Function validatePublicHttpUrl

packages/backend/src/utils/ssrfProtection.ts:34–78

(
    rawUrl: string,
    options: {
        allowedProtocols?: string[];
        allowPrivateAddresses?: boolean;
    } = {},
)

};

export const validatePublicHttpUrl = async (
    rawUrl: string,
    options: {
        allowedProtocols?: string[];
        allowPrivateAddresses?: boolean;
    } = {},
): Promise<URL> => {
    const allowedProtocols = options.allowedProtocols ?? ['https:'];

    let parsedUrl: URL;
    try {
        parsedUrl = new URL(rawUrl);
    } catch {
        throw new ParameterError(INVALID_URL_ERROR_MESSAGE);
    }

    if (!allowedProtocols.includes(parsedUrl.protocol)) {
        throw new ParameterError(INVALID_PROTOCOL_ERROR_MESSAGE);
    }

    if (parsedUrl.username || parsedUrl.password) {
        throw new ParameterError(URL_CREDENTIALS_ERROR_MESSAGE);
    }

    if (options.allowPrivateAddresses) {
        return parsedUrl;
    }

    if (isPrivateAddress(parsedUrl.hostname)) {
        throw new ParameterError(PRIVATE_ADDRESS_ERROR_MESSAGE);
    }

    let addresses: { address: string }[];
    try {
        addresses = await lookup(parsedUrl.hostname, { all: true });
    } catch {
        throw new ParameterError(HOSTNAME_LOOKUP_ERROR_MESSAGE);
    }

    if (addresses.some(({ address }) => isPrivateAddress(address))) {
        throw new ParameterError(PRIVATE_ADDRESS_ERROR_MESSAGE);
    }

    return parsedUrl;
};