SSRF Guards

import { lookup } from "node:dns/promises";
import ipaddr from "ipaddr.js";
 
const BLOCKED = new Set(["private", "loopback", "linkLocal", "uniqueLocal", "carrierGradeNat"]);
 
async function assertSafeUrl(raw: string): Promise<URL> {
  const url = new URL(raw);
  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Invalid protocol");
  const { address } = await lookup(url.hostname);
  const range = ipaddr.parse(address).range();
  if (BLOCKED.has(range)) throw new Error("Blocked destination");
  return url;
}

import { lookup } from "node:dns/promises";
import ipaddr from "ipaddr.js";
 
const METADATA_HOSTS = new Set(["169.254.169.254", "metadata.google.internal"]);
const ALLOWED_HOSTS = new Set(["api.stripe.com", "hooks.slack.com"]);
 
const BLOCKED_RANGES = new Set([
  "private", "loopback", "linkLocal", "uniqueLocal", "carrierGradeNat", "multicast",
]);
 
async function resolveAndValidate(hostname: string): Promise<void> {
  if (METADATA_HOSTS.has(hostname)) throw new SsrfError("Blocked host");
  const records = await lookup(hostname, { all: true });
  for (const { address } of records) {
    const range = ipaddr.parse(address).range();
    if (BLOCKED_RANGES.has(range)) throw new SsrfError(`Blocked IP range: ${range}`);
  }
}
 
class SsrfError extends Error {
  constructor(message: string) {
    super(message);
    this.name = "SsrfError";
  }
}
 
async function safeFetch(raw: string, init?: RequestInit): Promise<Response> {
  const url = new URL(raw);
  if (!["http:", "https:"].includes(url.protocol)) throw new SsrfError("Invalid protocol");
  if (process.env.SSRF_ALLOWLIST === "true" && !ALLOWED_HOSTS.has(url.hostname)) {
    throw new SsrfError("Host not allowlisted");
  }
  await resolveAndValidate(url.hostname);
  return fetch(url, {
    ...init,
    redirect: "manual",
    signal: AbortSignal.timeout(init?.signal ? undefined : 5_000),
  });
}
 
// Express route
import express from "express";
import { z } from "zod";
 
const app = express();
app.use(express.json());
 
app.post("/import", async (req, res) => {
  const { sourceUrl } = z.object({ sourceUrl: z.string().url() }).parse(req.body);
  try {
    const response = await safeFetch(sourceUrl);
    if (response.status >= 300 && response.status < 400) {
      return res.status(400).json({ error: "Redirects not allowed" });
    }
    res.json({ size: (await response.arrayBuffer()).byteLength });
  } catch (err) {
    if (err instanceof SsrfError) return res.status(400).json({ error: err.message });
    throw err;
  }
});

const parsed = ipaddr.parse(address);
if (parsed.kind() === "ipv6") {
  const ipv4 = parsed.isIPv4MappedAddress() ? parsed.toIPv4Address() : parsed;
  // check range on mapped form
}

const ALLOWED = /\.stripe\.com$/;
if (!ALLOWED.test(url.hostname)) throw new SsrfError("Not allowed");