@oneuptime/common 12.0.6 → 12.0.7

package/Server/Utils/Response.ts

@@ -21,11 +21,63 @@ import Dictionary from "../../Types/Dictionary";
 import Exception from "../../Types/Exception/Exception";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import ListData from "../../Types/ListData";
+import MimeType from "../../Types/File/MimeType";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 
+/*
+ * Raster image types, which is to say the types that cannot carry script and
+ * are therefore safe both to echo back verbatim and to render in our own
+ * origin. An SVG is not here on purpose: it is a document, not a picture, and
+ * a PDF is not here either because it gets its own scripting engine.
+ *
+ * The list is deliberately wider than the MimeType enum. Until November 2025
+ * (62d74c1d84) the file picker stored the browser's own MIME string verbatim,
+ * so installs upgrading through this change hold rows with values that never
+ * appeared in the enum - "image/vnd.microsoft.icon" from a favicon upload,
+ * "image/jpg" from assorted tools. Collapsing those to octet-stream would stop
+ * every one of those avatars and logos from rendering, because nosniff means
+ * an <img> cannot recover from a type it was given wrongly.
+ */
+const SAFE_IMAGE_MIME_TYPES: Set<string> = new Set<string>([
+  MimeType.png,
+  // MimeType.jpg is the same string as MimeType.jpeg, so it is covered.
+  MimeType.jpeg,
+  MimeType.gif,
+  MimeType.webp,
+  MimeType.ico,
+  MimeType.bmp,
+  MimeType.tiff,
+  MimeType.avif,
+  MimeType.heic,
+  "image/jpg",
+  "image/pjpeg",
+  "image/vnd.microsoft.icon",
+  "image/x-ms-bmp",
+]);
+
+/*
+ * `fileType` is a plain varchar filled in from the upload request body, so by
+ * the time a file is served back it holds whatever string the uploader chose -
+ * the MimeType enum is a compile-time type and is erased at runtime. Echoing
+ * that string back as Content-Type is what turns "upload an image" into "run
+ * script on the dashboard origin", because /api, /file and /dashboard are the
+ * same origin. Only types we actually recognise get echoed back.
+ *
+ * Note this read-side list is wider than the one FileService enforces on
+ * upload: new rows are held to the canonical enum, old rows only have to be
+ * servable.
+ */
+const ALLOWED_MIME_TYPES: Set<string> = new Set<string>([
+  ...Object.values(MimeType),
+  ...SAFE_IMAGE_MIME_TYPES,
+]);
+
+// What an unrecognised fileType degrades to: opaque bytes, never a document.
+const FALLBACK_MIME_TYPE: string = "application/octet-stream";
+
 export default class Response {
   @CaptureSpan()
   public static sendEmptySuccessResponse(
@@ -67,21 +119,105 @@ export default class Response {
     oneUptimeResponse.status(statusCode).send(body);
   }
 
+  /*
+   * Reduce a stored fileType to something safe to hand back as Content-Type.
+   * Anything we do not recognise - a made-up string, "text/html", a row
+   * written before uploads were validated - becomes opaque bytes.
+   */
+  public static getSafeFileType(fileType: string | undefined | null): string {
+    const normalizedFileType: string = (fileType || "").trim().toLowerCase();
+
+    if (ALLOWED_MIME_TYPES.has(normalizedFileType)) {
+      return normalizedFileType;
+    }
+
+    return FALLBACK_MIME_TYPE;
+  }
+
+  /*
+   * The filename goes into a response header, so it gets the same treatment as
+   * the MIME string: no quotes, no CR/LF, nothing that could split the header.
+   * This is the ASCII fallback only - see getContentDisposition, which pairs it
+   * with an encoded copy so a non-Latin name is not reduced to underscores.
+   */
+  public static getSafeFileName(name: string | undefined | null): string {
+    const safeFileName: string = (name || "")
+      .replace(/[^a-zA-Z0-9._-]/g, "_")
+      .slice(0, 100);
+
+    return safeFileName || "download";
+  }
+
+  /*
+   * RFC 6266: `filename` carries an ASCII-safe fallback for old clients and
+   * `filename*` carries the real name percent-encoded, so "月次レポート.pdf"
+   * downloads under its own name instead of as a row of underscores. Both are
+   * escaped, so neither can close the quoted string or inject a header.
+   */
+  public static getContentDisposition(
+    disposition: "inline" | "attachment",
+    name: string | undefined | null,
+  ): string {
+    const fileName: string = (name || "").trim().slice(0, 100) || "download";
+
+    /*
+     * encodeURIComponent leaves !'()* alone and RFC 5987's attr-char does not
+     * allow them - single quote especially, since it delimits the value.
+     */
+    const encodedFileName: string = encodeURIComponent(fileName).replace(
+      /['()*!]/g,
+      (character: string): string => {
+        return `%${character.charCodeAt(0).toString(16).toUpperCase()}`;
+      },
+    );
+
+    return `${disposition}; filename="${Response.getSafeFileName(fileName)}"; filename*=UTF-8''${encodedFileName}`;
+  }
+
   @CaptureSpan()
   public static async sendFileResponse(
     _req: ExpressRequest | ExpressRequest,
     res: ExpressResponse,
     file: FileModel,
   ): Promise<void> {
-    /** Create read stream */
-
     const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
 
