@slicedearth/whoisleuth-cli 1.47.4 → 2.0.1

package/lib/rdap-bootstrap.mjs

@@ -1,5 +1,6 @@
 // IANA RDAP bootstrap retrieval, bounded stale caching, and authority
 // selection for domain, IP, and ASN queries.
+import net from 'node:net';
 import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
 const BOOTSTRAP_TTL_MS = 60 * 60 * 1000;
 const BOOTSTRAP_STALE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
@@ -8,29 +9,71 @@ const BOOTSTRAP_FETCH_TIMEOUT_MS = 7000;
 const MAX_RDAP_ENDPOINT_LENGTH = 2048;
 const bootstrapCache = new Map();
 const bootstrapInflight = new Map();
+function admitRdapEndpoint(value, options = {}) {
+    if (typeof value !== 'string'
+        || !value
+        || value !== value.trim()
+        || value.length > MAX_RDAP_ENDPOINT_LENGTH
+        || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    try {
+        const parsed = new URL(value);
+        if (!['http:', 'https:'].includes(parsed.protocol)
+            || !parsed.hostname
+            || parsed.username
+            || parsed.password
+            || parsed.port
+            || parsed.hash
+            || (!options.allowQuery && parsed.search))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
 function ipv4ToLong(ip) {
     return ip.split('.').reduce((accumulator, octet) => (accumulator << 8) + (parseInt(octet, 10) & 0xff), 0) >>> 0;
 }
 function ipInCidrV4(ip, cidr) {
-    const [range, bitsString] = cidr.split('/');
-    if (!range)
+    const parts = cidr.split('/');
+    if (parts.length > 2)
+        return false;
+    const [range, bitsString] = parts;
+    if (!range || net.isIP(ip) !== 4 || net.isIP(range) !== 4)
+        return false;
+    const bits = bitsString === undefined || /^\d{1,2}$/u.test(bitsString)
+        ? Number(bitsString ?? 32)
+        : -1;
+    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
         return false;
-    const bits = bitsString !== undefined ? parseInt(bitsString, 10) : 32;
     const mask = bits === 0 ? 0 : (0xffffffff << (32 - bits)) >>> 0;
     return (ipv4ToLong(ip) & mask) === (ipv4ToLong(range) & mask);
 }
 function expandIpv6(ip) {
-    let head = ip;
+    let normalized = ip;
+    if (normalized.includes('.')) {
+        const lastColon = normalized.lastIndexOf(':');
+        const embedded = normalized.slice(lastColon + 1);
+        if (lastColon < 0 || net.isIP(embedded) !== 4) {
+            throw new TypeError('Invalid IPv4-embedded IPv6 address.');
+        }
+        const value = ipv4ToLong(embedded);
+        normalized = `${normalized.slice(0, lastColon)}:${(value >>> 16).toString(16)}:${(value & 0xffff).toString(16)}`;
+    }
+    if (net.isIP(normalized) !== 6)
+        throw new TypeError('Invalid IPv6 address.');
+    let head = normalized;
     let tail = '';
-    if (ip.includes('::')) {
-        const [headPart = '', tailPart = ''] = ip.split('::');
+    if (normalized.includes('::')) {
+        const [headPart = '', tailPart = ''] = normalized.split('::');
         head = headPart;
         tail = tailPart;
     }
     const headParts = head ? head.split(':').filter(Boolean) : [];
     const tailParts = tail ? tail.split(':').filter(Boolean) : [];
     const missing = 8 - headParts.length - tailParts.length;
-    const parts = ip.includes('::')
+    const parts = normalized.includes('::')
         ? [...headParts, ...Array(Math.max(missing, 0)).fill('0'), ...tailParts]
         : headParts;
     while (parts.length < 8)
@@ -41,13 +84,25 @@ function ipv6ToBigInt(ip) {
     return expandIpv6(ip).reduce((accumulator, part) => (accumulator << 16n) + BigInt(parseInt(part || '0', 16)), 0n);
 }
 function ipInCidrV6(ip, cidr) {
-    const [range, bitsString] = cidr.split('/');
