@atproto-labs/fetch-node 0.0.1

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# @atproto-labs/fetch-node
+
+## 0.0.1
+
+### Patch Changes
+
+- [`e134c79a0`](https://github.com/bluesky-social/atproto/commit/e134c79a0ffb000b2cb36437815673fa6bda664b) Thanks [@devinivy](https://github.com/devinivy)! - Initial publish of experimental oauth packages to @atproto-labs
+
+- Updated dependencies [[`e134c79a0`](https://github.com/bluesky-social/atproto/commit/e134c79a0ffb000b2cb36437815673fa6bda664b)]:
+  - @atproto-labs/transformer@0.0.1
+  - @atproto-labs/fetch@0.0.1

package/LICENSE.txt

@@ -0,0 +1,7 @@
+Dual MIT/Apache-2.0 License
+
+Copyright (c) 2022-2024 Bluesky PBC, and Contributors
+
+Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
+
+Downstream projects and end users may chose either license individually, or both together, at their discretion. The motivation for this dual-licensing is the additional software patent assurance provided by Apache 2.0.

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './safe.js';
+export * from './ssrf.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA"}

package/dist/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./safe.js"), exports);
+__exportStar(require("./ssrf.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAAyB;AACzB,4CAAyB"}

package/dist/safe.d.ts

@@ -0,0 +1,16 @@
+import { Fetch } from '@atproto-labs/fetch';
+export type SafeFetchWrapOptions = NonNullable<Parameters<typeof safeFetchWrap>[0]>;
+/**
+ * Wrap a fetch function with safety checks so that it can be safely used
+ * with user provided input (URL).
+ */
+export declare const safeFetchWrap: ({ fetch, responseMaxSize, allowHttp, allowData, ssrfProtection, timeout, forbiddenDomainNames, }?: {
+    fetch?: Fetch | undefined;
+    responseMaxSize?: number | undefined;
+    allowHttp?: boolean | undefined;
+    allowData?: boolean | undefined;
+    ssrfProtection?: boolean | undefined;
+    timeout?: number | undefined;
+    forbiddenDomainNames?: Iterable<string> | undefined;
+}) => Fetch;
+//# sourceMappingURL=safe.d.ts.map

package/dist/safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.d.ts","sourceRoot":"","sources":["../src/safe.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,EAMN,MAAM,qBAAqB,CAAA;AAK5B,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAC5C,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CACpC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;MAQjB,KA4CN,CAAA"}

package/dist/safe.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeFetchWrap = void 0;
+const fetch_1 = require("@atproto-labs/fetch");
+const transformer_1 = require("@atproto-labs/transformer");
+const ssrf_js_1 = require("./ssrf.js");
+/**
+ * Wrap a fetch function with safety checks so that it can be safely used
+ * with user provided input (URL).
+ */
+const safeFetchWrap = ({ fetch = globalThis.fetch, responseMaxSize = 512 * 1024, // 512kB
+allowHttp = false, allowData = false, ssrfProtection = true, timeout = 10e3, forbiddenDomainNames = fetch_1.DEFAULT_FORBIDDEN_DOMAIN_NAMES, } = {}) => (0, transformer_1.compose)(
+/**
+ * Prevent using http:, file: or data: protocols.
+ */
+(0, fetch_1.protocolCheckRequestTransform)(['https:']
+    .concat(allowHttp ? ['http:'] : [])
+    .concat(allowData ? ['data:'] : [])), 
+/**
+ * Only requests that will be issued with a "Host" header are allowed.
+ */
+(0, fetch_1.requireHostHeaderTranform)(), 
+/**
+ * Disallow fetching from domains we know are not atproto/OIDC client
+ * implementation. Note that other domains can be blocked by providing a
+ * custom fetch function combined with another
+ * forbiddenDomainNameRequestTransform.
+ */
+(0, fetch_1.forbiddenDomainNameRequestTransform)(forbiddenDomainNames), 
+/**
+ * Since we will be fetching from the network based on user provided
+ * input, let's mitigate resource exhaustion attacks by setting a timeout.
+ */
+(0, fetch_1.timeoutFetchWrap)({
+    timeout,
+    /**
+     * Since we will be fetching from the network based on user provided
+     * input, we need to make sure that the request is not vulnerable to SSRF
+     * attacks.
+     */
+    fetch: ssrfProtection ? (0, ssrf_js_1.ssrfFetchWrap)({ fetch }) : fetch,
+}), 
+/**
+ * Since we will be fetching user owned data, we need to make sure that an
+ * attacker cannot force us to download a large amounts of data.
+ */
+(0, fetch_1.fetchMaxSizeProcessor)(responseMaxSize));
+exports.safeFetchWrap = safeFetchWrap;
+//# sourceMappingURL=safe.js.map

