ssrf-lab 0.0.0-stage → 0.1.0

package/dist/range/bomb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bomb.js","sourceRoot":"","sources":["../../src/range/bomb.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEhD,uDAAuD;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,IAAI,MAAM,GAAkB,IAAI,CAAA;AAEhC;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAElC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IACxC,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/range/canaries.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Canaries are the proof that a client REACHED something it should not have.
+ *
+ * A probe that only watches for an error cannot tell a control from bad luck:
+ * a connection to a dead address fails on its own. A canary in the response
+ * body is positive evidence that the request completed.
+ */
+export declare const CANARY_INTERNAL_SECRET = "SSRF-LAB-CANARY-INTERNAL-SECRET";
+/** Returned by the body that a size cap must never finish reading. */
+export declare const CANARY_ENDLESS_CHUNK = "SSRF-LAB-CANARY-ENDLESS";
+/** Returned by the decompression bomb once it is fully expanded. */
+export declare const CANARY_BOMB_TAIL = "SSRF-LAB-CANARY-BOMB-TAIL";

package/dist/range/canaries.js

@@ -0,0 +1,13 @@
+/**
+ * Canaries are the proof that a client REACHED something it should not have.
+ *
+ * A probe that only watches for an error cannot tell a control from bad luck:
+ * a connection to a dead address fails on its own. A canary in the response
+ * body is positive evidence that the request completed.
+ */
+export const CANARY_INTERNAL_SECRET = 'SSRF-LAB-CANARY-INTERNAL-SECRET';
+/** Returned by the body that a size cap must never finish reading. */
+export const CANARY_ENDLESS_CHUNK = 'SSRF-LAB-CANARY-ENDLESS';
+/** Returned by the decompression bomb once it is fully expanded. */
+export const CANARY_BOMB_TAIL = 'SSRF-LAB-CANARY-BOMB-TAIL';
+//# sourceMappingURL=canaries.js.map

package/dist/range/canaries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canaries.js","sourceRoot":"","sources":["../../src/range/canaries.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,iCAAiC,CAAA;AAEvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAA"}

package/dist/range/isolation.d.ts

@@ -0,0 +1,4 @@
+/** This address exists only on lo inside the isolated integration namespace. */
+export declare const ISOLATED_PUBLIC_ADDRESS = "93.184.216.34";
+/** Fail closed before a listener or client can use the public-address fixture. */
+export declare function assertIsolatedNetwork(): void;

package/dist/range/isolation.js

@@ -0,0 +1,24 @@
+import { execFileSync } from 'node:child_process';
+/** This address exists only on lo inside the isolated integration namespace. */
+export const ISOLATED_PUBLIC_ADDRESS = '93.184.216.34';
+/** Fail closed before a listener or client can use the public-address fixture. */
+export function assertIsolatedNetwork() {
+    if (process.platform !== 'linux')
+        throw new Error('Public-address tests require Linux network isolation');
+    const links = JSON.parse(execFileSync('ip', ['-j', 'address', 'show'], { encoding: 'utf8' }));
+    if (links.length !== 1 || links[0]?.ifname !== 'lo' || !links[0].flags.includes('UP')) {
+        throw new Error('Public-address tests require a network namespace with only lo, enabled');
+    }
+    if (!links[0].addr_info.some((address) => address.local === ISOLATED_PUBLIC_ADDRESS)) {
+        throw new Error(`Assign ${ISOLATED_PUBLIC_ADDRESS}/32 to lo inside the isolated namespace first`);
+    }
+    for (const family of ['-4', '-6']) {
+        const routes = JSON.parse(execFileSync('ip', ['-j', family, 'route', 'show', 'table', 'all'], {
+            encoding: 'utf8',
+        }));
+        if (routes.some((route) => route.dev !== 'lo' || route.gateway !== undefined || route.dst === 'default')) {
+            throw new Error('Public-address tests require no external routes or gateways');
+        }
+    }
+}
+//# sourceMappingURL=isolation.js.map

