@dnsid-ai/transport 0.20.2 → 0.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +5 -1
- package/dist/index.js +5 -1
- package/package.json +2 -2
package/dist/index.cjs
CHANGED
|
@@ -172,7 +172,7 @@ function createSsrfSafeLookup(dnsServer, allowedUnsafeHosts = /* @__PURE__ */ ne
|
|
|
172
172
|
void (async () => {
|
|
173
173
|
const addresses = await resolveAddresses(hostname, family, dnsServer ? await customResolver() : void 0);
|
|
174
174
|
const unsafe = addresses.find(({ address }) => isUnsafeIp(address));
|
|
175
|
-
if (unsafe && !(
|
|
175
|
+
if (unsafe && !(unsafeHostAllowed(hostname, allowedUnsafeHosts) && addresses.every(({ address }) => isPrivateOrLoopbackIp(address)))) {
|
|
176
176
|
throw new import_protocol.VerificationError(`unsafe resolved IP address for ${hostname}: ${unsafe.address}`, {
|
|
177
177
|
code: import_protocol.VerificationCode.TLSError
|
|
178
178
|
});
|
|
@@ -185,6 +185,10 @@ function createSsrfSafeLookup(dnsServer, allowedUnsafeHosts = /* @__PURE__ */ ne
|
|
|
185
185
|
})().catch((err) => cb(err, "", 0));
|
|
186
186
|
};
|
|
187
187
|
}
|
|
188
|
+
function unsafeHostAllowed(hostname, allowedUnsafeHosts) {
|
|
189
|
+
const host = hostname.toLowerCase().replace(/\.$/, "");
|
|
190
|
+
return allowedUnsafeHosts.has(hostname) || host === "test" || host.endsWith(".test");
|
|
191
|
+
}
|
|
188
192
|
function normalizeAllowedUnsafeHost(host) {
|
|
189
193
|
let parsed;
|
|
190
194
|
try {
|
package/dist/index.js
CHANGED
|
@@ -130,7 +130,7 @@ function createSsrfSafeLookup(dnsServer, allowedUnsafeHosts = /* @__PURE__ */ ne
|
|
|
130
130
|
void (async () => {
|
|
131
131
|
const addresses = await resolveAddresses(hostname, family, dnsServer ? await customResolver() : void 0);
|
|
132
132
|
const unsafe = addresses.find(({ address }) => isUnsafeIp(address));
|
|
133
|
-
if (unsafe && !(
|
|
133
|
+
if (unsafe && !(unsafeHostAllowed(hostname, allowedUnsafeHosts) && addresses.every(({ address }) => isPrivateOrLoopbackIp(address)))) {
|
|
134
134
|
throw new VerificationError(`unsafe resolved IP address for ${hostname}: ${unsafe.address}`, {
|
|
135
135
|
code: VerificationCode.TLSError
|
|
136
136
|
});
|
|
@@ -143,6 +143,10 @@ function createSsrfSafeLookup(dnsServer, allowedUnsafeHosts = /* @__PURE__ */ ne
|
|
|
143
143
|
})().catch((err) => cb(err, "", 0));
|
|
144
144
|
};
|
|
145
145
|
}
|
|
146
|
+
function unsafeHostAllowed(hostname, allowedUnsafeHosts) {
|
|
147
|
+
const host = hostname.toLowerCase().replace(/\.$/, "");
|
|
148
|
+
return allowedUnsafeHosts.has(hostname) || host === "test" || host.endsWith(".test");
|
|
149
|
+
}
|
|
146
150
|
function normalizeAllowedUnsafeHost(host) {
|
|
147
151
|
let parsed;
|
|
148
152
|
try {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dnsid-ai/transport",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.21.0",
|
|
4
4
|
"description": "Node.js DNS and HTTPS transport implementations for DNSid.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"typecheck": "tsc --noEmit"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@dnsid-ai/protocol": "^0.
|
|
41
|
+
"@dnsid-ai/protocol": "^0.21.0",
|
|
42
42
|
"undici": "^8.10.2"
|
|
43
43
|
},
|
|
44
44
|
"publishConfig": {
|