@wbce-d9/api 11.0.4 → 11.0.8

package/dist/request/validate-ip.js

@@ -1,20 +1,70 @@
+import { BlockList } from 'net';
 import os from 'node:os';
 import { getEnv } from '../env.js';
+import logger from '../logger.js';
 export const validateIP = async (ip, url) => {
     const env = getEnv();
-    if (env['IMPORT_IP_DENY_LIST'].includes(ip)) {
-        throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+    const ipDenyList = env['IMPORT_IP_DENY_LIST'] || [];
+    // Create a BlockList for efficient IP range checking
+    const blockList = new BlockList();
+    // Add all denied ranges to the block list
+    for (const deniedRange of ipDenyList) {
+        if (deniedRange.includes('/')) {
+            // CIDR notation
+            const parts = deniedRange.split('/');
+            const network = parts[0];
+            const prefixLengthStr = parts[1];
+            if (!network || !prefixLengthStr) {
+                throw new Error('Invalid CIDR format: missing network or prefix');
+            }
+            const prefixLength = parseInt(prefixLengthStr, 10);
+            if (isNaN(prefixLength)) {
+                throw new Error('Invalid CIDR format: prefix length must be a number');
+            }
+            blockList.addSubnet(network, prefixLength);
+        }
+        else {
+            // Single IP address
+            blockList.addAddress(deniedRange);
+        }
     }
-    if (env['IMPORT_IP_DENY_LIST'].includes('0.0.0.0')) {
+    // Special case: "0.0.0.0" blocks all local interfaces AND loopback addresses
+    if (ipDenyList.includes('0.0.0.0')) {
+        // Add the entire loopback range (127.0.0.0/8) to fix the vulnerability
+        // This blocks all 127.x.x.x addresses, not just 127.0.0.1
+        blockList.addSubnet('127.0.0.0', 8);
+        // Add local network interfaces
         const networkInterfaces = os.networkInterfaces();
         for (const networkInfo of Object.values(networkInterfaces)) {
             if (!networkInfo)
                 continue;
             for (const info of networkInfo) {
-                if (info.address === ip) {
-                    throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+                if (info.internal && info.cidr) {
+                    try {
+                        const parts = info.cidr.split('/');
+                        const network = parts[0];
+                        const prefixLengthStr = parts[1];
+                        if (!network || !prefixLengthStr) {
+                            logger.warn(`Warning: Invalid local interface CIDR format "${info.cidr}": missing network or prefix`);
+                            continue;
+                        }
+                        const prefixLength = parseInt(prefixLengthStr, 10);
+                        if (isNaN(prefixLength)) {
+                            logger.warn(`Warning: Invalid prefix length in CIDR "${info.cidr}"`);
+                            continue;
+                        }
+                        blockList.addSubnet(network, prefixLength);
+                    }
+                    catch (error) {
+                        // Log but don't fail for invalid local interface CIDR
+                        logger.warn(`Warning: Invalid local interface CIDR "${info.cidr}": ${error instanceof Error ? error.message : 'Unknown error'}`);
+                    }
                 }
             }
         }
     }
+    // Check if the IP is blocked
+    if (blockList.check(ip)) {
+        throw new Error(`Requested URL "${url}" resolves to a denied IP address`);
+    }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wbce-d9/api",
-  "version": "11.0.4",
+  "version": "11.0.8",
   "description": "Directus is a real-time API and App dashboard for managing SQL database content",
   "type": "module",
   "keywords": [
@@ -143,20 +143,20 @@
     "uuid": "9.0.0",
     "uuid-validate": "0.0.3",
     "wellknown": "0.5.0",
-    "@wbce-d9/app": "9.33.1",
-    "@wbce-d9/exceptions": "9.26.4",
+    "@wbce-d9/app": "9.33.2",
     "@wbce-d9/constants": "9.28.0",
-    "@wbce-d9/extensions-sdk": "9.27.1",
+    "@wbce-d9/extensions-sdk": "9.27.2",
+    "@wbce-d9/exceptions": "9.26.4",
     "@wbce-d9/schema": "9.26.4",
-    "@wbce-d9/specs": "9.26.4",
-    "@wbce-d9/storage-driver-azure": "9.26.8",
+    "@wbce-d9/specs": "9.26.5",
     "@wbce-d9/storage": "9.26.4",
-    "@wbce-d9/storage-driver-cloudinary": "9.27.0",
-    "@wbce-d9/storage-driver-local": "9.26.8",
-    "@wbce-d9/storage-driver-gcs": "9.26.8",
-    "@wbce-d9/storage-driver-s3": "9.26.10",
-    "@wbce-d9/utils": "9.29.1",
-    "@wbce-d9/update-check": "9.28.0"
+    "@wbce-d9/storage-driver-cloudinary": "9.27.2",
+    "@wbce-d9/storage-driver-gcs": "9.26.9",
+    "@wbce-d9/storage-driver-azure": "9.26.9",
+    "@wbce-d9/storage-driver-local": "9.26.9",
+    "@wbce-d9/utils": "9.29.2",
+    "@wbce-d9/update-check": "9.28.0",
+    "@wbce-d9/storage-driver-s3": "9.26.11"
   },
   "devDependencies": {
     "@ngneat/falso": "6.4.0",
@@ -199,7 +199,7 @@
     "@vitest/coverage-c8": "0.30.1",
     "@wbce-d9/tsconfig": "0.0.7",
     "copyfiles": "2.4.1",
-    "form-data": "4.0.0",
+    "form-data": "4.0.4",
     "knex-mock-client": "3.0.2",
     "supertest": "6.3.3",
     "typescript": "5.0.4",
@@ -212,6 +212,7 @@
     "memcached": "2.2.2",
     "mysql": "2.18.1",
     "nodemailer-mailgun-transport": "2.1.5",
+    "oracledb": "^6.8.0",
     "pg": "8.10.0",
     "sqlite3": "5.1.6",
     "tedious": "18.6.1"