package/dist/range/isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolation.js","sourceRoot":"","sources":["../../src/range/isolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAA;AAEtD,kFAAkF;AAClF,MAAM,UAAU,qBAAqB;IACnC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACrB,CAAA;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,uBAAuB,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,UAAU,uBAAuB,+CAA+C,CAAC,CAAA;IACnG,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE;YAC5F,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAuD,CAAA;QACzD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/range/server.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A running attack range.
+ *
+ * It is 2 servers, because 1 is not enough to tell a control from an accident:
+ *
+ *   public    the site the operator asked for. It stands for the internet, so
+ *             a client is allowed to fetch it, and it is where every attack
+ *             starts.
+ *   internal  the service behind the firewall. Nothing outside may read it,
+ *             and it answers with a canary so a hit is provable.
+ *
+ * Both normally listen on loopback. The optional public-address fixture binds
+ * an address assigned to lo in a verified isolated namespace. `trustedOrigin`
+ * is a LAB AFFORDANCE for the built-in clients, never a production setting.
+ */
+export interface AttackRange {
+    readonly origin: string;
+    readonly port: number;
+    readonly internalOrigin: string;
+    readonly internalPort: number;
+    url(path: string): string;
+    /**
+     * How many requests the internal service has answered.
+     *
+     * This is the measurement that separates "the control stopped it" from "the
+     * client tried and something else failed". A canary in a body proves a hit;
+     * this counter proves the ABSENCE of one.
+     */
+    internalHits(): number;
+    /** Requests received by the entry server, including successful controls. */
+    publicHits(): number;
+    close(): Promise<void>;
+}
+/** Paths the public server serves. */
+export declare const RANGE_PATHS: {
+    readonly index: "/";
+    readonly redirectLoopback: "/redirect/loopback";
+    readonly redirectDecimalLoopback: "/redirect/decimal-loopback";
+    readonly redirectLinkLocal: "/redirect/link-local";
+    readonly redirectPrivate: "/redirect/private";
+    readonly redirectCredentials: "/redirect/credentials";
+    readonly redirectLoop: "/redirect/loop";
+    readonly payloadBomb: "/payload/bomb.gz";
+    readonly payloadEndless: "/payload/endless";
+    readonly payloadSlow: "/payload/slow";
+};
+/** The only path the internal service serves. */
+export declare const INTERNAL_PATH = "/internal/secret";
+export declare function startAttackRange(options?: {
+    publicAddress?: boolean;
+}): Promise<AttackRange>;

