request-filtering-agent
Version:
An http(s).Agent implementation that block request Private IP address.
175 lines • 7.56 kB
JavaScript
import * as net from "node:net";
import * as http from "node:http";
import * as https from "node:https";
import ipaddr from "ipaddr.js";
import * as dns from "node:dns";
export const DefaultRequestFilteringAgentOptions = {
allowPrivateIPAddress: false,
allowMetaIPAddress: false,
allowIPAddressList: [],
denyIPAddressList: []
};
/**
* validate the address that is matched the validation options
* @param address ip address
* @param host optional
* @param family optional
* @param options
*/
const validateIPAddress = ({ address, host, family }, options) => {
// if it is not IP address, skip it
if (net.isIP(address) === 0) {
return;
}
try {
const addr = ipaddr.parse(address);
const range = addr.range();
// prefer allowed list
if (options.allowIPAddressList.length > 0 && options.allowIPAddressList.includes(address)) {
return;
}
if (!options.allowMetaIPAddress) {
// address === "0.0.0.0" || address == "::"
if (range === "unspecified") {
return new Error(`DNS lookup ${address}(family:${family}, host:${host}) is not allowed. Because, It is meta IP address.`);
}
}
// TODO: rename option name
if (!options.allowPrivateIPAddress && range !== "unicast") {
return new Error(`DNS lookup ${address}(family:${family}, host:${host}) is not allowed. Because, It is private IP address.`);
}
if (options.denyIPAddressList.length > 0 && options.denyIPAddressList.includes(address)) {
return new Error(`DNS lookup ${address}(family:${family}, host:${host}) is not allowed. Because It is defined in denyIPAddressList.`);
}
}
catch (error) {
return error; // if can not parse IP address, throw error
}
return;
};
const makeLookup = (createConnectionOptions, requestFilterOptions) => {
// @ts-expect-error - @types/node has a poor definition of this callback
return (hostname, options, cb) => {
const lookup = createConnectionOptions.lookup || dns.lookup;
let lookupCb;
if (options.all) {
lookupCb = ((err, addresses) => {
if (err) {
cb(err);
return;
}
for (const { address, family } of addresses) {
const validationError = validateIPAddress({ address, family, host: hostname }, requestFilterOptions);
if (validationError) {
cb(validationError);
return;
}
}
cb(null, addresses);
});
}
else {
lookupCb = ((err, address, family) => {
if (err) {
cb(err);
return;
}
const validationError = validateIPAddress({ address: address, family: family, host: hostname }, requestFilterOptions);
if (validationError) {
cb(validationError);
return;
}
cb(null, address, family);
});
}
// @ts-expect-error - @types/node has a poor definition of this callback
lookup(hostname, options, lookupCb);
};
};
/**
* A subclass of http.Agent with request filtering
*/
export class RequestFilteringHttpAgent extends http.Agent {
requestFilterOptions;
constructor(options) {
super(options);
this.requestFilterOptions = {
allowPrivateIPAddress: options && options.allowPrivateIPAddress !== undefined
? options.allowPrivateIPAddress
: DefaultRequestFilteringAgentOptions.allowPrivateIPAddress,
allowMetaIPAddress: options && options.allowMetaIPAddress !== undefined
? options.allowMetaIPAddress
: DefaultRequestFilteringAgentOptions.allowMetaIPAddress,
allowIPAddressList: options && options.allowIPAddressList
? options.allowIPAddressList
: DefaultRequestFilteringAgentOptions.allowIPAddressList,
denyIPAddressList: options && options.denyIPAddressList
? options.denyIPAddressList
: DefaultRequestFilteringAgentOptions.denyIPAddressList
};
}
// override http.Agent#createConnection
// https://nodejs.org/api/http.html#http_agent_createconnection_options_callback
// https://nodejs.org/api/net.html#net_net_createconnection_options_connectlistener
createConnection(options, connectionListener) {
const { host } = options;
if (host !== undefined) {
// Direct ip address request without dns-lookup
// Example: http://127.0.0.1
// https://nodejs.org/api/net.html#net_socket_connect_options_connectlistener
const validationError = validateIPAddress({ address: host }, this.requestFilterOptions);
if (validationError) {
throw validationError;
}
}
// https://nodejs.org/api/net.html#net_socket_connect_options_connectlistener
return super.createConnection({ ...options, lookup: makeLookup(options, this.requestFilterOptions) }, connectionListener);
}
}
/**
* A subclass of https.Agent with request filtering
*/
export class RequestFilteringHttpsAgent extends https.Agent {
requestFilterOptions;
constructor(options) {
super(options);
this.requestFilterOptions = {
allowPrivateIPAddress: options && options.allowPrivateIPAddress !== undefined ? options.allowPrivateIPAddress : false,
allowMetaIPAddress: options && options.allowMetaIPAddress !== undefined ? options.allowMetaIPAddress : false,
allowIPAddressList: options && options.allowIPAddressList ? options.allowIPAddressList : [],
denyIPAddressList: options && options.denyIPAddressList ? options.denyIPAddressList : []
};
}
// override http.Agent#createConnection
// https://nodejs.org/api/http.html#http_agent_createconnection_options_callback
// https://nodejs.org/api/net.html#net_net_createconnection_options_connectlistener
createConnection(options, connectionListener) {
const { host } = options;
if (host !== undefined) {
// Direct ip address request without dns-lookup
// Example: http://127.0.0.1
// https://nodejs.org/api/net.html#net_socket_connect_options_connectlistener
const validationError = validateIPAddress({ address: host }, this.requestFilterOptions);
if (validationError) {
throw validationError;
}
}
// https://nodejs.org/api/net.html#net_socket_connect_options_connectlistener
return super.createConnection({ ...options, lookup: makeLookup(options, this.requestFilterOptions) }, connectionListener);
}
}
export const globalHttpAgent = new RequestFilteringHttpAgent();
export const globalHttpsAgent = new RequestFilteringHttpsAgent();
/**
* Get an agent for the url
* return http or https agent
* @param url
* @param options
*/
export const useAgent = (url, options) => {
if (!options) {
return url.startsWith("https") ? globalHttpsAgent : globalHttpAgent;
}
return url.startsWith("https") ? new RequestFilteringHttpsAgent(options) : new RequestFilteringHttpAgent(options);
};
//# sourceMappingURL=request-filtering-agent.js.map