n8n-core 2.26.2 → 2.27.0

package/dist/ssrf/ssrf-protection.service.js

@@ -1,159 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SsrfProtectionService = void 0;
-const backend_common_1 = require("@n8n/backend-common");
-const config_1 = require("@n8n/config");
-const di_1 = require("@n8n/di");
-const n8n_workflow_1 = require("n8n-workflow");
-const node_assert_1 = __importDefault(require("node:assert"));
-const node_net_1 = require("node:net");
-const dns_resolver_1 = require("./dns-resolver");
-const hostname_matcher_1 = require("./hostname-matcher");
-const ip_range_builder_1 = require("./ip-range-builder");
-const ssrf_blocked_ip_error_1 = require("./ssrf-blocked-ip.error");
-let SsrfProtectionService = class SsrfProtectionService {
-    constructor(ssrfConfig, dnsResolver, logger) {
-        this.ssrfConfig = ssrfConfig;
-        this.dnsResolver = dnsResolver;
-        this.logger = logger.scoped('ssrf-protection');
-        const blocked = (0, ip_range_builder_1.buildIpRangeList)(this.ssrfConfig.blockedIpRanges);
-        for (const issue of blocked.issues) {
-            this.logger.warn(`Invalid value '${issue.entry}' in N8N_SSRF_BLOCKED_IP_RANGES: ${issue.error}`);
-        }
-        this.blockedIps = blocked.list;
-        const allowed = (0, ip_range_builder_1.buildIpRangeList)(this.ssrfConfig.allowedIpRanges);
-        for (const issue of allowed.issues) {
-            this.logger.warn(`Invalid value '${issue.entry}' in N8N_SSRF_ALLOWED_IP_RANGES: ${issue.error}`);
-        }
-        this.allowedIps = allowed.list;
-        this.allowedHostnameMatcher = new hostname_matcher_1.HostnameMatcher(this.ssrfConfig.allowedHostnames);
-    }
-    async validateUrl(url) {
-        const parsed = this.tryParseUrl(url);
-        if (!parsed) {
-            return (0, n8n_workflow_1.createResultError)(new Error(`Invalid URL: ${String(url)}`));
-        }
-        const { hostname } = parsed;
-        const result = await this.lookupAndValidate(hostname, { all: true });
-        if (!result.ok) {
-            return result;
-        }
-        return (0, n8n_workflow_1.createResultOk)(undefined);
-    }
-    validateIp(ip) {
-        const family = this.getIpFamily(ip);
-        (0, node_assert_1.default)(family !== null, `Invalid IP address: ${ip}`);
-        if (this.allowedIps.check(ip, family)) {
-            return (0, n8n_workflow_1.createResultOk)(undefined);
-        }
-        if (this.blockedIps.check(ip, family)) {
-            return (0, n8n_workflow_1.createResultError)(new ssrf_blocked_ip_error_1.SsrfBlockedIpError(ip));
-        }
-        return (0, n8n_workflow_1.createResultOk)(undefined);
-    }
-    createSecureLookup() {
-        return async (hostname, options, onResult) => {
-            try {
-                const resolved = await this.secureLookupAsync(hostname, options);
-                if (options.all) {
-                    onResult(null, resolved);
-                    return;
-                }
-                const first = resolved[0];
-                onResult(null, first.address, first.family);
-            }
-            catch (error) {
-                onResult((0, n8n_workflow_1.ensureError)(error), options.all ? [] : '', undefined);
-            }
-        };
-    }
-    validateRedirectSync(url) {
-        const parsed = this.tryParseUrl(url);
-        if (!parsed)
-            return;
-        const { hostname } = parsed;
-        if (this.allowedHostnameMatcher.matches(hostname))
-            return;
-        const cleanIp = this.normalizeIpInHostname(hostname);
-        if ((0, node_net_1.isIP)(cleanIp)) {
-            const result = this.validateIp(cleanIp);
-            if (!result.ok) {
-                throw result.error;
-            }
-        }
-    }
-    normalizeIpInHostname(hostname) {
-        return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
-    }
-    async secureLookupAsync(hostname, options) {
-        const result = await this.lookupAndValidate(hostname, options);
-        if (!result.ok) {
-            throw result.error;
-        }
-        return result.result;
-    }
-    async lookupAndValidate(hostname, options) {
-        const cleanIp = this.normalizeIpInHostname(hostname);
-        const ipFamily = (0, node_net_1.isIP)(cleanIp);
-        if (ipFamily) {
-            const result = this.validateIp(cleanIp);
-            if (!result.ok) {
-                return result;
-            }
-            return (0, n8n_workflow_1.createResultOk)([
-                {
-                    address: cleanIp,
-                    family: ipFamily,
-                },
-            ]);
-        }
-        const resolved = await this.dnsResolver.lookup(hostname, options);
-        (0, node_assert_1.default)(resolved.length > 0, `DNS lookup for ${hostname} returned no results`);
-        if (this.allowedHostnameMatcher.matches(hostname)) {
-            return (0, n8n_workflow_1.createResultOk)(resolved);
-        }
-        for (const ip of resolved) {
-            const result = this.validateIp(ip.address);
-            if (!result.ok) {
-                return result;
-            }
-        }
-        return (0, n8n_workflow_1.createResultOk)(resolved);
-    }
-    tryParseUrl(url) {
-        try {
-            return url instanceof URL ? url : new URL(url);
-        }
-        catch {
-            return null;
-        }
-    }
-    getIpFamily(ip) {
-        const version = (0, node_net_1.isIP)(ip);
-        if (version === 4)
-            return 'ipv4';
-        if (version === 6)
-            return 'ipv6';
-        return null;
-    }
-};
-exports.SsrfProtectionService = SsrfProtectionService;
-exports.SsrfProtectionService = SsrfProtectionService = __decorate([
-    (0, di_1.Service)(),
-    __metadata("design:paramtypes", [config_1.SsrfProtectionConfig,
-        dns_resolver_1.DnsResolver,
-        backend_common_1.Logger])
-], SsrfProtectionService);
-//# sourceMappingURL=ssrf-protection.service.js.map

