domma-cms 1.8.14 → 1.8.16

package/server/services/outbound.js

@@ -0,0 +1,394 @@
+/**
+ * Outbound requests to addresses a site user chose - without becoming a way
+ * into the server's own network (SSRF).
+ *
+ * Every server-side request whose URL a site user can set goes through
+ * `safeFetch()` here: Actions' webhook step, a form's webhook, and any plugin
+ * that fetches a user's URL through core. The WordPress importer's media
+ * downloader (wpImport/fetch.js) uses the same address rules and pinned
+ * connection, with its own host list on top.
+ *
+ *  - http(s) only, no user name or password in the address, ports 80 and 443.
+ *  - The host name is resolved first, and EVERY address it resolves to must be
+ *    public: loopback, private, link-local (cloud metadata lives at
+ *    169.254.169.254), CGNAT, multicast, reserved and documentation ranges are
+ *    refused, IPv4-mapped and NAT64 IPv6 forms included - and so is every
+ *    address of this server's own interfaces, public ones too. The WHATWG URL
+ *    parser has already turned decimal, octal and hex IPv4 spellings
+ *    (http://2130706433/, http://0177.0.0.1/) into dotted form, so they are
+ *    checked as the address they are.
+ *  - The connection goes to the address that was checked (a pinned lookup), so
+ *    a second DNS answer cannot swap in an internal one (DNS rebinding).
+ *  - Redirects are followed at most three times, each one checked as above.
+ *  - A time limit for the whole request and a cap on the answer's size.
+ *
+ * Self-hosted sites that need internal targets (a webhook to n8n on the LAN)
+ * set `outboundAllowPrivate` in config/server.json: `true` lifts the address
+ * and port rules for every request, a list of host names, addresses and CIDR
+ * ranges lifts them for those only. It is IGNORED on a signed-only site
+ * (codePolicy.signedOnly() - every site a Manager hosts), because there the
+ * site's admin is a customer, not the owner of the network.
+ *
+ * @module services/outbound
+ */
+import dns from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
+import {getConfig} from '../config.js';
+import {signedOnly} from './codePolicy.js';
+
+export const FETCH_PORTS = Object.freeze([80, 443]);
+
+export const OUTBOUND_LIMITS = Object.freeze({maxBytes: 1024 * 1024, timeoutMs: 15_000, maxRedirects: 3});
+
+export class FetchRefused extends Error {
+    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
+}
+
+/** The port an address would be fetched on. */
+export function portOf(raw) {
+    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
+}
+
+// ---------------------------------------------------------------------------
+// Addresses
+// ---------------------------------------------------------------------------
+
+const V4_BLOCKED = [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
+    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
+];
+
+function v4ToInt(ip) {
+    const p = String(ip).split('.').map(Number);
+    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
+    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
+}
+
+function v4InRange(n, base, bits) {
+    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+    return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
+}
+
+function v4Blocked(ip) {
+    const n = v4ToInt(ip);
+    if (n === null) return true;
+    return V4_BLOCKED.some(([base, bits]) => v4InRange(n, base, bits));
+}
+
+/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
+function v6Groups(ip) {
+    let s = String(ip).toLowerCase().split('%')[0];
+    // A dotted IPv4 tail (::ffff:1.2.3.4).
+    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
+    if (tail) {
+        const n = v4ToInt(tail[1]);
+        if (n === null) return null;
+        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2) return null;
+    const left = halves[0] ? halves[0].split(':') : [];
+    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
+    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
+    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+/**
+ * Is this address one a server-side fetch must never reach?
+ *
+ * @param {string} ip
+ * @returns {boolean}
+ */
+export function isBlockedAddress(ip) {
+    const kind = net.isIP(String(ip || ''));
+    if (kind === 4) return v4Blocked(ip);
+    if (kind !== 6) return true;
+    const g = v6Groups(ip);
+    if (!g) return true;
+    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    if (g.every(x => x === 0)) return true;                                   // ::