package/dist/range/server.js

@@ -0,0 +1,190 @@
+import { createServer } from 'node:http';
+import { METADATA_ADDRESS } from '../util/addresses.js';
+import { decompressionBomb } from './bomb.js';
+import { CANARY_ENDLESS_CHUNK, CANARY_INTERNAL_SECRET } from './canaries.js';
+import { assertIsolatedNetwork, ISOLATED_PUBLIC_ADDRESS } from './isolation.js';
+/** Paths the public server serves. */
+export const RANGE_PATHS = {
+    index: '/',
+    redirectLoopback: '/redirect/loopback',
+    redirectDecimalLoopback: '/redirect/decimal-loopback',
+    redirectLinkLocal: '/redirect/link-local',
+    redirectPrivate: '/redirect/private',
+    redirectCredentials: '/redirect/credentials',
+    redirectLoop: '/redirect/loop',
+    payloadBomb: '/payload/bomb.gz',
+    payloadEndless: '/payload/endless',
+    payloadSlow: '/payload/slow',
+};
+/** The only path the internal service serves. */
+export const INTERNAL_PATH = '/internal/secret';
+export async function startAttackRange(options = {}) {
+    if (options.publicAddress)
+        assertIsolatedNetwork();
+    const publicHost = options.publicAddress ? ISOLATED_PUBLIC_ADDRESS : '127.0.0.1';
+    const timers = new Set();
+    let internalHits = 0;
+    let publicHits = 0;
+    const internal = await listen((_request, response) => {
+        internalHits += 1;
+        text(response, 200, CANARY_INTERNAL_SECRET);
+    });
+    let publicSide;
+    try {
+        publicSide = await listen((request, response) => {
+            publicHits += 1;
+            handle(request, response, `http://127.0.0.1:${internal.port}`, internal.port, timers);
+        }, publicHost);
+    }
+    catch (error) {
+        await close(internal);
+        throw error;
+    }
+    return {
+        origin: `http://${publicHost}:${publicSide.port}`,
+        port: publicSide.port,
+        internalOrigin: `http://127.0.0.1:${internal.port}`,
+        internalPort: internal.port,
+        url: (path) => `http://${publicHost}:${publicSide.port}${path}`,
+        internalHits: () => internalHits,
+        publicHits: () => publicHits,
+        close: async () => {
+            for (const timer of timers)
+                clearInterval(timer);
+            timers.clear();
+            await close(publicSide);
+            await close(internal);
+        },
+    };
+}
+async function listen(handler, host = '127.0.0.1') {
+    const sockets = new Set();
+    const server = createServer(handler);
+    server.on('connection', (socket) => {
+        sockets.add(socket);
+        socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, host, resolve);
+    });
+    return { server, port: server.address().port, sockets };
+}
+async function close(listener) {
+    for (const socket of listener.sockets)
+        socket.destroy();
+    listener.sockets.clear();
+    await new Promise((resolve, reject) => {
+        listener.server.close((error) => (error ? reject(error) : resolve()));
+    });
+}
+function handle(request, response, internalOrigin, internalPort, timers) {
+    const path = (request.url ?? '/').split('?')[0] ?? '/';
+    switch (path) {
+        case RANGE_PATHS.index: {
+            text(response, 200, Object.values(RANGE_PATHS).join('\n'));
+            return;
+        }
+        case RANGE_PATHS.redirectLoopback: {
+            redirect(response, `${internalOrigin}${INTERNAL_PATH}`);
+            return;
+        }
+        // 2130706433 is 127.0.0.1 written as one decimal number. A refusal that
+        // compares the raw host string never sees it; the URL parser does.
+        case RANGE_PATHS.redirectDecimalLoopback: {
+            redirect(response, `http://2130706433:${internalPort}${INTERNAL_PATH}`);
+            return;
+        }
+        case RANGE_PATHS.redirectLinkLocal: {
+            redirect(response, `http://${METADATA_ADDRESS}/latest/meta-data/`);
+            return;
+        }
+        // 198.51.100.0/24 is TEST-NET-2, reserved for documentation, so this probe
+        // reaches no real device on the machine's own network.
+        case RANGE_PATHS.redirectPrivate: {
+            redirect(response, 'http://198.51.100.1/');
+            return;
+        }
+        // Credentials in a redirect target end up in logs and error messages.
+        case RANGE_PATHS.redirectCredentials: {
+            redirect(response, `http://lab:s3cr3t@127.0.0.1:${internalPort}${INTERNAL_PATH}`);
+            return;
+        }
+        // Stays on the public origin, so it tests the hop cap and nothing else.
+        case RANGE_PATHS.redirectLoop: {
+            redirect(response, RANGE_PATHS.redirectLoop);
+            return;
+        }
+        case RANGE_PATHS.payloadBomb: {
+            const body = decompressionBomb();
+            response.writeHead(200, {
+                'content-type': 'application/octet-stream',
+                'content-encoding': 'gzip',
+                'content-length': String(body.byteLength),
+            });
+            response.end(body);
+            return;
+        }
+        case RANGE_PATHS.payloadEndless: {
+            endless(response, timers);
+            return;
+        }
+        case RANGE_PATHS.payloadSlow: {
+            slow(response, timers);
+            return;
+        }
+        default: {
+            text(response, 404, 'no such target');
+            return;
+        }
+    }
+}
+function text(response, status, body) {
+    response.writeHead(status, { 'content-type': 'text/plain; charset=utf-8' });
+    response.end(body);
+}
+function redirect(response, location) {
+    response.writeHead(302, { location, 'content-type': 'text/plain; charset=utf-8' });
+    response.end(`follow me to ${location}`);
+}
+/**
+ * A body with no end and no Content-Length.
+ *
+ * A cap that reads Content-Length and trusts it learns nothing here. Only a
+ * running total of received bytes stops this.
+ */
+function endless(response, timers) {
+    response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
+    const chunk = `${CANARY_ENDLESS_CHUNK}${'A'.repeat(64 * 1024)}`;
+    const timer = setInterval(() => {
+        if (response.writableEnded || response.destroyed) {
+            clearInterval(timer);
+            timers.delete(timer);
+            return;
+        }
+        response.write(chunk);
+    }, 10);
+    timers.add(timer);
+    response.on('close', () => {
+        clearInterval(timer);
+        timers.delete(timer);
+    });
+}
