@airgap/coinlib-core
Version:
The @airgap/coinlib-core is a protocol agnostic library to prepare, sign and broadcast cryptocurrency transactions.
240 lines • 10.9 kB
JavaScript
;
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var __generator = (this && this.__generator) || function (thisArg, body) {
var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
function verb(n) { return function (v) { return step([n, v]); }; }
function step(op) {
if (f) throw new TypeError("Generator is already executing.");
while (_) try {
if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
if (y = 0, t) op = [op[0] & 2, t.value];
switch (op[0]) {
case 0: case 1: t = op; break;
case 4: _.label++; return { value: op[1], done: false };
case 5: _.label++; y = op[1]; op = [0]; continue;
case 7: op = _.ops.pop(); _.trys.pop(); continue;
default:
if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
if (t[2]) _.ops.pop();
_.trys.pop(); continue;
}
op = body.call(thisArg, _);
} catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
}
};
var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
if (ar || !(i in from)) {
if (!ar) ar = Array.prototype.slice.call(from, 0, i);
ar[i] = from[i];
}
}
return to.concat(ar || Array.prototype.slice.call(from));
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.remoteDataGet = exports.isPublicHttpUrl = exports.REMOTE_DATA_MAX_REDIRECTS = exports.REMOTE_DATA_MAX_CONTENT_LENGTH = exports.REMOTE_DATA_TIMEOUT = void 0;
var index_1 = __importDefault(require("../../dependencies/src/axios-0.33.0/index"));
/**
* Remote data URIs can originate from untrusted, attacker-controlled sources, e.g. the `token_info`
* big map of an arbitrary Tezos FA2 contract. Fetching them unguarded turns the wallet into an SSRF
* proxy against whatever the host can reach (cloud metadata endpoints, a local node's RPC, ...).
*
* Every remote data fetch therefore goes through `remoteDataGet`, which rejects non-public targets
* and bounds the request.
*
* Known limitation: only *literal* addresses are checked, so a hostname that resolves to a private
* address (DNS rebinding) is not caught. Closing that requires a custom `lookup` passed down to
* `http.request`.
*/
var ALLOWED_PROTOCOLS = ['http:', 'https:'];
exports.REMOTE_DATA_TIMEOUT = 30000;
exports.REMOTE_DATA_MAX_CONTENT_LENGTH = 10 * 1024 * 1024;
exports.REMOTE_DATA_MAX_REDIRECTS = 3;
function parseUrl(uri) {
try {
return new URL(uri);
}
catch (error) {
return undefined;
}
}
function parseIPv4(hostname) {
var parts = hostname.split('.');
if (parts.length !== 4) {
return undefined;
}
var bytes = [];
for (var _i = 0, parts_1 = parts; _i < parts_1.length; _i++) {
var part = parts_1[_i];
if (!/^[0-9]{1,3}$/.test(part)) {
return undefined;
}
var byte = parseInt(part, 10);
if (byte > 255) {
return undefined;
}
bytes.push(byte);
}
return bytes;
}
function parseIPv6(hostname) {
var _a = hostname.split('::'), head = _a[0], tail = _a[1], rest = _a.slice(2);
if (rest.length > 0) {
return undefined;
}
var parseGroups = function (value) {
if (value === '') {
return [];
}
var groups = value.split(':');
var bytes = [];
for (var i = 0; i < groups.length; i++) {
// an IPv4 address may only appear as the very last piece, e.g. ::ffff:127.0.0.1
if (i === groups.length - 1 && groups[i].includes('.')) {
var ipv4 = parseIPv4(groups[i]);
if (ipv4 === undefined) {
return undefined;
}
bytes.push.apply(bytes, ipv4);
continue;
}
if (!/^[0-9a-fA-F]{1,4}$/.test(groups[i])) {
return undefined;
}
var group = parseInt(groups[i], 16);
bytes.push(group >>> 8, group & 0xff);
}
return bytes;
};
var headBytes = parseGroups(head);
// `tail === undefined` means the address was not compressed and must be complete
var tailBytes = tail === undefined ? [] : parseGroups(tail);
if (headBytes === undefined || tailBytes === undefined) {
return undefined;
}
var missing = 16 - headBytes.length - tailBytes.length;
if (tail === undefined ? missing !== 0 : missing < 0) {
return undefined;
}
return __spreadArray(__spreadArray(__spreadArray([], headBytes, true), new Array(missing).fill(0), true), tailBytes, true);
}
function isBlockedIPv4(bytes) {
var a = bytes[0], b = bytes[1];
return (a === 0 || // 0.0.0.0/8, "this network"
a === 10 || // private
a === 127 || // loopback
(a === 100 && b >= 64 && b <= 127) || // 100.64.0.0/10, carrier-grade NAT
(a === 169 && b === 254) || // link-local, incl. cloud metadata endpoints
(a === 172 && b >= 16 && b <= 31) || // private
(a === 192 && b === 0) || // 192.0.0.0/24, IETF protocol assignments
(a === 192 && b === 168) || // private
(a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15, benchmarking
a >= 224 // multicast and reserved, incl. 255.255.255.255
);
}
function isBlockedIPv6(bytes) {
var isPrefix = function () {
var prefix = [];
for (var _i = 0; _i < arguments.length; _i++) {
prefix[_i] = arguments[_i];
}
return prefix.every(function (byte, index) { return bytes[index] === byte; });
};
// IPv4-mapped (::ffff:0:0/96) and IPv4-translated/NAT64 (64:ff9b::/96) addresses embed an IPv4
// address in the last four bytes and are routed as such, so they must be judged as IPv4.
