tapimo 0.0.0 → 0.0.2

package/dist/internal/webhookDestinations/url.js

@@ -0,0 +1,130 @@
+import * as WebhookDestination from '../WebhookDestination.js';
+/**
+ * Builds a `url` destination. Its `deliver` serializes the envelope, signs the
+ * raw body with the subscription secret (HMAC in `tempo-signature`), re-runs the
+ * SSRF guard, and POSTs it rejecting redirects. The URL is SSRF-validated at
+ * construction time too. Deliver with `.deliver({ envelope, secret })`.
+ */
+export function url(url) {
+    assertDeliverableUrl(url);
+    return {
+        async deliver(options) {
+            const { envelope } = options;
+            // Defense-in-depth: re-run the static SSRF guard at delivery time so a
+            // stored URL that no longer passes (e.g. a tightened block list) is never
+            // POSTed to.
+            try {
+                assertDeliverableUrl(url);
+            }
+            catch (cause) {
+                const reason = cause instanceof WebhookDestination.InvalidUrlError ? cause.reason : 'malformed';
+                return { error: `url rejected (${reason})`, ok: false };
+            }
+            if (options.secret === undefined)
+                return { error: 'url destination requires a secret', ok: false };
+            const body = JSON.stringify(envelope);
+            return WebhookDestination.send({
+                body,
+                fetch: options.fetch,
+                headers: {
+                    [WebhookDestination.eventIdHeader]: envelope.id,
+                    [WebhookDestination.eventTypeHeader]: envelope.type,
+                    [WebhookDestination.signatureHeader]: WebhookDestination.sign({
+                        body,
+                        secret: options.secret,
+                        timestamp: options.timestamp,
+                    }),
+                },
+                now: options.now,
+                // Never follow redirects: a 3xx could point at a private/metadata host
+                // and bypass the SSRF guard, which only validates the original URL.
+                rejectRedirects: true,
+                timeoutMs: options.timeoutMs,
+                url,
+            });
+        },
+        type: 'url',
+        url,
+    };
+}
+/**
+ * Validates a subscriber URL, rejecting non-`https`, embedded credentials, and
+ * private/loopback/link-local/metadata hosts. Returns the parsed URL.
+ *
+ * This is a static guard; DNS-rebinding defense (resolving + re-checking at
+ * delivery time) is layered on later.
+ */
+export function assertDeliverableUrl(input) {
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new WebhookDestination.InvalidUrlError('malformed', input);
+    }
+    if (url.protocol !== 'https:')
+        throw new WebhookDestination.InvalidUrlError('protocol', input);
+    if (url.username || url.password)
+        throw new WebhookDestination.InvalidUrlError('credentials', input);
+    if (isBlockedHost(url.hostname))
+        throw new WebhookDestination.InvalidUrlError('blocked_host', input);
+    return url;
+}
+function isBlockedHost(hostname) {
+    // URL hostnames preserve IPv6 brackets and are already lowercased for names.
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host === 'metadata.google.internal')
+        return true;
+    if (host.length === 0)
+        return true;
+    if (isIpv4(host))
+        return isBlockedIpv4(host);
+    if (host.includes(':'))
+        return isBlockedIpv6(host);
+    return false;
+}
+function isIpv4(host) {
+    const parts = host.split('.');
+    return parts.length === 4 && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+function isBlockedIpv4(host) {
+    const [a, b] = host.split('.').map(Number);
+    if (a === 0 || a === 10 || a === 127)
+        return true; // unspecified, private, loopback
+    if (a === 169 && b === 254)
+        return true; // link-local (incl. cloud metadata)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // private
+    if (a === 192 && b === 168)
+        return true; // private
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // carrier-grade NAT
+    return false;
+}
+function isBlockedIpv6(host) {
+    if (host === '::' || host === '::1')
+        return true; // unspecified, loopback
+    if (host.startsWith('fe8') ||
+        host.startsWith('fe9') ||
+        host.startsWith('fea') ||
+        host.startsWith('feb'))
+        return true; // link-local fe80::/10
+    if (host.startsWith('fc') || host.startsWith('fd'))
+        return true; // unique local fc00::/7
+    // IPv4-mapped (::ffff:a.b.c.d) — re-check the embedded v4.
+    const dotted = host.match(/::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (dotted?.[1] && isIpv4(dotted[1]))
+        return isBlockedIpv4(dotted[1]);
+    // The URL parser compresses ::ffff:a.b.c.d to two hex groups (e.g. 7f00:1).
+    const hex = host.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (hex?.[1] && hex[2]) {
+        const high = Number.parseInt(hex[1], 16);
+        const low = Number.parseInt(hex[2], 16);
+        const v4 = `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+        return isBlockedIpv4(v4);
+    }
+    return false;
+}
+//# sourceMappingURL=url.js.map

package/dist/internal/webhookDestinations/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../../src/internal/webhookDestinations/url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,kBAAkB,MAAM,0BAA0B,CAAA;AAE9D;;;;;GAKG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACzB,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;YAC5B,uEAAuE;YACvE,0EAA0E;YAC1E,aAAa;YACb,IAAI,CAAC;gBACH,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAA;gBAClF,OAAO,EAAE,KAAK,EAAE,iBAAiB,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;YACzD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;YAClE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;YACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC;gBAC7B,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE;oBACP,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE;oBAC/C,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,IAAI;oBACnD,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,IAAI,CAAC;wBAC5D,IAAI;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAC;iBACH;gBACD,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,uEAAuE;gBACvE,oEAAoE;gBACpE,eAAe,EAAE,IAAI;gBACrB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,GAAG;aACJ,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,EAAE,KAAK;QACX,GAAG;KACJ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC9F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAC9B,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACpE,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAElC,IAAI,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;IAClD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAA;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAA;IAC9E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,iCAAiC;IACnF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,oCAAoC;IAC5E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,UAAU;IAC3D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,UAAU;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,oBAAoB;IACtE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,wBAAwB;IACzE,IACE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAEtB,OAAO,IAAI,CAAA,CAAC,uBAAuB;IACrC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,wBAAwB;IAExF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACzE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAErE,4EAA4E;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACjE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACvC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,EAAE,CAAA;QAClE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}