+/** One byte per second. Only a deadline stops this. */
+function slow(response, timers) {
+    response.writeHead(200, { 'content-type': 'text/plain; charset=utf-8' });
+    const timer = setInterval(() => {
+        if (response.writableEnded || response.destroyed) {
+            clearInterval(timer);
+            timers.delete(timer);
+            return;
+        }
+        response.write('.');
+    }, 1000);
+    timers.add(timer);
+    response.on('close', () => {
+        clearInterval(timer);
+        timers.delete(timer);
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/range/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/range/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAEhG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC5E,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAoC/E,sCAAsC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,GAAG;IACV,gBAAgB,EAAE,oBAAoB;IACtC,uBAAuB,EAAE,4BAA4B;IACrD,iBAAiB,EAAE,sBAAsB;IACzC,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,uBAAuB;IAC5C,YAAY,EAAE,gBAAgB;IAC9B,WAAW,EAAE,kBAAkB;IAC/B,cAAc,EAAE,kBAAkB;IAClC,WAAW,EAAE,eAAe;CACpB,CAAA;AAEV,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAA;AAQ/C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAuC,EAAE;IAC9E,IAAI,OAAO,CAAC,aAAa;QAAE,qBAAqB,EAAE,CAAA;IAClD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW,CAAA;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACnD,YAAY,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,IAAI,UAAoB,CAAA;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC9C,UAAU,IAAI,CAAC,CAAA;YACf,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,oBAAoB,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACvF,CAAC,EAAE,UAAU,CAAC,CAAA;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrB,MAAM,KAAK,CAAA;IACb,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE;QACjD,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,cAAc,EAAE,oBAAoB,QAAQ,CAAC,IAAI,EAAE;QACnD,YAAY,EAAE,QAAQ,CAAC,IAAI;QAC3B,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,UAAU,IAAI,UAAU,CAAC,IAAI,GAAG,IAAI,EAAE;QACvE,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY;QAChC,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,aAAa,CAAC,KAAK,CAAC,CAAA;YAChD,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;YACvB,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvB,CAAC;KACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,OAAqE,EACrE,IAAI,GAAG,WAAW;IAElB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAEpC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QACjC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACnB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAG,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,QAAkB;IACrC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IACvD,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,MAAM,CACb,OAAwB,EACxB,QAAwB,EACxB,cAAsB,EACtB,YAAoB,EACpB,MAA2B;IAE3B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAA;IAEtD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAClC,QAAQ,CAAC,QAAQ,EAAE,GAAG,cAAc,GAAG,aAAa,EAAE,CAAC,CAAA;YACvD,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,mEAAmE;QACnE,KAAK,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACzC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,YAAY,GAAG,aAAa,EAAE,CAAC,CAAA;YACvE,OAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACnC,QAAQ,CAAC,QAAQ,EAAE,UAAU,gBAAgB,oBAAoB,CAAC,CAAA;YAClE,OAAM;QACR,CAAC;QAED,2EAA2E;QAC3E,uDAAuD;QACvD,KAAK,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC;YACjC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QAED,sEAAsE;QACtE,KAAK,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;YACrC,QAAQ,CAAC,QAAQ,EAAE,+BAA+B,YAAY,GAAG,aAAa,EAAE,CAAC,CAAA;YACjF,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,KAAK,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,YAAY,CAAC,CAAA;YAC5C,OAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAA;YAChC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE;gBACtB,cAAc,EAAE,0BAA0B;gBAC1C,kBAAkB,EAAE,MAAM;gBAC1B,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1C,CAAC,CAAA;YACF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACzB,OAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QAED,OAAO,CAAC,CAAC,CAAC;YACR,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAA;YACrC,OAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAY;IAClE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAC3E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,QAAgB;IAC1D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAClF,QAAQ,CAAC,GAAG,CAAC,gBAAgB,QAAQ,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,QAAwB,EAAE,MAA2B;IACpE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAA;IACxE,MAAM,KAAK,GAAG,GAAG,oBAAoB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAA;IAE/D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAA;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,aAAa,CAAC,KAAK,CAAC,CAAA;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,uDAAuD;AACvD,SAAS,IAAI,CAAC,QAAwB,EAAE,MAA2B;IACjE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAA;IAExE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,CAAC,KAAK,CAAC,CAAA;YACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC,EAAE,IAAI,CAAC,CAAA;IAER,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,aAAa,CAAC,KAAK,CAAC,CAAA;QACpB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/util/addresses.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Classes of IP address that matter to an SSRF control.
+ * Everything that is not `public` points somewhere a fetcher of user-supplied
+ * URLs has no business reaching.
+ */
+export type AddressClass = 'loopback' | 'link-local' | 'private' | 'unique-local' | 'unspecified' | 'multicast' | 'broadcast' | 'public';
+/** Cloud instance metadata lives here on AWS, GCP and Azure. */
+export declare const METADATA_ADDRESS = "169.254.169.254";
+export declare class NotAnIpAddressError extends Error {
+    readonly value: string;
+    constructor(value: string);
+}
+/**
+ * Classify one IP address literal.
+ *
+ * The caller passes an address, never a hostname: a hostname has no class
+ * until it is resolved, and resolving it is the caller's decision.
+ */
+export declare function classifyAddress(address: string): AddressClass;
+/** True when an address must not be reached by a fetcher of untrusted URLs. */
+export declare function isForbiddenAddress(address: string): boolean;