package/dist/ssrf/ssrf-protection.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssrf-protection.service.js","sourceRoot":"","sources":["../../src/ssrf/ssrf-protection.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wDAA6C;AAC7C,wCAAmD;AACnD,gCAAkC;AAClC,+CAAsF;AACtF,8DAAiC;AAGjC,uCAAgC;AAEhC,iDAA6C;AAC7C,yDAAqD;AACrD,yDAAsD;AACtD,mEAA6D;AAwBtD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IASjC,YACkB,UAAgC,EAChC,WAAwB,EACzC,MAAc;QAFG,eAAU,GAAV,UAAU,CAAsB;QAChC,gBAAW,GAAX,WAAW,CAAa;QAGzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,IAAA,mCAAgB,EAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,kBAAkB,KAAK,CAAC,KAAK,oCAAoC,KAAK,CAAC,KAAK,EAAE,CAC9E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAE/B,MAAM,OAAO,GAAG,IAAA,mCAAgB,EAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAClE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,kBAAkB,KAAK,CAAC,KAAK,oCAAoC,KAAK,CAAC,KAAK,EAAE,CAC9E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAE/B,IAAI,CAAC,sBAAsB,GAAG,IAAI,kCAAe,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACrF,CAAC;IAMD,KAAK,CAAC,WAAW,CAAC,GAAiB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,IAAA,gCAAiB,EAAC,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC;QACf,CAAC;QAED,OAAO,IAAA,6BAAc,EAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAKD,UAAU,CAAC,EAAU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACpC,IAAA,qBAAM,EAAC,MAAM,KAAK,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAErD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAA,6BAAc,EAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,IAAA,gCAAiB,EAAC,IAAI,0CAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAA,6BAAc,EAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAaD,kBAAkB;QACjB,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC5C,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAEjE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;oBACzB,OAAO;gBACR,CAAC;gBAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAA,0BAAW,EAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAChE,CAAC;QACF,CAAC,CAAC;IACH,CAAC;IAQD,oBAAoB,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAE5B,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,IAAA,eAAI,EAAC,OAAO,CAAC,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,CAAC,KAAK,CAAC;YACpB,CAAC;QACF,CAAC;IACF,CAAC;IAMO,qBAAqB,CAAC,QAAgB;QAC7C,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9F,CAAC;IAKO,KAAK,CAAC,iBAAiB,CAC9B,QAAgB,EAChB,OAAsB;QAEtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;IAMO,KAAK,CAAC,iBAAiB,CAC9B,QAAgB,EAChB,OAAsB;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAA,eAAI,EAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,QAAQ,EAAE,CAAC;YAGd,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC;YACf,CAAC;YAED,OAAO,IAAA,6BAAc,EAAC;gBACrB;oBACC,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,QAAQ;iBAChB;aACD,CAAC,CAAC;QACJ,CAAC;QAGD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAElE,IAAA,qBAAM,EAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,kBAAkB,QAAQ,sBAAsB,CAAC,CAAC;QAE9E,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,IAAA,6BAAc,EAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC;YACf,CAAC;QACF,CAAC;QAED,OAAO,IAAA,6BAAc,EAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAEO,WAAW,CAAC,GAAiB;QACpC,IAAI,CAAC;YACJ,OAAO,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,WAAW,CAAC,EAAU;QAC7B,MAAM,OAAO,GAAG,IAAA,eAAI,EAAC,EAAE,CAAC,CAAC;QACzB,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAA;AAhNY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,YAAO,GAAE;qCAWqB,6BAAoB;QACnB,0BAAW;QACjC,uBAAM;GAZH,qBAAqB,CAgNjC"}