+    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
+    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
+    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
+    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
+    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
+    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
+    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
+    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
+    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
+    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
+    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
+    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
+    return false;
+}
+
+/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
+export function canonAddress(ip) {
+    const s = String(ip || '').toLowerCase().split('%')[0];
+    if (net.isIP(s) !== 6) return s;
+    const g = v6Groups(s);
+    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    return g ? g.map(x => x.toString(16)).join(':') : s;
+}
+
+/**
+ * This machine's own addresses - every interface, public ones included, plus
+ * the unspecified ones. A server must never fetch from itself, whatever its
+ * public address resolves as.
+ */
+export function ownAddresses(interfaces = os.networkInterfaces()) {
+    const out = new Set(['0.0.0.0', canonAddress('::')]);
+    for (const list of Object.values(interfaces || {})) {
+        for (const a of list || []) if (a?.address) out.add(canonAddress(a.address));
+    }
+    return out;
+}
+
+/** Does an address fall inside `a.b.c.d/n`, `v6::/n` or equal a plain address? */
+function addressMatches(ip, entry) {
+    const [base, bitsRaw] = String(entry).split('/');
+    const a = canonAddress(ip);
+    const b = canonAddress(base);
+    if (bitsRaw === undefined) return a === b;
+    const bits = Number(bitsRaw);
+    if (net.isIP(a) === 4 && net.isIP(b) === 4) {
+        return Number.isInteger(bits) && bits >= 0 && bits <= 32 && v4InRange(v4ToInt(a), b, bits);
+    }
+    const ga = v6Groups(a);
+    const gb = v6Groups(b);
+    if (!ga || !gb || !Number.isInteger(bits) || bits < 0 || bits > 128) return false;
+    for (let i = 0, left = bits; left > 0; i++, left -= 16) {
+        const take = Math.min(16, left);
+        const mask = (0xffff << (16 - take)) & 0xffff;
+        if ((ga[i] & mask) !== (gb[i] & mask)) return false;
+    }
+    return true;
+}
+
+/**
+ * Resolve a host and check every address.
+ *
+ * @param {string} hostname
+ * @param {object} [opts]
+ * @param {boolean} [opts.allowPrivate] - skip the address checks entirely
+ * @param {(address: string) => boolean} [opts.allowAddress] - addresses the site allowlisted
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @param {Set<string>} [opts.own] - this server's addresses
+ * @returns {Promise<{address: string, family: number, allowlisted: boolean}>} the address to connect to
+ */
+export async function resolvePublic(hostname, {allowPrivate = false, allowAddress = null, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
+    const host = String(hostname || '').replace(/^\[|\]$/g, '');
+    let addrs;
+    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
+    else {
+        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
+    }
+    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
+    const listed = (a) => !!allowAddress && allowAddress(a.address);
+    if (!allowPrivate) {
+        const bad = addrs.find(a => isBlockedAddress(a.address) && !listed(a));
+        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
+        const self = addrs.find(a => own.has(canonAddress(a.address)) && !listed(a));
+        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
+    }
+    return {address: addrs[0].address, family: addrs[0].family || net.isIP(addrs[0].address), allowlisted: allowPrivate || addrs.every(listed)};
+}
+
+/** Scheme and credentials (before any DNS). Returns the URL, or throws. */
+export function parseOutboundUrl(raw) {
+    let u;
+    try { u = new URL(String(raw || '').trim()); } catch { throw new FetchRefused('Not a web address.'); }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new FetchRefused(`${u.protocol} addresses are not fetched.`);
+    if (u.username || u.password) throw new FetchRefused('Addresses with a user name or password are not fetched.');
+    return u;
+}
+
+// ---------------------------------------------------------------------------
