> C) These white or blacklists are circumvented due to bad parsing The main problem is that the parsing is inconsistent between different subsystems, i.e. the

> C) These white or blacklists are circumvented due to bad parsing The main problem is that the parsing is inconsistent between different subsystems, i.e. the parse function interprets the URL one way and the fetch function interprets the URL in another way. This is why I think the most practical solution is to add another layer of validation that checks that a given URL belongs to a very small subset of all valid URLs that is interpreted consistently across all your functions.