package/dist/safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe.js","sourceRoot":"","sources":["../src/safe.ts"],"names":[],"mappings":";;;AAAA,+CAQ4B;AAC5B,2DAAmD;AAEnD,uCAAyC;AAMzC;;;GAGG;AACI,MAAM,aAAa,GAAG,CAAC,EAC5B,KAAK,GAAG,UAAU,CAAC,KAAc,EACjC,eAAe,GAAG,GAAG,GAAG,IAAI,EAAE,QAAQ;AACtC,SAAS,GAAG,KAAK,EACjB,SAAS,GAAG,KAAK,EACjB,cAAc,GAAG,IAAI,EACrB,OAAO,GAAG,IAAc,EACxB,oBAAoB,GAAG,sCAAkD,MACvE,EAAE,EAAS,EAAE,CACf,IAAA,qBAAO;AACL;;GAEG;AACH,IAAA,qCAA6B,EAC3B,CAAC,QAAQ,CAAC;KACP,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACtC;AAED;;GAEG;AACH,IAAA,iCAAyB,GAAE;AAE3B;;;;;GAKG;AACH,IAAA,2CAAmC,EAAC,oBAAoB,CAAC;AAEzD;;;GAGG;AACH,IAAA,wBAAgB,EAAC;IACf,OAAO;IAEP;;;;OAIG;IACH,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAA,uBAAa,EAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;CACzD,CAAC;AAEF;;;GAGG;AACH,IAAA,6BAAqB,EAAC,eAAe,CAAC,CACvC,CAAA;AApDU,QAAA,aAAa,iBAoDvB"}

package/dist/ssrf.d.ts

@@ -0,0 +1,6 @@
+import { Fetch } from '@atproto-labs/fetch';
+export type SsrfSafeFetchWrapOptions = NonNullable<Parameters<typeof ssrfFetchWrap>[0]>;
+export declare const ssrfFetchWrap: ({ fetch, }?: {
+    fetch?: Fetch | undefined;
+}) => Fetch;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAc,MAAM,qBAAqB,CAAA;AAKvD,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAChD,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CACpC,CAAA;AACD,eAAO,MAAM,aAAa;;MAEjB,KA0CR,CAAA"}

