Fix critical SSRF vulnerability in attachment upload

[FaizanKolega]

Security Disclosure Notice

This PR addresses a security vulnerability identified by Kolega.dev as part of our automated security remediation platform validation.

Disclosure Timeline:

• December 10, 2025: Initial responsible disclosure sent to security@nocodb.com with full technical details, reproduction steps, and proposed fixes
• December 16, 2025: Follow-up sent noting the approaching 7-day SLA
• December 19, 2025: No acknowledgment received; PR submitted publicly per standard responsible disclosure practices

We attempted to coordinate privately through NocoDB's official security reporting channel. After exceeding the published response SLA without acknowledgment, we are proceeding with public disclosure to ensure the community can protect their deployments.

Vulnerability identified and fix provided by Kolega.dev (https://kolega.dev/)

Implement strict URL validation, block private IPs and metadata endpoints, disable dangerous protocols, validate redirects, and use URL parsing in the downloadAndStoreAttachment function to prevent Server-Side Request Forgery attacks.

Change Summary

Provide summary of changes with issue number if any.

Change type

• feat: (new feature for the user, not a new feature for build script)
• fix: (bug fix for the user, not a fix to a build script)
• docs: (changes to the documentation)
• style: (formatting, missing semi colons, etc; no production code change)
• refactor: (refactoring production code, eg. renaming a variable)
• test: (adding missing tests, refactoring tests; no production code change)
• chore: (updating grunt tasks etc; no production code change)

Test/ Verification

Provide summary of changes.

Additional information / screenshots (optional)

Anything for maintainers to be made aware of

Security Disclosure Notice

This PR addresses a security vulnerability identified by Kolega.dev as part of our automated security remediation platform validation.

Disclosure Timeline:

• December 10, 2025: Initial responsible disclosure sent to security@nocodb.com with full technical details, reproduction steps, and proposed fixes
• December 16, 2025: Follow-up sent noting the approaching 7-day SLA
• December 19, 2025: No acknowledgment received; PR submitted publicly per standard responsible disclosure practices

We attempted to coordinate privately through NocoDB's official security reporting channel. After exceeding the published response SLA without acknowledgment, we are proceeding with public disclosure to ensure the community can protect their deployments.

Vulnerability identified and fix provided by Kolega.dev