Update features and dependencies

2026-07-01 11:10:37 +02:00
parent 9d9dfb46c6
commit 8b57a3fd87
107 changed files with 14654 additions and 458 deletions
@@ -0,0 +1,56 @@
+import dns from "node:dns/promises";
+
+function isPrivateAddress(ip: string): boolean {
+  const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const [, a, b, c] = v4.map(Number) as [number, number, number, number, number];
+    if (a === 127) return true;
+    if (a === 10) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 169 && b === 254) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fe80:")) return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  const v4mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4mapped) return isPrivateAddress(v4mapped[1]!);
+  return false;
+}
+
+/**
+ * Returns an error string if the URL is disallowed (SSRF), or null if safe.
+ * Blocks non-http(s) schemes, RFC-1918, loopback, link-local, cloud metadata.
+ */
+export async function validateWebhookUrl(rawUrl: string): Promise<string | null> {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return "Invalid URL";
+  }
+
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    return "Webhook URL must use http or https";
+  }
+
+  let addresses: string[];
+  try {
+    const results = await dns.lookup(url.hostname, { all: true, family: 0 });
+    addresses = results.map((r) => r.address);
+  } catch {
+    return "Unable to resolve webhook hostname";
+  }
+
+  for (const addr of addresses) {
+    if (isPrivateAddress(addr)) {
+      return "Webhook URL must not point to a private or reserved address";
+    }
+  }
+
+  return null;
+}