package/dist/ssrf.js

@@ -0,0 +1,91 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssrfFetchWrap = void 0;
+const node_dns_1 = __importStar(require("node:dns"));
+const fetch_1 = require("@atproto-labs/fetch");
+const ipaddr_js_1 = __importDefault(require("ipaddr.js"));
+const { IPv4, IPv6 } = ipaddr_js_1.default;
+const ssrfFetchWrap = ({ fetch = globalThis.fetch, } = {}) => {
+    const ssrfSafeFetch = async (request) => {
+        const { protocol, hostname } = new URL(request.url);
+        if (protocol === 'http:' || protocol === 'https:') {
+            if (request.redirect === 'follow') {
+                // TODO: actually implement by calling ssrfSafeFetch recursively (?)
+                throw new fetch_1.FetchError(500, 'Request redirect must be "error" or "manual" when SSRF is enabled', { request });
+            }
+            // Make sure the hostname is a unicast IP address
+            const ip = await hostnameLookup(hostname).catch((cause) => {
+                throw cause?.code === 'ENOTFOUND'
+                    ? new fetch_1.FetchError(400, `Invalid hostname ${hostname}`, {
+                        request,
+                        cause,
+                    })
+                    : new fetch_1.FetchError(500, `Unable resolve DNS for ${hostname}`, {
+                        request,
+                        cause,
+                    });
+            });
+            if (ip.range() !== 'unicast') {
+                throw new fetch_1.FetchError(400, `Invalid hostname IP address ${ip}`, {
+                    request,
+                });
+            }
+        }
+        else if (protocol === 'data:') {
+            // No SSRF issue
+        }
+        else {
+            // blob: about: file: all should be rejected
+            throw new fetch_1.FetchError(400, `Forbidden protocol ${protocol}`, { request });
+        }
+        return fetch(request);
+    };
+    return ssrfSafeFetch;
+};
+exports.ssrfFetchWrap = ssrfFetchWrap;
+async function hostnameLookup(hostname) {
+    if (IPv4.isIPv4(hostname)) {
+        return IPv4.parse(hostname);
+    }
+    if (hostname.startsWith('[') && hostname.endsWith(']')) {
+        return IPv6.parse(hostname.slice(1, -1));
+    }
+    return domainLookup(hostname);
+}
+async function domainLookup(domain) {
+    const addr = await node_dns_1.promises.lookup(domain, {
+        hints: node_dns_1.default.ADDRCONFIG | node_dns_1.default.V4MAPPED,
+    });
+    const ip = addr.family === 4 ? IPv4.parse(addr.address) : IPv6.parse(addr.address);
+    if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {
+        return ip.toIPv4Address();
+    }
+    return ip;
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../src/ssrf.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,qDAAuD;AAEvD,+CAAuD;AACvD,0DAA8B;AAE9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,mBAAM,CAAA;AAKtB,MAAM,aAAa,GAAG,CAAC,EAC5B,KAAK,GAAG,UAAU,CAAC,KAAc,MAC/B,EAAE,EAAS,EAAE;IACf,MAAM,aAAa,GAAU,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAEnD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClC,oEAAoE;gBACpE,MAAM,IAAI,kBAAU,CAClB,GAAG,EACH,mEAAmE,EACnE,EAAE,OAAO,EAAE,CACZ,CAAA;YACH,CAAC;YAED,iDAAiD;YACjD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxD,MAAM,KAAK,EAAE,IAAI,KAAK,WAAW;oBAC/B,CAAC,CAAC,IAAI,kBAAU,CAAC,GAAG,EAAE,oBAAoB,QAAQ,EAAE,EAAE;wBAClD,OAAO;wBACP,KAAK;qBACN,CAAC;oBACJ,CAAC,CAAC,IAAI,kBAAU,CAAC,GAAG,EAAE,0BAA0B,QAAQ,EAAE,EAAE;wBACxD,OAAO;wBACP,KAAK;qBACN,CAAC,CAAA;YACR,CAAC,CAAC,CAAA;YACF,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,kBAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,EAAE,EAAE;oBAC7D,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,gBAAgB;QAClB,CAAC;aAAM,CAAC;YACN,4CAA4C;YAC5C,MAAM,IAAI,kBAAU,CAAC,GAAG,EAAE,sBAAsB,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC,CAAA;IAED,OAAO,aAAa,CAAA;AACtB,CAAC,CAAA;AA5CY,QAAA,aAAa,iBA4CzB;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAA;AAC/B,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,mBAAW,CAAC,MAAM,CAAC,MAAM,EAAE;QAC5C,KAAK,EAAE,kBAAG,CAAC,UAAU,GAAG,kBAAG,CAAC,QAAQ;KACrC,CAAC,CAAA;IAEF,MAAM,EAAE,GACN,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEzE,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC,aAAa,EAAE,CAAA;IAC3B,CAAC;IAED,OAAO,EAAE,CAAA;AACX,CAAC"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@atproto-labs/fetch-node",
+  "version": "0.0.1",
+  "license": "MIT",
+  "description": "SSRF protection for fetch() in Node.js",
+  "keywords": [
+    "atproto",
+    "fetch",
+    "node"
+  ],
+  "homepage": "https://atproto.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bluesky-social/atproto",
+    "directory": "packages/fetch-node"
+  },
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "ipaddr.js": "^2.1.0",
+    "tslib": "^2.6.2",
+    "@atproto-labs/fetch": "0.0.1",
+    "@atproto-labs/transformer": "0.0.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.3.3"
+  },
+  "scripts": {
+    "build": "tsc --build tsconfig.json"
+  }
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from './safe.js'
+export * from './ssrf.js'