+    const parts = cidr.split('/');
+    if (parts.length > 2)
+        return false;
+    const [range, bitsString] = parts;
     if (!range)
         return false;
-    const bits = bitsString !== undefined ? parseInt(bitsString, 10) : 128;
+    const bits = bitsString === undefined || /^\d{1,3}$/u.test(bitsString)
+        ? Number(bitsString ?? 128)
+        : -1;
+    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 128)
+        return false;
     const full = (1n << 128n) - 1n;
     const mask = bits === 0 ? 0n : (full << BigInt(128 - bits)) & full;
-    return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+    try {
+        return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+    }
+    catch {
+        return false;
+    }
 }
 function validBootstrap(data) {
     const record = data && typeof data === 'object' && !Array.isArray(data)
@@ -74,7 +129,12 @@ async function fetchBootstrap(kind, options = {}) {
         return inflight;
     const request = (async () => {
         try {
-            const response = await fetchUpstream(`https://data.iana.org/rdap/${kind}.json`, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const requestedEndpoint = `https://data.iana.org/rdap/${kind}.json`;
+            const response = await fetchUpstream(requestedEndpoint, {}, BOOTSTRAP_FETCH_TIMEOUT_MS);
+            const finalEndpoint = admitRdapEndpoint(response.finalUrl ?? requestedEndpoint);
+            if (finalEndpoint !== requestedEndpoint) {
+                throw new Error(`IANA bootstrap redirected outside its fixed source endpoint for ${kind}`);
+            }
             if (!response.ok) {
                 throw new Error(`IANA bootstrap fetch failed for ${kind} (${response.status})`);
             }
@@ -112,10 +172,10 @@ function clearRdapBootstrapCache() {
 function uniqueRdapBases(urls) {
     const seen = new Set();
     return (Array.isArray(urls) ? urls : [])
-        .filter((url) => typeof url === 'string'
-        && url.length <= MAX_RDAP_ENDPOINT_LENGTH
-        && !/[\u0000-\u001f\u007f]/.test(url)
-        && /^https?:\/\//i.test(url))
+        .flatMap((url) => {
+        const admitted = admitRdapEndpoint(url);
+        return admitted ? [admitted] : [];
+    })
         .sort((left, right) => Number(/^http:\/\//i.test(left)) - Number(/^http:\/\//i.test(right)))
         .filter((url) => {
         const key = url.replace(/\/$/, '').toLowerCase();
@@ -170,4 +230,4 @@ async function findRdapBases(type, value) {
     }
     return [];
 }
-export { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, MAX_RDAP_ENDPOINT_LENGTH, clearRdapBootstrapCache, fetchBootstrap, findRdapBases, ipv4ToLong, ipv6ToBigInt, uniqueRdapBases, };
+export { BOOTSTRAP_STALE_TTL_MS, BOOTSTRAP_TTL_MS, MAX_RDAP_ENDPOINT_LENGTH, admitRdapEndpoint, clearRdapBootstrapCache, fetchBootstrap, findRdapBases, ipv4ToLong, ipv6ToBigInt, uniqueRdapBases, };

package/lib/rdap-client.mjs

@@ -1,8 +1,8 @@
 import { cached } from "./lookup-cache.mjs";
 import { findRdapBases, uniqueRdapBases, } from "./rdap-bootstrap.mjs";
 import { rdapAttempt, rdapFailure } from "./rdap-attempts.mjs";
-import { fetchRdapWithTimeout, } from "./rdap-transport.mjs";
-import { validateRdapResponse } from "./rdap-validation.mjs";
+import { fetchRdapDetailedWithTimeout, } from "./rdap-transport.mjs";
+import { admitRdapObjectEndpoint, validateRdapResponse, } from "./rdap-validation.mjs";
 const UPSTREAM_TIMEOUT_MS = 7_000;
 const UPSTREAM_TOTAL_DEADLINE_MS = 12_000;
 const MAX_RDAP_ENDPOINTS = 3;
@@ -24,7 +24,7 @@ function rdapPathFor(type, value) {
  * Query the bounded bootstrap candidate set while retaining every attempted
  * endpoint as separately attributed transport evidence.