+// The site's allowlist (config/server.json outboundAllowPrivate)
+// ---------------------------------------------------------------------------
+
+/**
+ * What this site lets outbound requests reach beyond the public internet.
+ *
+ * @param {object} [opts]
+ * @param {object} [opts.server] - server.json (read fresh when omitted)
+ * @param {boolean} [opts.signed] - signed-only (codePolicy.signedOnly() when omitted)
+ * @returns {{all: boolean, hosts: string[], addresses: string[]}}
+ */
+export function outboundPolicy({server, signed} = {}) {
+    const none = {all: false, hosts: [], addresses: []};
+    if (signed ?? signedOnly()) return none;
+    let cfg = server;
+    if (cfg === undefined) { try { cfg = getConfig('server'); } catch { cfg = {}; } }
+    const v = cfg?.outboundAllowPrivate;
+    if (v === true) return {all: true, hosts: [], addresses: []};
+    if (!Array.isArray(v)) return none;
+    const entries = v.filter(x => typeof x === 'string' && x.trim()).map(x => x.trim().toLowerCase().replace(/^\[|\]$/g, ''));
+    return {
+        all: false,
+        addresses: entries.filter(x => net.isIP(x.split('/')[0])),
+        hosts: entries.filter(x => !net.isIP(x.split('/')[0]))
+    };
+}
+
+// ---------------------------------------------------------------------------
+// The request
+// ---------------------------------------------------------------------------
+
+/**
+ * One HTTP request to an address already checked, connecting only to that
+ * address. Never follows a redirect itself.
+ *
+ * @returns {Promise<{status: number, headers: object, buffer: Buffer, truncated: boolean, redirect?: string}>}
+ */
+export function pinnedRequest(u, {address, family, method = 'GET', headers = {}, body, deadline, maxBytes, signal, truncate = false}) {
+    return new Promise((resolve, reject) => {
+        const lib = u.protocol === 'https:' ? https : http;
+        const payload = body === undefined || body === null ? null : (Buffer.isBuffer(body) ? body : Buffer.from(String(body)));
+        if (payload && !Object.keys(headers).some(k => /^content-length$/i.test(k))) headers = {...headers, 'content-length': String(payload.length)};
+        let done = false;
+        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
+        const req = lib.request({
+            protocol: u.protocol,
+            hostname: u.hostname.replace(/^\[|\]$/g, ''),
+            servername: net.isIP(u.hostname.replace(/^\[|\]$/g, '')) ? undefined : u.hostname,
+            port: u.port || undefined,
+            path: `${u.pathname}${u.search}`,
+            method,
+            headers,
+            // Connect to the address that was checked - not to a fresh lookup.
+            lookup: (_host, options, cb) => {
+                if (options?.all) cb(null, [{address, family}]);
+                else cb(null, address, family);
+            },
+            agent: false,
+            signal
+        }, (res) => {
+            const status = res.statusCode || 0;
+            if (status >= 300 && status < 400 && res.headers.location) {
+                res.resume();
+                return finish(resolve, {status, headers: res.headers, buffer: Buffer.alloc(0), truncated: false, redirect: String(res.headers.location)});
+            }
+            const declared = Number(res.headers['content-length']);
+            if (!truncate && Number.isFinite(declared) && declared > maxBytes) {
+                res.destroy();
+                return finish(reject, new FetchRefused(`The answer is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+            }
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                if (size + c.length > maxBytes) {
+                    res.destroy();
+                    if (truncate) {
+                        chunks.push(c.subarray(0, maxBytes - size));
+                        finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: true});
+                    } else {
+                        finish(reject, new FetchRefused(`The answer is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+                    }
+                    return;
+                }
+                size += c.length;
+                chunks.push(c);
+            });
+            res.on('end', () => finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: false}));
+            res.on('error', (err) => finish(reject, err));
+        });
+        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The request took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