-    /** Set the proper content type */
-    oneUptimeResponse.set("Content-Type", file.fileType);
+    const fileType: string = Response.getSafeFileType(file.fileType);
+
+    oneUptimeResponse.set("Content-Type", fileType);
+
+    /*
+     * Belt and braces for the types we do echo back. nosniff stops the browser
+     * from guessing its way to a different type; the CSP gives the response an
+     * opaque origin with no scripting even if it is opened as a top-level
+     * document, so a crafted file cannot reach dashboard cookies; and nothing
+     * we serve here is ever meant to be framed.
+     */
+    oneUptimeResponse.set("X-Content-Type-Options", "nosniff");
+    oneUptimeResponse.set(
+      "Content-Security-Policy",
+      "sandbox; script-src 'none'; object-src 'none'; frame-ancestors 'none'",
+    );
+    oneUptimeResponse.set("X-Frame-Options", "DENY");
+
+    /*
+     * Inline is reserved for raster images, which cannot execute anything.
+     * Everything else - SVG, PDF, office docs, whatever an older row happens
+     * to hold - downloads instead of rendering. This is deliberately not an
+     * SVG ban: <img> and <link rel="icon"> ignore Content-Disposition, so
+     * status page logos, favicons and avatars still render. The only
+     * behaviour that changes is a top-level navigation to the file URL, and
+     * that is exactly the navigation an XSS payload needs.
+     */
+    oneUptimeResponse.set(
+      "Content-Disposition",
+      Response.getContentDisposition(
+        SAFE_IMAGE_MIME_TYPES.has(fileType) ? "inline" : "attachment",
+        file.name,
+      ),
+    );
+
     oneUptimeResponse.status(200);
-    /** Return response */
-    // readstream.pipe(res);
 
     oneUptimeResponse.send(file.file);
   }

package/Server/Utils/SSRFProtection.ts

@@ -1,9 +1,7 @@
 import URL from "../../Types/API/URL";
 import BadDataException from "../../Types/Exception/BadDataException";
 import dns from "dns";
-
-const IPV4_LITERAL_REGEX: RegExp = /^(\d{1,3}\.){3}\d{1,3}$/;
-const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
+import net from "net";
 
 /*
  * Guards outbound HTTP(S) requests whose target is (fully or partly)
@@ -28,14 +26,23 @@ export default class SSRFProtection {
    * (`http://169.254.169.254/?x=office.com`) and pins nothing.
    */
   public static getBareHostname(rawUrl: string | URL): string {
-    let parsed: URL;
+    /*
+     * WHATWG, not URL.fromString. OneUptime's parser takes everything before
+     * the first "/" as the authority and never terminates at "?" or "#", so it
+     * reads "https://169.254.169.254#.office.com" as the host
+     * "169.254.169.254#.office.com" - which ends with ".office.com" and
+     * satisfied the allowlist, while axios re-parsed the same string per WHATWG
+     * and dialled 169.254.169.254. A pin is only worth anything if it parses
+     * the host the same way the HTTP client will.
+     */
+    let parsed: globalThis.URL;
     try {
-      parsed = URL.fromString(rawUrl.toString());
+      parsed = new globalThis.URL(rawUrl.toString());
     } catch {
       return "";
     }
 
