@tryghost/domain-validator 4.0.9 → 4.2.0

package/lib/pro.js

@@ -16,18 +16,19 @@ const responseObject = {
     raw: null,
 };
 
+// The origin echoes X-Forwarded-Proto back as x-ghost-forwarded-proto, using "-" when
+// it received no X-Forwarded-Proto header at all, so "-" is the same as the header being absent
+_private.hasForwardedProto = (headers) =>
+    _.has(headers, 'x-ghost-forwarded-proto') && headers['x-ghost-forwarded-proto'] !== '-';
+
 // Attempt to detect if the results look like a proxy
-_private.detectProxy = (headers, proto) => {
+_private.detectProxy = (headers) => {
     if (
         // If x-forwarded-host was originally set, this is a proxy. "- [Invalid]" means original value was empty
         (_.has(headers, 'x-ghost-forwarded-host') &&
             headers['x-ghost-forwarded-host'] !== '- [Invalid]') ||
         // If x-amz-cf-id is set, then this is cloudfront and therefore is a proxy
-        _.has(headers, 'x-amz-cf-id') ||
-        // If we are making an https request and get http back, this must be a proxy
-        (proto === 'https' &&
-            _.has(headers, 'x-ghost-forwarded-proto') &&
-            headers['x-ghost-forwarded-proto'] !== proto)
+        _.has(headers, 'x-amz-cf-id')
     ) {
         return true;
     }
@@ -55,11 +56,10 @@ _private.validateProxy = (headers, subdomain, customdomain, subdirectory, prodom
         });
     }
 
-    // Proto must be https
-    if (
-        !_.has(headers, 'x-ghost-forwarded-proto') ||
-        headers['x-ghost-forwarded-proto'] !== 'https'
-    ) {
+    // Proto must be https when the header is present. An absent header ("-") is not
+    // evidence of a bad proxy: Fastly sets X-Forwarded-Proto itself and can lose it
+    // on the hop between its own nodes, so only fail on a positive wrong value
+    if (_private.hasForwardedProto(headers) && headers['x-ghost-forwarded-proto'] !== 'https') {
         proxyResult.isValid = false;
         proxyResult.errors.push({
             'x-forwarded-proto': {
@@ -137,7 +137,7 @@ _private.buildResponse = (result, proto, subdomain, customdomain, subdirectory,
     response.isGhostPro =
         response.isGhostPro && (!response.hasRedirect || response.isGhostProRedirect);
 
-    response.isProxy = _private.detectProxy(headers, proto);
+    response.isProxy = _private.detectProxy(headers);
 
     // Generate a proxy report
     const proxyResult = _private.validateProxy(

package/lib/redirect.js

@@ -0,0 +1,56 @@
+const dns = require('@tryghost/dns');
+const domain = require('@tryghost/dns/lib/domain');
+const debug = require('@tryghost/debug')('dv:redirect');
+
+const REDIRECT_SERVER_IP = '178.128.137.126';
+
+const skipped = { hasRedirectRecord: null, redirectDomain: null };
+
+/**
+ * Check whether the counterpart of an apex/www domain has an A record set to
+ * the redirect server.
+ *
+ * For an apex domain we check www.<domain>, for a www domain we check the
+ * apex. Any other subdomain has no redirect counterpart, so the check is
+ * skipped and hasRedirectRecord stays null. Informational only — this never
+ * affects ratings or whether the domain can be activated.
+ *
+ * @param {string} customdomain
+ * @returns {Promise<{hasRedirectRecord: boolean|null, redirectDomain: string|null}>}
+ */
+module.exports.validate = (customdomain) => {
+    let parsed;
+    try {
+        parsed = domain.normalize(customdomain);
+    } catch {
+        return Promise.resolve(skipped);
+    }
+
+    if (!parsed.domain) {
+        return Promise.resolve(skipped);
+    }
+
+    let redirectDomain;
+    if (!parsed.subdomain) {
+        // Apex domain: the redirect record lives on www
+        redirectDomain = 'www.' + parsed.domain;
+    } else if (parsed.subdomain === 'www') {
+        // www domain: the redirect record lives on the apex
+        redirectDomain = parsed.domain;
+    } else {
+        return Promise.resolve(skipped);
+    }
+
+    debug('Checking redirect record for ' + redirectDomain);
+    return dns
+        .aRecordMatches(redirectDomain, REDIRECT_SERVER_IP)
+        .then((matches) => ({ hasRedirectRecord: matches, redirectDomain }))
+        .catch((err) => {
+            // Fail open: this check is informational, so it can never take
+            // down the rest of the validity report. null = "unknown".
+            const message =
+                err && typeof err.message === 'string' ? err.message : String(err || 'UNKNOWN');
+            debug('Unexpected redirect record error: ' + message);
+            return { hasRedirectRecord: null, redirectDomain };
+        });
+};

package/lib/validate.js

@@ -2,6 +2,7 @@ const _ = require('lodash');
 const dns = require('./dns');
 const pro = require('./pro');
 const caa = require('./caa');
+const redirect = require('./redirect');
 const debug = require('@tryghost/debug')('dv:validate');
 
 const _private = {};
@@ -28,6 +29,8 @@ const validityReportObject = {
     caaSource: null,
     caaAllowedIssuers: [],
     caaError: null,
+    hasRedirectRecord: null,
+    redirectDomain: null,
     message: '',
 };
 
@@ -44,11 +47,13 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer
                 caaIssuers && caaIssuers.length > 0
                     ? caa.validate(customdomain, caaIssuers)
                     : Promise.resolve(null),
+                redirect.validate(customdomain),
             ]);
         })
-        .then(([dnsResult, caaResult]) => {
+        .then(([dnsResult, caaResult, redirectResult]) => {
             checkResult.dns = dnsResult;
             checkResult.caa = caaResult;
+            checkResult.redirect = redirectResult;
             debug('got dns, returning');
             return checkResult;
         });
@@ -91,6 +96,8 @@ module.exports.validate = (
             _.merge(validityReport, _.omit(result.pro, 'raw'));
             // Do a few last DNS-related checks, and then output validity values
             _.merge(validityReport, _.omit(result.dns, 'raw'));
+            // Redirect record info is informational only and never affects ratings
+            _.merge(validityReport, result.redirect);
 
             if (result.caa) {
                 _.merge(validityReport, result.caa);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/domain-validator",
-  "version": "4.0.9",
+  "version": "4.2.0",
   "license": "MIT",
   "author": "Ghost Foundation",
   "repository": {
@@ -21,17 +21,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@tryghost/debug": "2.3.2",
-    "@tryghost/errors": "3.3.2",
-    "@tryghost/pretty-cli": "3.3.2",
+    "@tryghost/debug": "2.3.14",
+    "@tryghost/errors": "3.3.14",
+    "@tryghost/pretty-cli": "3.3.14",
     "got": "11.8.6",
     "lodash": "4.18.1",
     "semver": "7.8.5",
-    "@tryghost/dns": "^0.8.9"
+    "@tryghost/dns": "^0.8.11"
   },
   "devDependencies": {
     "should": "13.2.3",
-    "sinon": "22.0.0"
+    "sinon": "22.1.0"
   },
   "engines": {
     "node": ">=20.20.0"