Fix SSRF in Node.js and Express

// No validation at all: parse the URL and hand the host straight to the resolver.
function target(rawUrl) {
  const url = new URL(rawUrl);
  return {
    hostname: url.hostname.replace(/^\[|\]$/g, ''),
    port: url.port ? Number(url.port) : defaultPort(url.protocol),
    hostHeader: url.port ? `${url.hostname}:${url.port}` : url.hostname,
    pathname: `${url.pathname}${url.search}`,
    origin: url.origin,
  };
}

// Private, loopback, link-local and other non-public ranges. Everything the feature
// should never reach, in one table, so the policy is reviewable in one place.
const DENY_V4 = [
  ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
  ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
  ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
  ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
];

function v4ToBytes(ip) {
  return ip.split('.').map(Number);
}

function v6ToBytes(ip) {
  let text = ip.split('%')[0];
  const embedded = text.match(/(.*:)((?:\d{1,3}\.){3}\d{1,3})$/);
  if (embedded) {
    const [a, b, c, d] = v4ToBytes(embedded[2]);
    text = `${embedded[1]}${((a << 8) | b).toString(16)}:${((c << 8) | d).toString(16)}`;
  }
  const halves = text.split('::');
  if (halves.length > 2) return null;
  const head = halves[0] ? halves[0].split(':') : [];
  const tail = halves.length === 2 ? (halves[1] ? halves[1].split(':') : []) : null;
  const groups = tail === null ? head : [...head, ...Array(8 - head.length - tail.length).fill('0'), ...tail];
  if (groups.length !== 8) return null;
  const bytes = [];
  for (const g of groups) {
    const v = parseInt(g, 16);
    bytes.push((v >> 8) & 0xff, v & 0xff);
  }
  return bytes;
}

function inRange(bytes, prefix, len) {
  for (let bit = 0; bit < len; bit += 1) {
    const byte = bit >> 3;
    const mask = 1 << (7 - (bit & 7));
    if ((bytes[byte] & mask) !== (prefix[byte] & mask)) return false;
  }
  return true;
}

// inet_aton-style parse so decimal (2130706433), octal (0177.0.0.1) and hex
// (0x7f.0.0.1) literals are recognised as addresses rather than treated as names and
// trusted to the resolver.
function parseIpLiteral(host) {
  const inner = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
  if (net.isIPv6(inner)) return { family: 6, text: inner };
  if (inner !== host) return null; // bracketed but not IPv6
  const parts = host.split('.');
  if (parts.length > 4) return null;
  const nums = [];
  for (const part of parts) {
    let value;
    if (/^0[xX][0-9a-fA-F]+$/.test(part)) value = parseInt(part, 16);
    else if (/^0[0-7]*$/.test(part)) value = parseInt(part || '0', 8);
    else if (/^[1-9][0-9]*$/.test(part)) value = Number(part);
    else return null;
    if (!Number.isSafeInteger(value) || value < 0) return null;
    nums.push(value);
  }
  const caps = [0xffffffff, 0xffffff, 0xffff, 0xff];
  const last = nums.length - 1;
  if (nums[last] > caps[last]) return null;
  if (nums.slice(0, last).some((n) => n > 0xff)) return null;
  const shifts = { 1: [0], 2: [24, 0], 3: [24, 16, 0], 4: [24, 16, 8, 0] }[nums.length];
  const value = nums.reduce((acc, n, i) => acc + n * 2 ** shifts[i], 0);
  const octet = (shift) => Math.floor(value / 2 ** shift) % 256;
  return { family: 4, text: `${octet(24)}.${octet(16)}.${octet(8)}.${octet(0)}` };
}