  */
-export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapWithTimeout) {
+export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap, fetchUpstream = fetchRdapDetailedWithTimeout) {
     const candidates = uniqueRdapBases(bases).slice(0, MAX_RDAP_ENDPOINTS);
     if (candidates.length === 0)
         return null;
@@ -38,13 +38,21 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
         const url = `${base.replace(/\/$/, '')}/${rdapPathFor(type, value)}`;
         try {
             const upstream = await fetchUpstream(url, { headers: { Accept: 'application/rdap+json' } }, Math.min(UPSTREAM_TIMEOUT_MS, remaining));
+            const selectedEndpoint = admitRdapObjectEndpoint(type, value, upstream.finalUrl ?? url);
+            if (!selectedEndpoint) {
+                attempts.push(rdapAttempt(url, 'invalid_response', {
+                    status: upstream.status,
+                    detail: 'The endpoint returned final URL provenance for an invalid or different RDAP object.',
+                }));
+                continue;
+            }
             if (upstream.status !== 404 && !upstream.ok) {
                 const outcome = upstream.status === 429
                     ? 'rate_limited'
                     : upstream.status >= 500
                         ? 'server_error'
                         : 'client_error';
-                attempts.push(rdapAttempt(url, outcome, {
+                attempts.push(rdapAttempt(selectedEndpoint, outcome, {
                     status: upstream.status,
                     detail: `The endpoint returned HTTP ${upstream.status}.`,
                 }));
@@ -55,21 +63,21 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
                 data = JSON.parse(upstream.text);
             }
             catch {
-                attempts.push(rdapAttempt(url, 'invalid_json', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_json', {
                     status: upstream.status,
                     detail: 'The endpoint returned invalid JSON.',
                 }));
                 continue;
             }
             if (upstream.status === 404) {
-                attempts.push(rdapAttempt(url, 'not_found', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'not_found', {
                     status: upstream.status,
                     detail: 'The authoritative endpoint reported no matching object.',
                     selected: true,
                 }));
                 return {
-                    rdapServer: url,
-                    transportSecurity: /^https:\/\//i.test(url) ? 'https' : 'http',
+                    rdapServer: selectedEndpoint,
+                    transportSecurity: /^https:\/\//i.test(selectedEndpoint) ? 'https' : 'http',
                     upstreamStatus: upstream.status,
                     fetchedAt: new Date().toISOString(),
                     data,
@@ -80,20 +88,20 @@ export async function fetchRdapFromBasesWithParser(type, value, bases, parseRdap
             const parsed = parseRdap(type, data);
             const validation = validateRdapResponse(type, value, parsed);
             if (!validation.valid) {
-                attempts.push(rdapAttempt(url, 'invalid_response', {
+                attempts.push(rdapAttempt(selectedEndpoint, 'invalid_response', {
                     status: upstream.status,
                     detail: validation.detail,
                 }));
                 continue;
             }
-            attempts.push(rdapAttempt(url, 'success', {
+            attempts.push(rdapAttempt(selectedEndpoint, 'success', {
                 status: upstream.status,
                 detail: 'The endpoint returned the requested RDAP object.',
                 selected: true,
             }));
             return {
-                rdapServer: url,
-                transportSecurity: /^https:\/\//i.test(url) ? 'https' : 'http',
+                rdapServer: selectedEndpoint,
+                transportSecurity: /^https:\/\//i.test(selectedEndpoint) ? 'https' : 'http',
                 upstreamStatus: upstream.status,
                 fetchedAt: new Date().toISOString(),
                 data,