SSRF lab: Guard an outbound fetch against SSRF

export async function fetchGuarded(rawUrl, client) {
  let url = rawUrl;
  for (let hop = 0; hop <= 5; hop++) {
    const parsed = URL.parse(url);
    if (!parsed || (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
        || parsed.username || parsed.password) return {status: 'blocked'};
    const host = parsed.hostname;
    const literal = ipFromHost(host);
    const addresses = literal ? [literal] : await client.resolve(host);
    if (!addresses.length || !addresses.every(isPublic)) return {status: 'blocked'};
    const response = await client.fetch(parsed.href);
    if (!response.redirect) return {status: 'fetched', url: parsed.href};
    url = new URL(response.redirect, parsed.href).href;
  }
  return {status: 'blocked'};
}

// The IP address of an IP-literal host, or null for a name. The URL parser has already
// normalized 2130706433, 0x7f.1 and 127.1 to 127.0.0.1 and bracketed IPv6 hosts.
function ipFromHost(host) {
  if (host.startsWith('[') && host.endsWith(']')) return host.slice(1, -1);
  return /^\d{1,3}(\.\d{1,3}){3}$/.test(host) ? host : null;
}

function isPublic(address) {
  const h = address.toLowerCase();
  if (h.includes(':'))
    // IPv6: only global unicast 2000::/3, minus documentation 2001:db8::/32. Loopback,
    // unspecified, link-local, unique-local, multicast and IPv4-mapped (::ffff:…) fall outside it.
    return /^[23][0-9a-f]{3}:/.test(h) && !/^2001:0?db8:/.test(h);
  const n = h.split('.').map(Number);
  if (n.length !== 4 || n.some(o => !(o >= 0 && o <= 255))) return false;
  const [a, b, c] = n;
  if (a === 10 || a === 127 || a === 0 || a >= 224) return false;        // private, loopback, this-host, multicast/reserved
  if (a === 169 && b === 254) return false;                              // link-local, incl. 169.254.169.254
  if (a === 172 && b >= 16 && b <= 31) return false;                     // private
  if (a === 192 && b === 168) return false;                              // private
  if (a === 100 && b >= 64 && b <= 127) return false;                    // carrier-grade NAT
  if (a === 192 && b === 0 && (c === 0 || c === 2)) return false;        // protocol assignments, TEST-NET-1
  if (a === 198 && (b === 18 || b === 19)) return false;                 // benchmarking
  if (a === 198 && b === 51 && c === 100) return false;                  // TEST-NET-2
  if (a === 203 && b === 0 && c === 113) return false;                   // TEST-NET-3
  return true;
}