block user HTTP requests to backend API

src/extensions.js

@@ -385,6 +385,7 @@ SnapExtensions.primitives.set(
     'xhr_request(mth, url, dta, hdrs)',
     function (method, url, data, headers, proc) {
         var response, i, header;
+        Process.prototype.checkURLAllowed(url);
         if (!proc.httpRequest) {
             proc.httpRequest = new XMLHttpRequest();
             proc.httpRequest.open(method, url, true);

src/threads.js

@@ -3632,6 +3632,7 @@ Process.prototype.reportLastAnswer = function () {
 
 Process.prototype.reportURL = function (url) {
     var response;
+    this.checkURLAllowed(url);
     if (!this.httpRequest) {
         // use the location protocol unless the user specifies otherwise
         if (url.indexOf('//') < 0 || url.indexOf('//') > 8) {
@@ -3663,6 +3664,14 @@ Process.prototype.reportURL = function (url) {
     this.pushContext();
 };
 
+Process.prototype.checkURLAllowed = function (url) {
+    if ([ 'users', 'logout', 'projects', 'collections' ].some(
+        which => url.match(`snap\.berkeley\.edu.*${which}`))
+    ) {
+        throw new Error('Request blocked');
+    }
+};
+
 // Process event messages primitives
 
 Process.prototype.doBroadcast = function (message) {