@blinklabs/dingo 0.85.0 → 0.87.1

package/npm/checksums.json

@@ -1,8 +1,8 @@
 {
-  "dingo-v0.85.0-darwin-amd64.tar.gz": "270c3751a34f24e2a8cd5fb93112dce6af60ef02c12e4064f4f9c2cfa6151cfe",
-  "dingo-v0.85.0-darwin-arm64.tar.gz": "b77938960005799c108464e62a8384c99fc9d7df74f1ecf63a61660585759c1c",
-  "dingo-v0.85.0-freebsd-amd64.tar.gz": "1cafd0d142b0c95236814f57ecc58cfca75eac8242121ac55bc7288ec0390db3",
-  "dingo-v0.85.0-freebsd-arm64.tar.gz": "2ea82ef8ac5945417726d5c9c9e068dbafb7361444147bba327ceca455d54bd2",
-  "dingo-v0.85.0-linux-amd64.tar.gz": "e3b14ae3d05e4b8dd3eda1f869f8fabdf2214f61a1fc185df54f4e7272c7f34d",
-  "dingo-v0.85.0-linux-arm64.tar.gz": "b7d45e45b7a2809f2e4d671a978c1697b1c17e53e785166b6875867c81714657"
+  "dingo-v0.87.1-darwin-amd64.tar.gz": "3f2be9c9d7c6b39b2d21dc6e0a790377abad16a26ad8ee90df4ab3f01bf99489",
+  "dingo-v0.87.1-darwin-arm64.tar.gz": "bfd4f467cdd3b76a3bb4b68cb141a8515821aa73dea5abdb395544a5ec170454",
+  "dingo-v0.87.1-freebsd-amd64.tar.gz": "a07ca436f12c27cb8ea8d02a454f5ec7f9a21da02fde9f1b6c1426f33dbf8f1a",
+  "dingo-v0.87.1-freebsd-arm64.tar.gz": "4df1766807ff002cda6be85922706ef26197d884602c3311683ae477430b32e9",
+  "dingo-v0.87.1-linux-amd64.tar.gz": "7d6ecaefa1aee4de0713fb31af4cb2566126c8c865e26c1a6dbacf672ea73a2e",
+  "dingo-v0.87.1-linux-arm64.tar.gz": "f703da349302257e441478d7b9290e85e35a6853ff3b65cdb44727845d573e2a"
 }

package/npm/install.js

@@ -13,9 +13,11 @@
 'use strict';
 
