@bonniernews/stayput 0.1.0 → 0.1.2

package/README.md

@@ -87,7 +87,7 @@ stayput is a client-side footgun guard — the last line of defence, not the pla
 
 ## How it works
 
-Patches `net.Socket.prototype.connect` (sync throw on blocked IP literals; unix sockets always allowed) and `dns.lookup` (hostnames are vetted when they resolve). TLS and undici ride on `net.Socket`, so they're covered for free. This is a footgun guard, not a security boundary.
+Patches `net.Socket.prototype.connect` (sync throw on blocked IP literals; unix sockets always allowed) and `dns.lookup` (hostnames are vetted when they resolve). TLS, http/https and undici ride on `net.Socket`, so they're covered for free. `server.listen` resolves its host through `dns.lookup` too, so binding is allowed for loopback and for the unspecified addresses (`0.0.0.0`, `::`) — binding a specific non-local IP needs `STAYPUT_ALLOW`. This is a footgun guard, not a security boundary.
 
 Requires node ≥ 20.6 (preloaded in CI with `NODE_OPTIONS=--import …/register.js`).
 

package/index.js

@@ -8,7 +8,7 @@
 import net from 'node:net';
 import dns from 'node:dns';
 
-const VERSION = '0.1.0';
+const VERSION = '0.1.2';
 const STATE_KEY = Symbol.for('bonnier.stayput');
 
 // ---- address helpers ------------------------------------------------------
@@ -48,6 +48,14 @@ function isLoopback(address) {
   return unmapped === 'localhost' || unmapped === '::1' || inCidr4(unmapped, '127.0.0.0/8');
 }
 
+// the unspecified addresses. `server.listen(port, host)` resolves host through dns.lookup, so a
+// test binding 0.0.0.0 would otherwise be refused for "connecting" to it. As a connect target they
+// mean this machine anyway, so allowing them costs nothing.
+// ponytail: a bind to a specific non-local IP is still refused — STAYPUT_ALLOW is the escape hatch.
+function isUnspecified(address) {
+  return address === '0.0.0.0' || address === '::' || address === '0:0:0:0:0:0:0:0';
+}
+
 function isPrivate(address) {
   const unmapped = unmapIPv4(address);
   if (/^f[cd]/i.test(unmapped) || /^fe80:/i.test(unmapped)) return true; // IPv6 ULA + link-local
@@ -64,7 +72,7 @@ function matchesList(list, target) {
 function addressOk(address, state, hostAllowed) {
   if (matchesList(state.deny, address)) return false;
   if (hostAllowed || matchesList(state.allow, address)) return true;
-  if (isLoopback(address)) return true;
+  if (isLoopback(address) || isUnspecified(address)) return true;
   return state.privateOk && isPrivate(address);
 }
 
@@ -98,13 +106,19 @@ function makePatchedConnect(originalConnect) {
       if (firstArg !== null && typeof firstArg === 'object') ({ host, port, path } = firstArg);
       else if (typeof firstArg === 'string' && Number.isNaN(Number(firstArg))) path = firstArg; // mirrors node's pipe-name detection
       else { port = firstArg; if (typeof args[1] === 'string') host = args[1]; }
-      if (path === undefined) { // unix sockets always allowed
+      // unix sockets always allowed. Truthiness, not `=== undefined`: node's http/https agent
+      // passes `path: null` for every TCP request, which would skip the check entirely
+      if (!path) {
         const targetHost = String(host === undefined ? 'localhost' : host).toLowerCase();
         const isIpLiteral = net.isIP(unmapIPv4(targetHost)) !== 0;
         // non-IP hostnames (unless deny-listed) are vetted async in the dns.lookup patch —
         // connect is sync, DNS isn't
         if (matchesList(state.deny, targetHost) || (isIpLiteral && !addressOk(targetHost, state, false))) {
           notifyBlock(state, targetHost, port);
+          // drivers arm a connect timeout before attaching their socket 'error' listener (pg does),
+          // so a sync throw leaves nothing listening: destroying the socket first makes the driver's
+          // own destroy(err) a no-op instead of an unhandled 'error' event killing the test run
+          this.destroy();
           throw blockedError(`${targetHost}:${port}`); // sync throw — driver retry loops swallow emitted errors
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bonniernews/stayput",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Default-deny network guard for Node.js test environments — blocks non-local TCP at the socket level.",
   "license": "MIT",
   "repository": {