Comment by erdbeerkaese

Unfortunately, the "sensible defaults" don't seem to check input URLs correctly and allow file:// URLs.

Just try ?url=file:///etc/passwd on the demo instance.

That seems to be a quite common issue with services like this built on generic libraries.