package/src/safe.ts

@@ -0,0 +1,74 @@
+import {
+  DEFAULT_FORBIDDEN_DOMAIN_NAMES,
+  Fetch,
+  fetchMaxSizeProcessor,
+  forbiddenDomainNameRequestTransform,
+  protocolCheckRequestTransform,
+  requireHostHeaderTranform,
+  timeoutFetchWrap,
+} from '@atproto-labs/fetch'
+import { compose } from '@atproto-labs/transformer'
+
+import { ssrfFetchWrap } from './ssrf.js'
+
+export type SafeFetchWrapOptions = NonNullable<
+  Parameters<typeof safeFetchWrap>[0]
+>
+
+/**
+ * Wrap a fetch function with safety checks so that it can be safely used
+ * with user provided input (URL).
+ */
+export const safeFetchWrap = ({
+  fetch = globalThis.fetch as Fetch,
+  responseMaxSize = 512 * 1024, // 512kB
+  allowHttp = false,
+  allowData = false,
+  ssrfProtection = true,
+  timeout = 10e3 as number,
+  forbiddenDomainNames = DEFAULT_FORBIDDEN_DOMAIN_NAMES as Iterable<string>,
+} = {}): Fetch =>
+  compose(
+    /**
+     * Prevent using http:, file: or data: protocols.
+     */
+    protocolCheckRequestTransform(
+      ['https:']
+        .concat(allowHttp ? ['http:'] : [])
+        .concat(allowData ? ['data:'] : []),
+    ),
+
+    /**
+     * Only requests that will be issued with a "Host" header are allowed.
+     */
+    requireHostHeaderTranform(),
+
+    /**
+     * Disallow fetching from domains we know are not atproto/OIDC client
+     * implementation. Note that other domains can be blocked by providing a
+     * custom fetch function combined with another
+     * forbiddenDomainNameRequestTransform.
+     */
+    forbiddenDomainNameRequestTransform(forbiddenDomainNames),
+
+    /**
+     * Since we will be fetching from the network based on user provided
+     * input, let's mitigate resource exhaustion attacks by setting a timeout.
+     */
+    timeoutFetchWrap({
+      timeout,
+
+      /**
+       * Since we will be fetching from the network based on user provided
+       * input, we need to make sure that the request is not vulnerable to SSRF
+       * attacks.
+       */
+      fetch: ssrfProtection ? ssrfFetchWrap({ fetch }) : fetch,
+    }),
+
+    /**
+     * Since we will be fetching user owned data, we need to make sure that an
+     * attacker cannot force us to download a large amounts of data.
+     */
+    fetchMaxSizeProcessor(responseMaxSize),
+  )

package/src/ssrf.ts

@@ -0,0 +1,86 @@
+import dns, { promises as dnsPromises } from 'node:dns'
+
+import { Fetch, FetchError } from '@atproto-labs/fetch'
+import ipaddr from 'ipaddr.js'
+
+const { IPv4, IPv6 } = ipaddr
+
+export type SsrfSafeFetchWrapOptions = NonNullable<
+  Parameters<typeof ssrfFetchWrap>[0]
+>
+export const ssrfFetchWrap = ({
+  fetch = globalThis.fetch as Fetch,
+} = {}): Fetch => {
+  const ssrfSafeFetch: Fetch = async (request) => {
+    const { protocol, hostname } = new URL(request.url)
+
+    if (protocol === 'http:' || protocol === 'https:') {
+      if (request.redirect === 'follow') {
+        // TODO: actually implement by calling ssrfSafeFetch recursively (?)
+        throw new FetchError(
+          500,
+          'Request redirect must be "error" or "manual" when SSRF is enabled',
+          { request },
+        )
+      }
+
+      // Make sure the hostname is a unicast IP address
+      const ip = await hostnameLookup(hostname).catch((cause) => {
+        throw cause?.code === 'ENOTFOUND'
+          ? new FetchError(400, `Invalid hostname ${hostname}`, {
+              request,
+              cause,
+            })
+          : new FetchError(500, `Unable resolve DNS for ${hostname}`, {
+              request,
+              cause,
+            })
+      })
+      if (ip.range() !== 'unicast') {
+        throw new FetchError(400, `Invalid hostname IP address ${ip}`, {
+          request,
+        })
+      }
+    } else if (protocol === 'data:') {
+      // No SSRF issue
+    } else {
+      // blob: about: file: all should be rejected
+      throw new FetchError(400, `Forbidden protocol ${protocol}`, { request })
+    }
+
+    return fetch(request)
+  }
+
+  return ssrfSafeFetch
+}
+
+async function hostnameLookup(
+  hostname: string,
+): Promise<ipaddr.IPv4 | ipaddr.IPv6> {
+  if (IPv4.isIPv4(hostname)) {
+    return IPv4.parse(hostname)
+  }
+
+  if (hostname.startsWith('[') && hostname.endsWith(']')) {
+    return IPv6.parse(hostname.slice(1, -1))
+  }
+
+  return domainLookup(hostname)
+}
+
+async function domainLookup(
+  domain: string,
+): Promise<ipaddr.IPv4 | ipaddr.IPv6> {
+  const addr = await dnsPromises.lookup(domain, {
+    hints: dns.ADDRCONFIG | dns.V4MAPPED,
+  })
+
+  const ip =
+    addr.family === 4 ? IPv4.parse(addr.address) : IPv6.parse(addr.address)
+
+  if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {
+    return ip.toIPv4Address()
+  }
+
+  return ip
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig/node.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}