@finapi/web-form/src/utils/url.util.ts

Library for integrating the finAPI Web Form

const LOCALHOST = "localhost";
const FINAPI_DOMAIN = ".finapi.net";
const FINAPI_PUBLIC_DOMAIN = ".finapi.io";

const isPrivateIPv4 = (ip: string) => {
  if (/^(10)\.(.*)\.(.*)\.(.*)$/.test(ip)) {
    // 10.x.x.x
    return true;
  } else if (/^(172)\.(1[6-9]|2\d|3[0-1])\.(.*)\.(.*)$/.test(ip)) {
    // 172.16.x.x - 172.31.255.255
    return true;
  } else {
    // 192.168.x.x
    return /^(192)\.(168)\.(.*)\.(.*)$/.test(ip);
  }
};

const isTargetLocal = (targetUrl: string) => {
  const hostname = new URL(targetUrl).hostname;
  return (
    hostname === LOCALHOST ||
    // the given IP address belongs to a private network (local testing)
    isPrivateIPv4(hostname)
  );
};

const isFinApiDomain = (targetUrl: string) => {
  const hostname = new URL(targetUrl).hostname;
  return (
    hostname.endsWith(FINAPI_DOMAIN) || hostname.endsWith(FINAPI_PUBLIC_DOMAIN)
  );
};

export const validateUrl = (url: string): void => {
  try {
    // if the url is not valid, the constructor throws an error
    new URL(url);

    if (!isTargetLocal(url) && !isFinApiDomain(url)) {
      throw Error("The URL must be local or belong to the finAPI domain.");
    }
  } catch (err) {
    throw new Error("Invalid 'url': " + url);
  }
};