function assertPublicAddress(ip) {
  let bytes = v4ToBytes(ip);
  let family = 4;
  if (net.isIPv6(ip)) {
    bytes = v6ToBytes(ip);
    family = 6;
    if (!bytes) throw new BlockedRequestError('unparseable address');
    // Unwrap IPv4-mapped (::ffff:a.b.c.d), NAT64 (64:ff9b::/96) and 6to4 (2002::/16).
    if (inRange(bytes, v6ToBytes('::ffff:0:0'), 96) || inRange(bytes, v6ToBytes('64:ff9b::'), 96)) {
      bytes = bytes.slice(12);
      family = 4;
    } else if (inRange(bytes, v6ToBytes('2002::'), 16)) {
      bytes = bytes.slice(2, 6);
      family = 4;
    }
  }
  if (family === 6) {
    const isGlobalUnicast = inRange(bytes, v6ToBytes('2000::'), 3) && !inRange(bytes, v6ToBytes('2001:db8::'), 32);
    if (!isGlobalUnicast) throw new BlockedRequestError('non-public IPv6 address');
    return;
  }
  for (const [prefix, len] of DENY_V4) {
    if (inRange(bytes, v4ToBytes(prefix), len)) throw new BlockedRequestError('non-public IPv4 address');
  }
}

// Parse the URL, enforce the scheme and port allowlists, turn the host into a vetted
// address, and return everything the connection needs. Reject (not resolve) IP
// literals that are not public, so rebinding cannot reach them later.
async function vet(rawUrl, resolve) {
  let url;
  try {
    url = new URL(rawUrl);
  } catch {
    throw new BlockedRequestError('invalid URL');
  }
  if (!DEFAULTS.allowedSchemes.includes(url.protocol)) throw new BlockedRequestError('scheme not allowed');
  if (url.username || url.password) throw new BlockedRequestError('credentials in URL not allowed');
  const port = url.port ? Number(url.port) : defaultPort(url.protocol);
  if (!DEFAULTS.allowedPorts.includes(port)) throw new BlockedRequestError('port not allowed');

  const hostname = url.hostname.replace(/^\[|\]$/g, '');
  const literal = parseIpLiteral(url.hostname);
  const addresses = literal ? [literal.text] : await resolve(hostname);
  if (addresses.length === 0) throw new BlockedRequestError('host did not resolve');
  for (const ip of addresses) assertPublicAddress(ip); // reject the whole set if any is internal

  return {
    ip: addresses[0],
    port,
    hostHeader: url.port ? `${url.hostname}:${url.port}` : url.hostname,
    pathname: `${url.pathname}${url.search}`,
    origin: url.origin,
  };
}

// A 3xx response is a fresh destination decision, not permission to follow. Re-run the
// full policy on every hop and pin each connection to its own vetted address.
export async function fetchUrl(rawUrl, deps) {
  const resolve = deps.resolve;
  const maxRedirects = deps.maxRedirects ?? DEFAULTS.maxRedirects;
  let target = rawUrl;
  for (let hop = 0; hop <= maxRedirects; hop += 1) {
    const vetted = await vet(target, resolve);
    const result = await sendOnce(vetted.ip, vetted.port, vetted.hostHeader, vetted.pathname, deps);
    if (result.status >= 300 && result.status < 400 && result.location) {
      target = new URL(result.location, target).href; // relative to this hop's URL; validated again at the top of the loop
      continue;
    }
    return summarise(result);
  }
  throw new BlockedRequestError('too many redirects');
}

// A substring blocklist of "obviously internal" hosts. Looks reassuring; the address
// an attacker actually reaches is decided by DNS, which this never consults.
const BLOCKED_SUBSTRINGS = [
  'localhost', '127.0.0.1', '0.0.0.0', '169.254', '10.', '192.168', '172.16', '::1', 'metadata', 'internal',
];

function target(rawUrl) {
  const url = new URL(rawUrl);
  const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
  if (BLOCKED_SUBSTRINGS.some((bad) => host.includes(bad))) {
    throw new BlockedRequestError('host is blocked');
  }
  return {
    hostname: host,
    port: url.port ? Number(url.port) : defaultPort(url.protocol),
    hostHeader: url.port ? `${url.hostname}:${url.port}` : url.hostname,
    pathname: `${url.pathname}${url.search}`,
    origin: url.origin,
  };
}