@node9/policy-engine 2.9.2 → 2.9.3

package/dist/index.js

@@ -2866,9 +2866,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -2891,7 +2897,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2903,7 +2909,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2916,7 +2922,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -2927,7 +2933,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/dist/index.mjs

@@ -2743,9 +2743,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -2768,7 +2774,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2780,7 +2786,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2793,7 +2799,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -2804,7 +2810,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.9.2",
+  "version": "2.9.3",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",