+        req.on('error', (err) => finish(reject, err));
+        if (payload) req.write(payload);
+        req.end();
+    });
+}
+
+/**
+ * Check one URL against the rules and the site's allowlist, and resolve it.
+ *
+ * @returns {Promise<{u: URL, address: string, family: number}>}
+ */
+export async function checkOutbound(raw, {policy = outboundPolicy(), lookup, own, allowPrivate = false} = {}) {
+    const u = parseOutboundUrl(raw);
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    const hostListed = policy.all || allowPrivate || policy.hosts.includes(host);
+    const allowAddress = policy.addresses.length ? (ip) => policy.addresses.some(e => addressMatches(ip, e)) : null;
+    const {address, family, allowlisted} = await resolvePublic(host, {
+        allowPrivate: hostListed, allowAddress, ...(lookup && {lookup}), ...(own && {own})
+    });
+    const port = portOf(u.href);
+    if (!allowlisted && !FETCH_PORTS.includes(port)) throw new FetchRefused(`Port ${port} is not reached - only 80 and 443.`);
+    return {u, address, family};
+}
+
+/**
+ * Make a request to a URL a site user chose.
+ *
+ * @param {string} url
+ * @param {object} [opts]
+ * @param {string} [opts.method='GET']
+ * @param {object} [opts.headers]
+ * @param {string|Buffer} [opts.body]
+ * @param {number} [opts.timeoutMs]
+ * @param {number} [opts.maxBytes] - the answer's size cap
+ * @param {boolean} [opts.truncate] - cut an oversized answer instead of failing
+ * @param {number} [opts.maxRedirects]
+ * @param {AbortSignal} [opts.signal]
+ * @param {object} [opts.policy] - outboundPolicy(), read fresh when omitted
+ * @param {Function} [opts.lookup] - tests
+ * @param {Set<string>} [opts.own] - tests
+ * @returns {Promise<{ok: boolean, status: number, headers: object, buffer: Buffer, text: () => string, json: () => unknown, url: string, truncated: boolean}>}
+ */
+export async function safeFetch(url, opts = {}) {
+    const lim = {...OUTBOUND_LIMITS, ...Object.fromEntries(Object.entries(opts).filter(([, v]) => v !== undefined))};
+    const deadline = Date.now() + lim.timeoutMs;
+    const policy = opts.policy || outboundPolicy();
+    let method = String(opts.method || 'GET').toUpperCase();
+    let body = opts.body;
+    // Headers that steer the connection itself are the request's, not the caller's.
+    const callerHeaders = Object.fromEntries(Object.entries(opts.headers || {})
+        .filter(([k]) => !/^(host|connection|transfer-encoding|content-length|keep-alive|upgrade|te|trailer|proxy-.*)$/i.test(k)));
+    let headers = {'user-agent': 'DommaCMS/1', ...callerHeaders};
+    let current = url;
+    let first = null;
+    for (let hop = 0; hop <= lim.maxRedirects; hop++) {
+        const {u, address, family} = await checkOutbound(current, {policy, lookup: opts.lookup, own: opts.own});
+        if (first === null) first = u;
+        else if (u.origin !== first.origin) {
+            // A redirect to another origin (or from https down to http) takes none of
+            // the caller's headers - an API key meant for the first host stays there.
+            headers = Object.fromEntries(Object.entries(headers).filter(([k]) => /^(user-agent|content-type|accept)$/i.test(k)));
+        }
+        const res = await pinnedRequest(u, {
+            address, family, method, headers, body, deadline,
+            maxBytes: lim.maxBytes, truncate: !!opts.truncate, signal: opts.signal
+        });
+        if (res.redirect) {
+            if (hop === lim.maxRedirects) throw new FetchRefused('Too many redirects.');
+            current = new URL(res.redirect, u).href;
+            // As browsers do: 303, and 301/302 after a POST, continue as a GET without the body.
+            if (res.status === 303 || ((res.status === 301 || res.status === 302) && method === 'POST')) {
+                method = 'GET';
+                body = undefined;
+                headers = Object.fromEntries(Object.entries(headers).filter(([k]) => !/^content-(type|length)$/i.test(k)));
+            }
+            continue;
+        }
+        const buffer = res.buffer;
+        return {
+            ok: res.status >= 200 && res.status < 300,
+            status: res.status,
+            headers: res.headers,
+            buffer,
+            truncated: res.truncated,
+            url: u.href,
+            text: () => buffer.toString('utf8'),
+            json: () => JSON.parse(buffer.toString('utf8'))
+        };
+    }
+    throw new FetchRefused('Too many redirects.');
+}

