fix: URLs to internal resources should not be sent to Iframely

shared/utils/urls.ts

@@ -1,6 +1,6 @@
 import escapeRegExp from "lodash/escapeRegExp";
 import env from "../env";
-import { parseDomain } from "./domains";
+import { getBaseDomain, parseDomain } from "./domains";
 
 /**
  * Prepends the CDN url to the given path (If a CDN is configured).
@@ -15,10 +15,6 @@ export function cdnPath(path: string): string {
 /**
  * Returns true if the given string is a link to inside the application.
  *
- * Important Note: If this is called server-side, it will always return false.
- * The reason this is in a shared util is because it's used in an editor plugin
- * which is also in the shared code
- *
  * @param url The url to check.
  * @returns True if the url is internal, false otherwise.
  */
@@ -36,10 +32,10 @@ export function isInternalUrl(href: string) {
   const outline =
     typeof window !== "undefined"
       ? parseDomain(window.location.href)
-      : undefined;
-
+      : parseDomain(env.URL);
   const domain = parseDomain(href);
-  return outline?.host === domain.host;
+
+  return outline.host === domain.host || domain.host.endsWith(getBaseDomain());
 }
 
 /**