@nocobase/utils 2.2.0-beta.8 → 2.2.0-beta.9

package/lib/server-request.js

@@ -44,7 +44,12 @@ __export(server_request_exports, {
 module.exports = __toCommonJS(server_request_exports);
 var import_ipaddr = __toESM(require("ipaddr.js"));
 var import_axios = __toESM(require("axios"));
+var import_promises = require("dns/promises");
 const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+const SSRF_RISK_IP_RANGES = /* @__PURE__ */ new Set(["loopback", "private", "linkLocal", "uniqueLocal", "unspecified"]);
+const SSRF_RISK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "metadata.google.internal"]);
+const DNS_LOOKUP_WARNING_TIMEOUT = 1e3;
+const warnedSsrfRiskTargets = /* @__PURE__ */ new Set();
 function matchesIpEntry(hostname, entry) {
   try {
     let addr = import_ipaddr.default.parse(hostname);
@@ -87,6 +92,88 @@ function matchesEntry(hostname, entry) {
   return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
 }
 __name(matchesEntry, "matchesEntry");
+function getNormalizedHost(url) {
+  const { hostname } = url;
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+__name(getNormalizedHost, "getNormalizedHost");
+function getSsrfRiskReason(hostname) {
+  const host = hostname.toLowerCase();
+  if (SSRF_RISK_HOSTNAMES.has(host)) {
+    return "known local or metadata hostname";
+  }
+  if (!import_ipaddr.default.isValid(host)) {
+    return;
+  }
+  try {
+    let addr = import_ipaddr.default.parse(host);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    const range = addr.range();
+    return SSRF_RISK_IP_RANGES.has(range) ? range : void 0;
+  } catch {
+    return;
+  }
+}
+__name(getSsrfRiskReason, "getSsrfRiskReason");
+function warnSsrfRiskTarget(host, reason, key = `${host}:${reason}`) {
+  if (warnedSsrfRiskTargets.has(key)) return;
+  warnedSsrfRiskTargets.add(key);
+  console.warn(
+    [
+      `Outbound request to "${host}" targets a potential SSRF risk target (${reason}) and is allowed because SERVER_REQUEST_WHITELIST is not configured.`,
+      "Configure SERVER_REQUEST_WHITELIST to explicitly allow required outbound targets.",
+      "A future version may block private, loopback, link-local, and metadata targets by default."
+    ].join(" ")
+  );
+}
+__name(warnSsrfRiskTarget, "warnSsrfRiskTarget");
+function warnIfSsrfRiskTarget(host) {
+  const reason = getSsrfRiskReason(host);
+  if (!reason) return;
+  warnSsrfRiskTarget(host, reason);
+}
+__name(warnIfSsrfRiskTarget, "warnIfSsrfRiskTarget");
+function hasServerRequestWhitelist() {
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  return Boolean(whitelist && whitelist.trim());
+}
+__name(hasServerRequestWhitelist, "hasServerRequestWhitelist");
+async function resolveHostAddresses(host) {
+  try {
+    return await Promise.race([
+      (0, import_promises.lookup)(host, { all: true, verbatim: true }),
+      new Promise((resolve) => {
+        setTimeout(() => resolve([]), DNS_LOOKUP_WARNING_TIMEOUT);
+      })
+    ]);
+  } catch {
+    return [];
+  }
+}
+__name(resolveHostAddresses, "resolveHostAddresses");
+async function warnIfResolvedSsrfRiskTarget(url) {
+  if (!url || !url.includes("://") || hasServerRequestWhitelist()) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) return;
+  const host = getNormalizedHost(parsed);
+  if (getSsrfRiskReason(host) || import_ipaddr.default.isValid(host)) return;
+  const addresses = await resolveHostAddresses(host);
+  for (const address of addresses) {
+    const reason = getSsrfRiskReason(address.address);
+    if (reason) {
+      warnSsrfRiskTarget(host, `resolves to ${address.address} (${reason})`, `${host}:resolved-risk`);
+      return;
+    }
+  }
+}
+__name(warnIfResolvedSsrfRiskTarget, "warnIfResolvedSsrfRiskTarget");
 function checkUrlAgainstWhitelist(url) {
   if (!url) return;
   if (!url.includes("://")) return;
@@ -101,12 +188,14 @@ function checkUrlAgainstWhitelist(url) {
       `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
     );
   }
+  const host = getNormalizedHost(parsed);
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
-  if (!whitelist || !whitelist.trim()) return;
+  if (!whitelist || !whitelist.trim()) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
   if (entries.length === 0) return;
-  const { hostname } = parsed;
-  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }
@@ -117,6 +206,7 @@ function checkUrlAgainstWhitelist(url) {
 __name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
 async function serverRequest(config) {
   checkUrlAgainstWhitelist(config.url);
+  await warnIfResolvedSsrfRiskTarget(config.url);
   return import_axios.default.request(config);
 }
 __name(serverRequest, "serverRequest");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.2.0-beta.8",
+  "version": "2.2.0-beta.9",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -21,5 +21,5 @@
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "fa2502c1e9faf6d74b3f51b42dbc6546638d46af"
+  "gitHead": "60e3d7abbaa0c7cead76f71a4f3d5eedb6b8acdb"
 }