|
| 1 | +import { lookup } from "node:dns/promises"; |
| 2 | +import { isIP } from "node:net"; |
| 3 | + |
| 4 | +export class UrlError extends Error { |
| 5 | + constructor(message: string) { |
| 6 | + super(message); |
| 7 | + this.name = "UrlError"; |
| 8 | + } |
| 9 | +} |
| 10 | + |
| 11 | +/** |
| 12 | + * Validates a URL to prevent SSRF attacks. |
| 13 | + */ |
| 14 | +export async function validatePublicUrl(url: string): Promise<void> { |
| 15 | + const parsed = new URL(url); |
| 16 | + if (parsed.protocol !== "http:" && parsed.protocol !== "https:") { |
| 17 | + throw new UrlError(`Unsupported protocol: ${parsed.protocol}`); |
| 18 | + } |
| 19 | + let hostname = parsed.hostname; |
| 20 | + if (hostname.startsWith("[") && hostname.endsWith("]")) { |
| 21 | + hostname = hostname.substring(1, hostname.length - 2); |
| 22 | + } |
| 23 | + if (hostname === "localhost") { |
| 24 | + throw new UrlError("Localhost is not allowed"); |
| 25 | + } |
| 26 | + if ("Deno" in globalThis && !isIP(hostname)) { |
| 27 | + // If the `net` permission is not granted, we can't resolve the hostname. |
| 28 | + // However, we can safely assume that it cannot gain access to private |
| 29 | + // resources. |
| 30 | + const netPermission = await Deno.permissions.query({ name: "net" }); |
| 31 | + if (netPermission.state !== "granted") return; |
| 32 | + } |
| 33 | + const { address, family } = await lookup(hostname); |
| 34 | + if ( |
| 35 | + family === 4 && !isValidPublicIPv4Address(address) || |
| 36 | + family === 6 && !isValidPublicIPv6Address(address) || |
| 37 | + family < 4 || family === 5 || family > 6 |
| 38 | + ) { |
| 39 | + throw new UrlError(`Invalid or private address: ${address}`); |
| 40 | + } |
| 41 | +} |
| 42 | + |
| 43 | +export function isValidPublicIPv4Address(address: string): boolean { |
| 44 | + const parts = address.split("."); |
| 45 | + const first = parseInt(parts[0]); |
| 46 | + if (first === 0 || first === 10 || first === 127) return false; |
| 47 | + const second = parseInt(parts[1]); |
| 48 | + if (first === 169 && second === 254) return false; |
| 49 | + if (first === 172 && second >= 16 && second <= 31) return false; |
| 50 | + if (first === 192 && second === 168) return false; |
| 51 | + return true; |
| 52 | +} |
| 53 | + |
| 54 | +export function isValidPublicIPv6Address(address: string) { |
| 55 | + address = expandIPv6Address(address); |
| 56 | + if (address.at(4) !== ":") return false; |
| 57 | + const firstWord = parseInt(address.substring(0, 4), 16); |
| 58 | + return !( |
| 59 | + (firstWord >= 0xfc00 && firstWord <= 0xfdff) || // ULA |
| 60 | + (firstWord >= 0xfe80 && firstWord <= 0xfebf) || // Link-local |
| 61 | + firstWord === 0 || firstWord >= 0xff00 // Multicast |
| 62 | + ); |
| 63 | +} |
| 64 | + |
| 65 | +export function expandIPv6Address(address: string): string { |
| 66 | + address = address.toLowerCase(); |
| 67 | + if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000"; |
| 68 | + if (address.startsWith("::")) address = "0000" + address; |
| 69 | + if (address.endsWith("::")) address = address + "0000"; |
| 70 | + address = address.replace( |
| 71 | + "::", |
| 72 | + ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":", |
| 73 | + ); |
| 74 | + const parts = address.split(":"); |
| 75 | + return parts.map((part) => part.padStart(4, "0")).join(":"); |
| 76 | +} |
0 commit comments