(req, res, socketIO, true)
        })

        // ----------------------------------------

Review comment (bug):
what if `parsedConfig` doesn't have the property `allowedOrigins`, will it fails?
shouldn't we do something like `parsedConfig.allowedOrigins?.length && parsedConfig.allowedOrigins[0] !== ''` ?

Code after:
                })
            } catch (e: any) {
                return res.json({ status: 'ERROR', repos: [] })
            }
        })

        // ----------------------------------------
        // Prediction
        // ----------------------------------------

        // Send input message and get prediction result (External)
        this.app.post(
            '/api/v1/prediction/:id',
            upload.array('files'),
            (req: Request, res: Response, next: NextFunction) => getRateLimiter(req, res, next),
            async (req: Request, res: Response) => {
                const chatflow = await this.AppDataSource.getRepository(ChatFlow).findOneBy({
                    id: req.params.id
                })
                if (!chatflow) return res.status(404).send(`Chatflow ${req.params.id} not found`)
                let isDomainAllowed = true
                logger.info(`[server]: Request originated from ${req.headers.origin}`)
                if (chatflow.chatbotConfig) {
                    const parsedConfig = JSON.parse(chatflow.chatbotConfig)
                    // check whether the first one is not empty. if it is empty that means the user set a value and then removed it.
                    const isValidAllowedOrigins = parsedConfig.allowedOrigins?.length && parsedConfig.allowedOrigins[0] !== ''
                    if (isValidAllowedOrigins) {
                        const originHeader = req.headers.origin as string
                        const origin = new URL(originHeader).host
                        isDomainAllowed =
                            parsedConfig.allowedOrigins.filter((domain: string) => {
                                try {
                                    const allowedOrigin = new URL(domain).host
                                    return origin === allowedOrigin
                                } catch (e) {
                                    return false
                                }
                            }).length > 0
                    }
                }

                if (isDomainAllowed) {
                    await this.buildChatflow(req, res, socketIO)
                } else {
                    return res.status(401).send(`This site is not allowed to access this chatbot`)
                }
            }
        )

        // Send input message and get prediction result (Internal)
        this.app.post('/api/v1/internal-prediction/:id', async (req: Request, res: Response) => {