Prerequisites

• You have permission to manage MergeUp configuration metadata and edit the applicable MergeUp Template records.
• You know the public image hosts used by the IMAGE commands in the Templates you plan to protect.

Overview

IMAGE command URL security controls let administrators limit the initial public image URLs in a Template to approved hosts. The controls align MergeUp more closely with Salesforce security best practices and the Salesforce Trusted URL framework. When enforcement applies, MergeUp checks the initial URL supplied to the IMAGE command before retrieving an image.

Use these controls to approve the public hosts that your Templates need while preventing IMAGE commands from directly requesting images from unapproved hosts.

How Enforcement Is Determined

The org-wide Enforce External URL Allowlist setting in MergeUp Global Configuration is the first decision point. If it is disabled, missing, or null, allowlist enforcement is disabled for every Template, regardless of the Template setting.

When global enforcement is enabled, the Template's External URL Allowlist Mode determines the effective allowlist:

Template mode	Result when global enforcement is enabled
Use Global Allowlist	MergeUp enforces the global domain list.
Add Template Domains	MergeUp enforces the combined global and Template-specific domain lists.
Disable for This Template	MergeUp does not enforce the allowlist for that Template.

A blank or null Template mode has the same effect as Use Global Allowlist. This allows existing Templates to inherit the global behavior without requiring a record update.

Steps

1. Review the hosts used by the initial public HTTPS URLs in your Templates' IMAGE commands.

2. Create or update an External URL Allowed Domain custom metadata record for each globally approved host. Enter one host pattern in the Domain field and select Enabled to include it in the allowlist.

3. Use an exact host such as images.example.com to allow only that host. Use an explicit wildcard such as *.example.com to allow subdomains such as cdn.example.com; it does not allow example.com. Add both patterns when you need to allow both the apex host and its subdomains.

4. Enter host patterns only. Do not include a scheme, port, path, query string, fragment, or user information. Host matching is case-insensitive; a pattern applies to HTTPS URLs on all ports.

5. For a Template that needs additional image hosts, set External URL Allowlist Mode to Add Template Domains and add one host pattern per line to External URL Allowed Domains. These entries are added to the global list for that Template.

6. For a Template that should use only the global list, select Use Global Allowlist or leave the mode blank. Select Disable for This Template only when you deliberately need to exempt that Template.

7. In a sandbox, merge representative documents for each affected Template. Test an approved initial image URL, an unapproved initial image URL, and any approved URLs that redirect.

8. After the sandbox tests succeed, enable Enforce External URL Allowlist in the MergeUp Global Configuration metadata. Repeat the representative merge tests before enabling the setting in production.

Security Considerations

• With global enforcement disabled, no Template is protected by the External URL allowlist.
• A Template set to Disable for This Template is exempt even when global enforcement is enabled. Use this mode sparingly and review it regularly.
• Public IMAGE URLs must be complete HTTPS URLs. URLs that use another scheme, contain credentials, use an IP address or single-label hostname, or target a disallowed hostname result in a merge error.
• When allowlist enforcement is enabled, MergeUp checks the initial IMAGE URL and follows its redirects. Redirect destinations are not compared separately with the allowlist, so approve only initial hosts whose redirect behavior you trust. When enforcement is disabled, redirected IMAGE URLs are rejected.
• When enforcement is enabled, an invalid domain pattern results in a merge error. An empty allowlist blocks every public IMAGE URL for Templates where enforcement applies.
• When a URL is blocked, the merge and Merge Log provide an error that identifies the IMAGE URL allowlist issue. Correct the URL or allow the required host, then test the Template again.

Notes

New Bellatrix installations have Enforce External URL Allowlist enabled by default. For orgs that already had MergeUp before Bellatrix is pushed, the setting remains disabled by default to preserve current Template behavior. Before configuring the controls, administrators must add the new fields to their Salesforce layouts. See Bellatrix Post-Install Steps.

Next Steps

• Bellatrix Post-Install Steps
• MergeUp Global Configuration
• About IMAGE
• IMAGE in Word
• IMAGE in PowerPoint