-    return SSRFProtection.extractHost(parsed.hostname.hostname.toLowerCase());
+    return SSRFProtection.extractHost(parsed.hostname.toLowerCase());
   }
 
   /*
@@ -47,14 +54,15 @@ export default class SSRFProtection {
     rawUrl: string | URL,
     allowedDomains: Array<string>,
   ): boolean {
-    let parsed: URL;
+    let parsed: globalThis.URL;
     try {
-      parsed = URL.fromString(rawUrl.toString());
+      parsed = new globalThis.URL(rawUrl.toString());
     } catch {
       return false;
     }
 
-    if (parsed.protocol.toString().toLowerCase() !== "https://") {
+    // Scheme and host must come from the SAME parser, or they can disagree.
+    if (parsed.protocol.toLowerCase() !== "https:") {
       return false;
     }
 
@@ -73,6 +81,30 @@ export default class SSRFProtection {
   public static async validateWebhookTargetIsSafe(
     rawUrl: string | URL,
   ): Promise<void> {
+    /*
+     * URL.fromString only knows http/https/ws/wss/mongodb/mailto and silently
+     * DEFAULTS anything else to https - "file:///etc/passwd" comes back as
+     * host "file", not as a file: URL - so the protocol check below never sees
+     * the scheme the caller actually wrote. Read it off the raw string first.
+     *
+     * The ":" must be followed by "/" or this would treat the host in a
+     * scheme-less "example.com:8080/hook" as a scheme and reject it.
+     */
+    const schemeMatch: RegExpMatchArray | null = rawUrl
+      .toString()
+      .trim()
+      .match(/^([a-z][a-z0-9+.-]*):\//i);
+
+    if (
+      schemeMatch &&
+      schemeMatch[1] &&
+      !["http", "https"].includes(schemeMatch[1].toLowerCase())
+    ) {
+      throw new BadDataException(
+        "Webhook URL must use http or https protocol.",
+      );
+    }
+
     let parsed: URL;
     try {
       parsed = URL.fromString(rawUrl.toString());
@@ -164,72 +196,253 @@ export default class SSRFProtection {
     return host;
   }
 