package/dist/util/addresses.js

@@ -0,0 +1,143 @@
+import { BlockList, isIP } from 'node:net';
+/** Cloud instance metadata lives here on AWS, GCP and Azure. */
+export const METADATA_ADDRESS = '169.254.169.254';
+export class NotAnIpAddressError extends Error {
+    value;
+    constructor(value) {
+        super(`not an IP address: ${value}`);
+        this.value = value;
+        this.name = 'NotAnIpAddressError';
+    }
+}
+/**
+ * Special-purpose ranges. The first match wins, so a range that sits inside
+ * another must come first: 255.255.255.255 is inside 240.0.0.0/4.
+ */
+const RANGES = [
+    ['255.255.255.255/32', 'ipv4', 'broadcast'],
+    ['0.0.0.0/8', 'ipv4', 'unspecified'],
+    ['127.0.0.0/8', 'ipv4', 'loopback'],
+    ['169.254.0.0/16', 'ipv4', 'link-local'],
+    ['10.0.0.0/8', 'ipv4', 'private'],
+    ['172.16.0.0/12', 'ipv4', 'private'],
+    ['192.168.0.0/16', 'ipv4', 'private'],
+    // Carrier-grade NAT. Reachable inside many hosting networks.
+    ['100.64.0.0/10', 'ipv4', 'private'],
+    // IETF protocol assignments, documentation and benchmarking.
+    ['192.0.0.0/24', 'ipv4', 'private'],
+    ['192.0.2.0/24', 'ipv4', 'private'],
+    ['198.18.0.0/15', 'ipv4', 'private'],
+    ['198.51.100.0/24', 'ipv4', 'private'],
+    ['203.0.113.0/24', 'ipv4', 'private'],
+    ['224.0.0.0/4', 'ipv4', 'multicast'],
+    ['240.0.0.0/4', 'ipv4', 'private'],
+    ['::/128', 'ipv6', 'unspecified'],
+    ['::1/128', 'ipv6', 'loopback'],
+    // NAT64 for local use; the well-known prefix 64:ff9b::/96 is handled as an
+    // embedded IPv4 address instead.
+    ['64:ff9b:1::/48', 'ipv6', 'private'],
+    // Discard-only.
+    ['100::/64', 'ipv6', 'private'],
+    // IETF protocol assignments (Teredo, benchmarking, ...) and documentation,
+    // the IPv6 counterparts of the IPv4 ranges above.
+    ['2001::/23', 'ipv6', 'private'],
+    ['2001:db8::/32', 'ipv6', 'private'],
+    ['fc00::/7', 'ipv6', 'unique-local'],
+    ['fe80::/10', 'ipv6', 'link-local'],
+    // Deprecated site-local, the predecessor of fc00::/7.
+    ['fec0::/10', 'ipv6', 'private'],
+    ['ff00::/8', 'ipv6', 'multicast'],
+];
+/**
+ * `BlockList` compares parsed numbers, not text, so no spelling of an address
+ * can slip past a pattern. That is the gap this file once shared with
+ * `ssrf-agent`: a regex on the text missed `0:0:0:0:0:ffff:7f00:1`.
+ */
+const COMPILED = RANGES.map(([cidr, family, label]) => {
+    const [network = '', prefix = ''] = cidr.split('/');
+    const list = new BlockList();
+    list.addSubnet(network, Number(prefix), family);
+    return { family, label, list };
+});
+/**
+ * Classify one IP address literal.
+ *
+ * The caller passes an address, never a hostname: a hostname has no class
+ * until it is resolved, and resolving it is the caller's decision.
+ */
+export function classifyAddress(address) {
+    const family = isIP(address);
+    if (family === 4)
+        return matchRange(address, 'ipv4');
+    if (family === 6)
+        return classifyIpv6(address);
+    throw new NotAnIpAddressError(address);
+}
+/** True when an address must not be reached by a fetcher of untrusted URLs. */
+export function isForbiddenAddress(address) {
+    return classifyAddress(address) !== 'public';
+}
+function matchRange(address, family) {
+    for (const range of COMPILED) {
+        if (range.family === family && range.list.check(address, family))
+            return range.label;
+    }
+    return 'public';
+}
+function classifyIpv6(address) {
+    const { canonical, hextets } = parseIpv6(address);
+    // An address that carries an IPv4 address is judged by that IPv4 address,
+    // because that is where a connection to it can end up.
+    const embedded = embeddedIpv4(hextets);
+    if (embedded !== null)
+        return matchRange(embedded, 'ipv4');
+    return matchRange(canonical, 'ipv6');
+}
+/**
+ * Parse an IPv6 literal into its 8 groups.
+ *
+ * The WHATWG URL parser validates the address and writes it in one canonical
+ * form: lowercase, at most one `::`, and any dotted IPv4 tail rewritten in hex.
+ * A zone ID (`%eth0`) names an interface, not a different address.
+ */
+function parseIpv6(address) {
+    const bare = address.split('%')[0] ?? '';
+    let canonical;
+    try {
+        canonical = new URL(`http://[${bare}]/`).hostname.slice(1, -1);
+    }
+    catch {
+        throw new NotAnIpAddressError(address);
+    }
+    const [head = '', tail] = canonical.split('::');
+    const left = head === '' ? [] : head.split(':');
+    const right = tail === undefined || tail === '' ? [] : tail.split(':');
+    const zeros = tail === undefined ? [] : Array(8 - left.length - right.length).fill('0');
+    const hextets = [...left, ...zeros, ...right].map((group) => Number.parseInt(group, 16));
+    return { canonical, hextets };
+}
+/**
+ * The IPv4 address inside an IPv6 address, for the forms that carry one.
+ *
+ * - `::ffff:a.b.c.d`     IPv4-mapped
+ * - `::ffff:0:a.b.c.d`   IPv4-translated
+ * - `::a.b.c.d`          IPv4-compatible (deprecated); `::` and `::1` excluded
+ * - `64:ff9b::a.b.c.d`   NAT64 well-known prefix
+ * - `2002:aabb:ccdd::`   6to4
+ */
+function embeddedIpv4(h) {
+    const zero = (from, to) => h.slice(from, to).every((group) => group === 0);
+    const dotted = (high = 0, low = 0) => [high >> 8, high & 0xff, low >> 8, low & 0xff].join('.');
+    if (zero(0, 5) && h[5] === 0xffff)
+        return dotted(h[6], h[7]);
+    if (zero(0, 4) && h[4] === 0xffff && h[5] === 0)
+        return dotted(h[6], h[7]);
+    if (zero(0, 6) && !(h[6] === 0 && (h[7] ?? 0) <= 1))
+        return dotted(h[6], h[7]);
+    if (h[0] === 0x64 && h[1] === 0xff9b && zero(2, 6))
+        return dotted(h[6], h[7]);
+    if (h[0] === 0x2002)
+        return dotted(h[1], h[2]);
+    return null;
+}
+//# sourceMappingURL=addresses.js.map