package/server/services/views.js

@@ -24,6 +24,11 @@
  *
  * Forbidden stage types:
  *   $out, $merge, $function, $accumulator, $graphLookup
+ *
+ * Stage CONFIGS are checked too, at any depth (mongoQueryGuard.js): no
+ * `$where`/`$function`/`$accumulator` hidden in a `$match`, `$group` or
+ * `$lookup` sub-pipeline, and a `$lookup` only into this site's `cms_<slug>`
+ * collections. Checked on save and again before MongoDB runs the pipeline.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -35,6 +40,7 @@ import {getEffectiveLevel} from './userRoles.js';
 import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
 import {fileIn} from './safePath.js';
+import {assertSafeMongoQuery, toSafeMongoPipeline} from './mongoQueryGuard.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -88,6 +94,7 @@ function validateStages(stages) {
         if (!ALLOWED_STAGES.has(stage.type)) {
             throw new Error(`Stage type "${stage.type}" is not in the allowed list`);
         }
+        assertSafeMongoQuery({[stage.type]: stage.config});
     }
 }
 
@@ -389,7 +396,12 @@ async function executeMongoView(view, { page, limit, user }) {
     const db = getDb(view.connection || 'default');
 
     const sourceCollection = `${COLLECTION_PREFIX}${view.pipeline.source}`;
-    const pipeline = buildPipelineStages(view.pipeline?.stages || []);
+    // The one translation of a view for MongoDB: refuses code-running
+    // operators at any depth and a $lookup outside this site's collections.
+    const {getCollection} = await import('./collections.js');
+    const pipeline = await toSafeMongoPipeline(view.pipeline?.stages || [], {
+        collectionExists: async (slug) => !!(await getCollection(slug).catch(() => null))
+    });
 
     // Prepend row-level $match if configured
     const rowLevel = view.access?.rowLevel;

package/server/services/wpImport/fetch.js

@@ -21,25 +21,15 @@
  *
  * @module services/wpImport/fetch
  */
-import dns from 'node:dns';
-import http from 'node:http';
-import https from 'node:https';
-import net from 'node:net';
-import os from 'node:os';
+import {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, pinnedRequest, portOf, resolvePublic} from '../outbound.js';
 
-export const FETCH_PORTS = Object.freeze([80, 443]);
-
-/** The port an address would be fetched on. */
-export function portOf(raw) {
-    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
-}
+// The address rules and the pinned connection are shared with every other
+// outbound request (services/outbound.js); this module adds the WordPress
+// site's own host list, the 50 MB cap and "only a 200 is a file".
+export {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, portOf, resolvePublic};
 
 export const FETCH_LIMITS = Object.freeze({maxBytes: 50 * 1024 * 1024, timeoutMs: 60_000, maxRedirects: 3});
 
-export class FetchRefused extends Error {
-    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
-}
-
 /**
  * The test-only switch: private addresses are allowed only outside
  * production AND with WP_IMPORT_ALLOW_PRIVATE_HOSTS=1 set.
@@ -48,121 +38,6 @@ export function testHostsAllowed(env = process.env) {
     return env.NODE_ENV !== 'production' && env.WP_IMPORT_ALLOW_PRIVATE_HOSTS === '1';
 }
 