+  /*
+   * An IP literal needs no DNS lookup - but "looks like it has a colon" is not
+   * the same question, and getting it wrong is a bypass in both directions.
+   * net.isIP is the authority: it rejects "2852039166" and "0177.0.0.1"
+   * (which then go to DNS, where getaddrinfo decodes them and the resolved
+   * address gets checked) and accepts every real IPv6 spelling.
+   */
   private static isIpLiteral(hostname: string): boolean {
-    return IPV4_LITERAL_REGEX.test(hostname) || hostname.includes(":");
+    return net.isIP(SSRFProtection.stripZoneId(hostname)) !== 0;
+  }
+
+  private static stripZoneId(address: string): string {
+    const zoneIndex: number = address.indexOf("%");
+    return zoneIndex === -1 ? address : address.substring(0, zoneIndex);
+  }
+
+  /*
+   * Expands an IPv6 address into its eight 16-bit groups, folding an embedded
+   * IPv4 tail ("::ffff:127.0.0.1") into two hex groups on the way, so that
+   * every spelling of one address produces one canonical answer. Returns null
+   * if the address is not parseable as IPv6.
+   *
+   * This exists because the checks below CANNOT be string prefix matches:
+   * "::1", "0:0:0:0:0:0:0:1" and "0000:...:0001" are the same host, and
+   * "::ffff:169.254.169.254" is the cloud metadata endpoint wearing a hat.
+   */
+  private static expandIpv6(address: string): Array<number> | null {
+    let ip: string = SSRFProtection.stripZoneId(address.toLowerCase());
+
+    if (net.isIPv6(ip) === false) {
+      return null;
+    }
+
+    // Fold a dotted-quad tail into the two hex groups it stands for.
+    const lastColonIndex: number = ip.lastIndexOf(":");
+    const tail: string = ip.substring(lastColonIndex + 1);
+    if (tail.includes(".")) {
+      if (net.isIPv4(tail) === false) {
+        return null;
+      }
+      const octets: Array<number> = tail.split(".").map((part: string) => {
+        return parseInt(part, 10);
+      });
+      const high: string = (
+        ((octets[0] as number) << 8) |
+        (octets[1] as number)
+      ).toString(16);
+      const low: string = (
+        ((octets[2] as number) << 8) |
+        (octets[3] as number)
+      ).toString(16);
+      ip = `${ip.substring(0, lastColonIndex)}:${high}:${low}`;
+    }
+
+    const halves: Array<string> = ip.split("::");
+    if (halves.length > 2) {
+      return null;
+    }
+
+    const head: Array<string> =
+      halves[0] === undefined || halves[0] === "" ? [] : halves[0].split(":");
+    const rear: Array<string> =
+      halves.length === 2 && halves[1] !== undefined && halves[1] !== ""
+        ? halves[1].split(":")
+        : [];
+
+    let groups: Array<string>;
+    if (halves.length === 2) {
+      const zeroFill: number = 8 - head.length - rear.length;
+      if (zeroFill < 0) {
+        return null;
+      }
+      groups = [...head, ...new Array(zeroFill).fill("0"), ...rear];
+    } else {
+      groups = head;
+    }
+
+    if (groups.length !== 8) {
+      return null;
+    }
+
+    const parsed: Array<number> = groups.map((group: string) => {
+      return parseInt(group || "0", 16);
+    });
+
+    if (
+      parsed.some((group: number) => {
+        return Number.isNaN(group) || group < 0 || group > 0xffff;
+      })
+    ) {
+      return null;
+    }
+
+    return parsed;
+  }
+
+  /*
+   * True when an IPv6 literal points somewhere the server must never be made
+   * to reach. Ranges, not spellings: loopback, unspecified, link-local
+   * (fe80::/10), unique-local (fc00::/7) and multicast (ff00::/8), plus the
+   * three ways IPv6 can carry an IPv4 destination - IPv4-mapped
+   * (::ffff:0:0/96), IPv4-compatible (::/96) and the NAT64 well-known prefix
+   * (64:ff9b::/96) - which are handed to the IPv4 blocklist.
+   */
+  private static isBlockedIpv6(address: string): boolean {
+    const groups: Array<number> | null = SSRFProtection.expandIpv6(address);
+
+    if (!groups) {
+      // Not parseable as IPv6; the caller's other checks decide.
+      return false;
+    }
+
+    const isZeroThrough: (endExclusive: number) => boolean = (
+      endExclusive: number,
+    ): boolean => {
+      return groups.slice(0, endExclusive).every((group: number) => {
+        return group === 0;
+      });
+    };
+
+    const embeddedIpv4: () => string = (): string => {
+      const high: number = groups[6] as number;
+      const low: number = groups[7] as number;
+      return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+    };
+
+    // ::  — unspecified. Connecting here lands on the local host.
+    if (isZeroThrough(8)) {
+      return true;
+    }
+
+    // ::1 — loopback.
+    if (isZeroThrough(7) && groups[7] === 1) {
+      return true;
+    }
+
+    // ::ffff:0:0/96 — IPv4-mapped.
+    if (isZeroThrough(5) && groups[5] === 0xffff) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    // 64:ff9b::/96 — NAT64 well-known prefix.
+    if (
+      groups[0] === 0x0064 &&
+      groups[1] === 0xff9b &&
+      groups[2] === 0 &&
+      groups[3] === 0 &&
+      groups[4] === 0 &&
+      groups[5] === 0
+    ) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    // ::/96 — IPv4-compatible (deprecated, still routable by some stacks).
+    if (isZeroThrough(6)) {
+      return SSRFProtection.isBlockedIpv4(embeddedIpv4());
+    }
+
+    const first: number = groups[0] as number;
+
+    // fe80::/10 — link-local.
+    if ((first & 0xffc0) === 0xfe80) {
+      return true;
+    }
+
+    // fc00::/7 — unique-local.
+    if ((first & 0xfe00) === 0xfc00) {
+      return true;
+    }
+
+    // fec0::/10 — site-local. Deprecated by RFC 3879, still routed on some networks.
+    if ((first & 0xffc0) === 0xfec0) {
+      return true;
+    }
+
+    // ff00::/8 — multicast.
+    if ((first & 0xff00) === 0xff00) {
+      return true;
+    }
+
+    return false;
+  }
+
+  private static isBlockedIpv4(address: string): boolean {
+    const octets: Array<number> = address.split(".").map((part: string) => {
+      return Number(part);
+    });
+
+    if (
+      octets.length !== 4 ||
+      octets.some((octet: number) => {
+        return Number.isNaN(octet) || octet < 0 || octet > 255;
+      })
+    ) {
+      return true;
+    }
+
+    const [first, second] = octets as [number, number, number, number];
+
+    if (first === 0) {
+      return true; // 0.0.0.0/8 — "this host".
+    }
+    if (first === 127) {
+      return true; // loopback
+    }
+    if (first === 10) {
+      return true; // RFC-1918
+    }
+    if (first === 172 && (second & 0xf0) === 16) {
+      return true; // RFC-1918 172.16/12
+    }
+    if (first === 192 && second === 168) {
+      return true; // RFC-1918
+    }
+    if (first === 169 && second === 254) {
+      return true; // link-local, incl. the 169.254.169.254 metadata endpoint
+    }
+    if (first === 100 && (second & 0xc0) === 64) {
+      return true; // CGNAT 100.64/10
+    }
+    if (first >= 224) {
+      return true; // multicast, reserved, and 255.255.255.255
+    }
+
+    return false;
   }
 