 const crypto = require('node:crypto');
+const dns = require('node:dns');
 const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const https = require('node:https');
+const net = require('node:net');
 const os = require('node:os');
 const path = require('node:path');
 const { spawn } = require('node:child_process');
@@ -25,6 +27,97 @@ const { pipeline } = require('node:stream/promises');
 const MAX_ARCHIVE_BYTES = 256 * 1024 * 1024;
 const MAX_BINARY_BYTES = 512 * 1024 * 1024;
 const RETRY_DELAYS_MS = [100, 500];
+const RELEASE_HOSTS = new Set([
+  'github.com',
+  'github-releases.githubusercontent.com',
+  'objects.githubusercontent.com',
+  'release-assets.githubusercontent.com',
+]);
+
+// The two families are kept in separate lists because a Node BlockList matches
+// every IPv4 address against an IPv6 rule covering ::ffff:0:0/96, which would
+// reject all IPv4 answers. IPv4-mapped IPv6 answers are unmapped instead and
+// checked against the IPv4 rules.
+const blockedIPv4 = new net.BlockList();
+for (const [network, prefix] of [
+  ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
+  ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
+  ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+  ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
+]) blockedIPv4.addSubnet(network, prefix, 'ipv4');
+const blockedIPv6 = new net.BlockList();
+for (const [network, prefix] of [
+  ['::', 128], ['::1', 128], ['64:ff9b::', 96], ['64:ff9b:1::', 48],
+  ['100::', 64], ['2001:2::', 48], ['2001:db8::', 32], ['2001:10::', 28],
+  ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+]) blockedIPv6.addSubnet(network, prefix, 'ipv6');
+
+function mappedIPv4(address) {
+  let host;
+  try {
+    // URL serialization canonicalizes every IPv6 spelling to compressed hex.
+    host = new URL(`http://[${address}]`).hostname;
+  } catch {
+    return null;
+  }
+  const match = /^\[::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})\]$/.exec(host);
+  if (!match) return null;
+  const high = parseInt(match[1], 16);
+  const low = parseInt(match[2], 16);
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+
+function disallowedAddress(address) {
+  try {
+    if (net.isIPv4(address)) return blockedIPv4.check(address, 'ipv4');
+    if (!net.isIPv6(address)) return true;
+    const ipv4 = mappedIPv4(address);
+    if (ipv4) return blockedIPv4.check(ipv4, 'ipv4');
+    return blockedIPv6.check(address, 'ipv6');
+  } catch {
+    return true;
+  }
+}
+
+function validateReleaseURL(parsed) {
+  if (parsed.protocol !== 'https:') {
+    throw new Error('Dingo release downloads require HTTPS');
+  }
+  if (parsed.username || parsed.password || (parsed.port && parsed.port !== '443')) {
+    throw new Error('Dingo release download URL is not allowed');
+  }
+  if (!RELEASE_HOSTS.has(parsed.hostname.toLowerCase())) {
+    throw new Error('Dingo release download host is not allowed');
+  }
+}
+
+function publicLookup(hostname, options, callback) {
+  const lookupOptions = typeof options === 'object' ? options : {};
+  dns.lookup(hostname, {
+    family: lookupOptions.family,
+    hints: lookupOptions.hints,
+    all: true,
+    verbatim: true,
+  }, (error, addresses) => {
+    if (error) {
+      callback(error);
+      return;
+    }
+    if (addresses.length === 0 || addresses.some(({ address }) => disallowedAddress(address))) {
+      callback(new Error('Dingo release host resolved to a disallowed address'));
+      return;
+    }
+    if (lookupOptions.all) {
+      callback(null, addresses);
+      return;
+    }
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+}
+
+function secureGet(url, callback) {
+  return https.get(url, { lookup: publicLookup }, callback);
+}
 
 function releaseTarget(version, platform = process.platform, arch = process.arch) {
   const targets = {
@@ -64,9 +157,12 @@ function byteLimit(maxBytes, description) {
 
 function downloadOnce(url, destination, get, redirects, maxBytes) {
   return new Promise((resolve, reject) => {
-    const parsed = new URL(url);
-    if (parsed.protocol !== 'https:') {
-      reject(new Error('Dingo release downloads require HTTPS'));
+    let parsed;
+    try {
+      parsed = new URL(url);
+      validateReleaseURL(parsed);
+    } catch (error) {
+      reject(error);
       return;
     }
     const request = get(parsed, (response) => {
@@ -109,7 +205,7 @@ function downloadOnce(url, destination, get, redirects, maxBytes) {
   });
 }
 
-async function download(url, destination, get = https.get, options = {}) {
+async function download(url, destination, get = secureGet, options = {}) {
   const delays = options.retryDelays ?? RETRY_DELAYS_MS;
   const wait = options.wait ?? ((milliseconds) => new Promise((resolve) => {
     setTimeout(resolve, milliseconds);
@@ -208,4 +304,4 @@ async function install(packageRoot, options = {}) {
   }
 }
 
-module.exports = { binaryPath, download, install, releaseURL };
+module.exports = { binaryPath, download, install, publicLookup, releaseURL };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blinklabs/dingo",
-  "version": "0.85.0",
+  "version": "0.87.1",
   "description": "Dingo is a Cardano blockchain data node",
   "bin": {
     "dingo": "npm/bin/dingo.js"