-const V4_BLOCKED = [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
-    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
-    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
-];
-
-function v4ToInt(ip) {
-    const p = ip.split('.').map(Number);
-    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
-    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
-}
-
-function v4Blocked(ip) {
-    const n = v4ToInt(ip);
-    if (n === null) return true;
-    return V4_BLOCKED.some(([base, bits]) => {
-        const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
-        return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
-    });
-}
-
-/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
-function v6Groups(ip) {
-    let s = ip.toLowerCase().split('%')[0];
-    // A dotted IPv4 tail (::ffff:1.2.3.4).
-    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
-    if (tail) {
-        const n = v4ToInt(tail[1]);
-        if (n === null) return null;
-        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
-    }
-    const halves = s.split('::');
-    if (halves.length > 2) return null;
-    const left = halves[0] ? halves[0].split(':') : [];
-    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
-    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
-    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
-    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
-}
-
-/**
- * Is this address one a server-side fetch must never reach?
- *
- * @param {string} ip
- * @returns {boolean}
- */
-export function isBlockedAddress(ip) {
-    const kind = net.isIP(String(ip || ''));
-    if (kind === 4) return v4Blocked(ip);
-    if (kind !== 6) return true;
-    const g = v6Groups(ip);
-    if (!g) return true;
-    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    if (g.every(x => x === 0)) return true;                                   // ::
-    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
-    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
-    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
-    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
-    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
-    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
-    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
-    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
-    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
-    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
-    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
-    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
-    return false;
-}
-
-/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
-function canon(ip) {
-    const s = String(ip || '').toLowerCase().split('%')[0];
-    if (net.isIP(s) !== 6) return s;
-    const g = v6Groups(s);
-    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    return g ? g.map(x => x.toString(16)).join(':') : s;
-}
-
-/**
- * This machine's own addresses - every interface, public ones included, plus
- * the unspecified ones. A server must never fetch from itself, whatever its
- * public address resolves as.
- */
-export function ownAddresses(interfaces = os.networkInterfaces()) {
-    const out = new Set(['0.0.0.0', canon('::')]);
-    for (const list of Object.values(interfaces || {})) {
-        for (const a of list || []) if (a?.address) out.add(canon(a.address));
-    }
-    return out;
-}
-
-/**
- * Resolve a host and check every address.
- *
- * @returns {Promise<{address: string, family: number}>} the address to connect to
- */
-export async function resolvePublic(hostname, {allowPrivate = false, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
-    const host = String(hostname || '').replace(/^\[|\]$/g, '');
-    let addrs;
-    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
-    else {
-        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
-    }
-    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
-    if (!allowPrivate) {
-        const bad = addrs.find(a => isBlockedAddress(a.address));
-        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
-        const self = addrs.find(a => own.has(canon(a.address)));
-        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
-    }
-    return addrs[0];
-}
-
 /** May this URL be fetched at all (before any DNS)? Returns the URL, or throws. */
 export function checkUrl(raw, {hosts = [], allowPrivate = false} = {}) {
     let u;
@@ -209,56 +84,12 @@ export async function fetchMedia(url, opts = {}) {
     throw new FetchRefused('Too many redirects.');
 }
 
-function request(u, {address, family, deadline, maxBytes, signal}) {
-    return new Promise((resolve, reject) => {
-        const lib = u.protocol === 'https:' ? https : http;
-        let done = false;
-        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
-        const req = lib.request({
-            protocol: u.protocol,
-            hostname: u.hostname,
-            port: u.port || undefined,
-            path: `${u.pathname}${u.search}`,
-            method: 'GET',
-            headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'},
-            // Connect to the address that was checked - not to a fresh lookup.
-            lookup: (_host, options, cb) => {
-                if (options?.all) cb(null, [{address, family}]);
-                else cb(null, address, family);
-            },
-            agent: false,
-            signal
-        }, (res) => {
-            const status = res.statusCode || 0;
-            if (status >= 300 && status < 400 && res.headers.location) {
-                res.resume();
-                return finish(resolve, {redirect: String(res.headers.location)});
-            }
-            if (status !== 200) {
-                res.resume();
-                return finish(reject, Object.assign(new Error(`The old site answered ${status}.`), {code: 'EHTTP', status}));
-            }
-            const declared = Number(res.headers['content-length']);
-            if (Number.isFinite(declared) && declared > maxBytes) {
-                res.destroy();
-                return finish(reject, new FetchRefused(`The file is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-            }
-            const chunks = [];
-            let size = 0;
-            res.on('data', (c) => {
-                size += c.length;
-                if (size > maxBytes) {
-                    res.destroy();
-                    finish(reject, new FetchRefused(`The file is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-                    return;
-                }
-                chunks.push(c);
-            });
-            res.on('end', () => finish(resolve, {buffer: Buffer.concat(chunks), contentType: String(res.headers['content-type'] || '')}));
-            res.on('error', (err) => finish(reject, err));
-        });
-        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The download took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
-        req.on('error', (err) => finish(reject, err));
-        req.end();
+async function request(u, {address, family, deadline, maxBytes, signal}) {
+    const res = await pinnedRequest(u, {
+        address, family, deadline, maxBytes, signal,
+        headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'}
     });
+    if (res.redirect) return {redirect: res.redirect};
+    if (res.status !== 200) throw Object.assign(new Error(`The old site answered ${res.status}.`), {code: 'EHTTP', status: res.status});
+    return {buffer: res.buffer, contentType: String(res.headers['content-type'] || '')};
 }