package/dist/util/addresses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addresses.js","sourceRoot":"","sources":["../../src/util/addresses.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AAiB1C,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAA;AAEjD,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,KAAa;QAChC,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAA;QADjB,UAAK,GAAL,KAAK,CAAQ;QAEhC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAID;;;GAGG;AACH,MAAM,MAAM,GAAgF;IAC1F,CAAC,oBAAoB,EAAE,MAAM,EAAE,WAAW,CAAC;IAC3C,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC;IACpC,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC;IACnC,CAAC,gBAAgB,EAAE,MAAM,EAAE,YAAY,CAAC;IACxC,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC;IACjC,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC;IACpC,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC;IACrC,6DAA6D;IAC7D,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC;IACpC,6DAA6D;IAC7D,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC;IACnC,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC;IACnC,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC;IACpC,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC;IACtC,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC;IACrC,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC;IACpC,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,CAAC;IAElC,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC;IACjC,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC;IAC/B,2EAA2E;IAC3E,iCAAiC;IACjC,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,CAAC;IACrC,gBAAgB;IAChB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,kDAAkD;IAClD,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC;IAChC,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC;IACpC,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC;IACpC,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC;IACnC,sDAAsD;IACtD,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC;IAChC,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;CAClC,CAAA;AAED;;;;GAIG;AACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;IACpD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAA;IAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AAChC,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACpD,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;AACxC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,eAAe,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,MAAc;IACjD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAA;IACtF,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAEjD,0EAA0E;IAC1E,uDAAuD;IACvD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE1D,OAAO,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACtE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAS,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAExF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAoB;IACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;IACnG,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAU,EAAE,CAC3C,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE1D,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1E,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAE9C,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/util/flipLookup.d.ts