   private static isBlockedHostnameLiteral(hostname: string): boolean {
     if (
       hostname === "localhost" ||
+      hostname === "localhost." ||
       hostname.endsWith(".localhost") ||
       hostname === "metadata.google.internal"
     ) {
       return true;
     }
 
-    const ipv4Match: RegExpMatchArray | null = hostname.match(
-      /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
+    const address: string = SSRFProtection.stripZoneId(
+      hostname.replace(/^\[|\]$/g, ""),
     );
-    if (ipv4Match) {
-      const octets: Array<number> = [
-        Number(ipv4Match[1]),
-        Number(ipv4Match[2]),
-        Number(ipv4Match[3]),
-        Number(ipv4Match[4]),
-      ];
-
-      if (
-        octets.some((o: number) => {
-          return o < 0 || o > 255;
-        })
-      ) {
-        return true;
-      }
-      if (octets[0] === 0) {
-        return true;
-      }
-      if (octets[0] === 127) {
-        return true;
-      }
-      if (octets[0] === 10) {
-        return true;
-      }
-      if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
-        return true;
-      }
-      if (octets[0] === 192 && octets[1] === 168) {
-        return true;
-      }
-      if (octets[0] === 169 && octets[1] === 254) {
-        return true;
-      }
-      if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
-        return true;
-      }
-      return false;
+
+    if (net.isIPv4(address)) {
+      return SSRFProtection.isBlockedIpv4(address);
     }
 
-    if (hostname.includes(":")) {
-      const stripped: string = hostname.replace(/^\[|\]$/g, "");
-      if (stripped === "::1" || stripped === "::") {
-        return true;
-      }
-      if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
-        return true;
-      }
-      if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
-        return true;
-      }
+    if (net.isIPv6(address)) {
+      return SSRFProtection.isBlockedIpv6(address);
     }
 
     return false;

package/Server/Utils/StartServer.ts

@@ -127,6 +127,14 @@ const setDefaultHeaders: RequestHandler = (
 
   res.header("Access-Control-Expose-Headers", CORS_EXPOSED_HEADERS.join(", "));
 
+  /*
+   * Content sniffing turns "the server declared a boring type" into "the
+   * browser guessed an interesting one", which is how an upload becomes a
+   * document. nginx sets this on the static app locations but not on /api or
+   * /file, so set it here for everything the app itself serves.
+   */
+  res.header("X-Content-Type-Options", "nosniff");
+
   next();
 };
 

package/Server/Utils/VM/VMRunner.ts

@@ -10,6 +10,7 @@ import CaptureSpan from "../Telemetry/CaptureSpan";
 import Dictionary from "../../../Types/Dictionary";
 import GenericObject from "../../../Types/GenericObject";
 import vm, { Context } from "vm";
+import SSRFProtection from "../SSRFProtection";
 