// Node normalizes ::ffff:127.0.0.1 to the hex form ::ffff:7f00:1, hence the check on bytes.
if (isPrefix(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff) || isPrefix(0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0)) {
return isBlockedIPv4(bytes.slice(12));
}
return (bytes.every(function (byte) { return byte === 0; }) || // :: unspecified
isPrefix(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1) || // ::1 loopback
(bytes[0] & 0xfe) === 0xfc || // fc00::/7 unique local
(bytes[0] === 0xfe && (bytes[1] & 0xc0) === 0x80) || // fe80::/10 link-local
bytes[0] === 0xff // ff00::/8 multicast
);
}
/**
* Whether `uri` is an `http(s)` URL that does not obviously point back at the host or its private
* network. Anything unparseable, non-`http(s)`, credential-bearing or address-literal-private is
* rejected.
*/
function isPublicHttpUrl(uri) {
var url = parseUrl(uri);
if (url === undefined) {
return false;
}
if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
return false;
}
// credentials in an untrusted URL are only ever a way to make us leak them
if (url.username !== '' || url.password !== '') {
return false;
}
// `new URL` keeps IPv6 hosts bracketed and may keep a fully qualified name's trailing dot
var hostname = url.hostname
.replace(/^\[|\]$/g, '')
.replace(/\.$/, '')
.toLowerCase();
if (hostname === '') {
return false;
}
if (hostname === 'localhost' || hostname.endsWith('.localhost')) {
return false;
}
// `new URL` already normalizes the integer, octal and hex spellings of an IPv4 host
var ipv4 = parseIPv4(hostname);
if (ipv4 !== undefined) {
return !isBlockedIPv4(ipv4);
}
var ipv6 = parseIPv6(hostname);
if (ipv6 !== undefined) {
return !isBlockedIPv6(ipv6);
}
return true;
}
exports.isPublicHttpUrl = isPublicHttpUrl;
/**
* The single entry point through which remote data is fetched. Validates the target, bounds the
* request, and re-validates every redirect hop, since a one-off check on the initial URL is
* trivially defeated by a redirect.
*/
function remoteDataGet(uri, responseType) {
if (responseType === void 0) { responseType = 'json'; }
return __awaiter(this, void 0, void 0, function () {
return __generator(this, function (_a) {
if (!isPublicHttpUrl(uri)) {
throw new Error("Refusing to fetch remote data from a non-public URL: ".concat(uri));
}
return [2 /*return*/, index_1.default.get(uri, {
responseType: responseType,
timeout: exports.REMOTE_DATA_TIMEOUT,
maxContentLength: exports.REMOTE_DATA_MAX_CONTENT_LENGTH,
maxRedirects: exports.REMOTE_DATA_MAX_REDIRECTS,
beforeRedirect: function (options) {
var href = options.href;
if (typeof href !== 'string' || !isPublicHttpUrl(href)) {
throw new Error("Refusing to follow a remote data redirect to a non-public URL: ".concat(String(href)));
}
}
})];
});
});
}
exports.remoteDataGet = remoteDataGet;
//# sourceMappingURL=remoteDataRequest.js.map