@itentialopensource/adapter-utils 5.10.24 → 5.10.26

package/lib/connectorRest.js

@@ -32,6 +32,7 @@ const { HttpsProxyAgent } = require('https-proxy-agent');
 const { SocksProxyAgent } = require('socks-proxy-agent');
 const AsyncLockCl = require('async-lock');
 const FormData = require('form-data');
+const validator = require('validator');
 
 const ThrottleCl = require(path.join(__dirname, '/throttle.js'));
 
@@ -134,6 +135,45 @@ let sslCertFilePath = null;
 
 const mfaStepsResults = []; // keeps requested result for each step
 
+// SSRF Protection: Validate requests to prevent malicious requests
+function validateRequestSecurity(requestHeader, options) {
+  const { hostname, port: requestPort, path: requestPath } = requestHeader;
+  if (!hostname) {
+    throw new Error('Hostname is required');
+  }
+  if (!requestPort) {
+    throw new Error('Port is required');
+  }
+
+  const isValidIP = validator.isIP(hostname);
+  let isValidDomain = false;
+  if (!isValidIP) {
+    // Only validate as FQDN if it's NOT an IP address
+    const fqdnOptions = {
+      require_tld: false,
+      allow_underscores: true,
+      ignore_max_length: true
+    };
+
+    isValidDomain = validator.isFQDN(hostname, fqdnOptions);
+  }
+
+  if (!isValidIP && !isValidDomain) {
+    throw new Error('Hostname must be a valid IP address or domain name');
+  }
+
+  if (!validator.isPort(String(requestPort))) {
+    throw new Error('Invalid port number');
+  }
+
+  if (requestPath && options.maxPathLength && options.maxPathLength > 0) {
+    if (requestPath.length > options.maxPathLength) {
+      throw new Error(`Path too long (${requestPath.length} > ${options.maxPathLength})`);
+    }
+  }
+  return requestHeader;
+}
+
 /* CONNECTOR ENGINE INTERNAL FUNCTIONS         */
 /** Wait for adapter-mongo to be available.
  * @summary adapter may load before adapter-mongo but it requires UPDATE: test if dbUtil object can connect.
@@ -644,7 +684,8 @@ function makeRequest(request, entitySchema, callProperties, startTrip, attempt,
     }
 
     // make the call to System
-    const httpRequest = useProt.request(request.header, (res) => {
+    const validatedHeader = validateRequestSecurity(request.header, {});
+    const httpRequest = useProt.request(validatedHeader, (res) => {
       let respStr = '';
       if (res.headers['content-encoding'] !== 'gzip') {
         res.setEncoding('utf8');
@@ -869,7 +910,18 @@ function makeRequest(request, entitySchema, callProperties, startTrip, attempt,
     // handle any exception
     const tripDiff = process.hrtime(roundTTime);
     const tripEnd = `${Math.round(((tripDiff[0] * NS_PER_SEC) + tripDiff[1]) / 1000000)}ms`;
-    const errorObj = transUtilInst.checkAndReturn(e, origin, 'Issue during make request');
+
+    // Check if this is a validation error from validateRequestSecurity
+    const isValidationError = e.message && (
+      e.message.includes('Hostname is required')
+      || e.message.includes('Port is required')
+      || e.message.includes('Hostname must be a valid IP address or domain name')
+      || e.message.includes('Invalid port number')
+      || e.message.includes('Path length exceeds maximum allowed')
+    );
+
+    const errorMessage = isValidationError ? 'Request security validation failed' : 'Issue during make request';
+    const errorObj = transUtilInst.checkAndReturn(e, origin, errorMessage);
     errorObj.metrics = {
       code: 'translate_error',
       redirects: attempt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itentialopensource/adapter-utils",
-  "version": "5.10.24",
+  "version": "5.10.26",
   "description": "Itential Adapter Utility Libraries",
   "scripts": {
     "postinstall": "node utils/setup.js",
@@ -37,11 +37,12 @@
     "json-query": "^2.2.2",
     "jsontoxml": "^1.0.1",
     "jsonwebtoken": "^9.0.1",
-    "mongodb": "^3.7.4",
     "mocha": "^10.7.3",
+    "mongodb": "^3.7.4",
     "readline-sync": "^1.4.10",
     "socks-proxy-agent": "^8.0.1",
     "uuid": "^9.0.0",
+    "validator": "^13.15.15",
     "xml2js": "^0.6.0"
   },
   "devDependencies": {