 /**
  * Symbol used to retrieve the real (unwrapped) target from a sandbox proxy.
@@ -356,6 +357,51 @@ function unwrapProxy<T>(value: T): T {
 }
 
 export default class VMRunner {
+  /*
+   * Works out which URL the sandbox's axios call will actually dial, so the
+   * SSRF check and the request agree on the destination. axios accepts the
+   * target three different ways - a positional url, config.url on a
+   * `request()` call, and a relative url resolved against config.baseURL - and
+   * a check that only looked at the positional argument would miss two of them.
+   *
+   * Anything that does not end up an absolute http(s) URL is rejected rather
+   * than guessed at.
+   */
+  private static resolveEffectiveRequestUrl(data: {
+    method: string;
+    url: string;
+    config?: JSONObject | undefined;
+  }): string {
+    const baseUrl: string =
+      typeof data.config?.["baseURL"] === "string"
+        ? (data.config["baseURL"] as string)
+        : "";
+
+    let target: string = data.url || "";
+
+    if (data.method === "request" || !target) {
+      const configUrl: unknown = data.config?.["url"];
+      target = typeof configUrl === "string" ? configUrl : target;
+    }
+
+    let absolute: string = target;
+
+    const absoluteUrlRegex: RegExp = /^https?:\/\//i;
+
+    if (!absoluteUrlRegex.test(absolute)) {
+      if (!baseUrl) {
+        throw new Error("Request URL must be an absolute http or https URL.");
+      }
+      absolute = `${baseUrl.replace(/\/+$/, "")}/${absolute.replace(/^\/+/, "")}`;
+    }
+
+    if (!absoluteUrlRegex.test(absolute)) {
+      throw new Error("Request URL must be an absolute http or https URL.");
+    }
+
+    return absolute;
+  }
+
   @CaptureSpan()
   public static async runCodeInNodeVM(data: {
     code: string;
@@ -730,7 +776,7 @@ export default class VMRunner {
             hasBody && arg1 ? (JSON.parse(arg1) as JSONObject) : undefined;
 
           const configStr: string | undefined = hasBody ? arg2 : arg1;
-          const config: JSONObject | undefined = configStr
+          let config: JSONObject | undefined = configStr
             ? (JSON.parse(configStr) as JSONObject)
             : undefined;
 
@@ -783,6 +829,47 @@ export default class VMRunner {
             return plain;
           };
 
+          /*
+           * SSRF guard (GHSA-v5xh-rw9h-77fv).
+           *
+           * This bridge hands the host process's real axios to code the user
+           * wrote - the Custom JavaScript workflow component documents "you can
+           * use axios module" - so without a check here it is a strictly more
+           * capable version of the hole that was reported against the API
+           * components: arbitrary method, headers and body against the internal
+           * network, with the full response marshalled back into the sandbox
+           * and on into the workflow log.
+           *
+           * It has to live on THIS side of the isolate boundary. The
+           * sandbox-side axios shim is attacker-editable - user code can simply
+           * redefine it - so a check there guards nothing.
+           */
+          const effectiveUrl: string = VMRunner.resolveEffectiveRequestUrl({
+            method,
+            url,
+            config,
+          });
+
+          await SSRFProtection.validateWebhookTargetIsSafe(effectiveUrl);
+
+          /*
+           * The URL that was just validated has to be the URL that gets
+           * dialled. Each of these would otherwise steer the connection
+           * somewhere else entirely, past the check above:
+           *   proxy      - sends the request to an arbitrary host:port
+           *   socketPath - connects to a unix socket (/var/run/docker.sock)
+           *   transport / adapter - replaces the transport wholesale
+           * and a redirect would let a validated public host nominate an
+           * internal one on the second hop.
+           */
+          const safeConfig: JSONObject = config || {};
+          delete safeConfig["proxy"];
+          delete safeConfig["socketPath"];
+          delete safeConfig["transport"];
+          delete safeConfig["adapter"];
+          safeConfig["maxRedirects"] = 0;
+          config = safeConfig;
+
           try {
             let response: AxiosResponse;