Find the SSRF bug in this generated preview helper.
JavaScript
async function preview(input) {
const target = new URL(input);
if (!target.hostname.endsWith('example.com')) throw new Error('blocked');
return fetch(target, { redirect: 'follow' });
}