@@ -0,0 +1,11 @@
+import type { LookupFunction } from 'node:net';
+/**
+ * A resolver that changes its answer between calls.
+ *
+ * This is DNS rebinding compressed into one process: the first answer is the
+ * one a pre-check sees, and every later answer is the one a socket gets.
+ *
+ * The rebinding here is SIMULATED. It tests the address used at connection
+ * time, not real DNS caching, TTL handling, or recursive resolvers.
+ */
+export declare function flipLookup(answers: readonly string[]): LookupFunction;

package/dist/util/flipLookup.js

@@ -0,0 +1,32 @@
+/**
+ * A resolver that changes its answer between calls.
+ *
+ * This is DNS rebinding compressed into one process: the first answer is the
+ * one a pre-check sees, and every later answer is the one a socket gets.
+ *
+ * The rebinding here is SIMULATED. It tests the address used at connection
+ * time, not real DNS caching, TTL handling, or recursive resolvers.
+ */
+export function flipLookup(answers) {
+    let call = 0;
+    return ((_hostname, options, callback) => {
+        const done = (typeof options === 'function' ? options : callback);
+        const index = Math.min(call, answers.length - 1);
+        call += 1;
+        const address = answers[index] ?? '127.0.0.1';
+        const family = address.includes(':') ? 6 : 4;
+        const wantsAll = typeof options === 'object' && options !== null && 'all' in options
+            ? Boolean(options.all)
+            : false;
+        // Match an asynchronous resolver. A synchronous callback can let an
+        // immediate connection failure surface before http.request's caller has
+        // attached its error listener, especially in a network-isolated test.
+        process.nextTick(() => {
+            if (wantsAll)
+                done(null, [{ address, family }]);
+            else
+                done(null, address, family);
+        });
+    });
+}
+//# sourceMappingURL=flipLookup.js.map

package/dist/util/flipLookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flipLookup.js","sourceRoot":"","sources":["../../src/util/flipLookup.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,OAAO,CAAC,CAAC,SAAiB,EAAE,OAAgB,EAAE,QAAiB,EAAE,EAAE;QACjE,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAIvD,CAAA;QAET,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAChD,IAAI,IAAI,CAAC,CAAA;QACT,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,WAAW,CAAA;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAE5C,MAAM,QAAQ,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,IAAI,OAAO;YAClF,CAAC,CAAC,OAAO,CAAE,OAA6B,CAAC,GAAG,CAAC;YAC7C,CAAC,CAAC,KAAK,CAAA;QAET,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;YACpB,IAAI,QAAQ;gBAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;;gBAC1C,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAmB,CAAA;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "ssrf-lab",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Test whether your Node.js fetcher actually blocks SSRF or just got lucky: a local attack range with an independent hit counter, for CI.",
+  "keywords": [
+    "ssrf",
+    "security",
+    "dns-rebinding",
+    "zip-bomb",
+    "http-client",
+    "testing",
+    "ssrf-protection",
+    "security-testing",
+    "appsec",
+    "webhook",
+    "link-preview",
+    "github-actions"
+  ],
+  "license": "MIT",
+  "author": "Roshan Amble",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/roshan-amble/ssrf-lab.git"
+  },
+  "homepage": "https://github.com/roshan-amble/ssrf-lab#readme",
+  "bugs": {
+    "url": "https://github.com/roshan-amble/ssrf-lab/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "bin": {
+    "ssrf-lab": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "!dist/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "scan": "tsx src/cli.ts",
+    "prepack": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "22.20.2",
+    "guarded-fetch": "0.1.5",
+    "request-filtering-agent": "3.2.1",
+    "ssrf-agent": "1.0.5",
+    "ssrf-req-filter": "1.1.1",
+    "tsx": "4.23.13",
+    "typescript": "5.9.3",
+    "vitest": "5.0.3"
+  }
+}