Spot the bug in the preview helper

from Server-side request forgery
Node 24 intermediate 4 min 2 issues to find

Find the SSRF bug in this generated preview helper.

JavaScript
async function preview(input) {
  const target = new URL(input);
  if (!target.hostname.endsWith('example.com')) throw new Error('blocked');
  return fetch(target, { redirect: 'follow' });
}
Open in playground
Report an error