mirror of
https://github.com/nexu-io/open-design.git
synced 2026-10-27 09:51:12 +01:00
@aaronjmarsandGitHub
377d65b7e4
* fix(security): strip trailing dot in normalizeBracketedIpv6 (FQDN bypass)
new URL('http://192.168.1.5./').hostname returns '192.168.1.5.' — the
trailing dot is the RFC 1034 absolute-FQDN form and resolves identically
to '192.168.1.5'. parseIpv4 fails on the dotted form, so 169.254.169.254.
slips past the metadata-service block, 192.168.1.5. slips past the LAN
block, and localhost. slips past the loopback identification.
Strip trailing dots in normalizeBracketedIpv6 so all downstream checks
(isLoopbackApiHost, isBlockedExternalApiHostname, isBlockedIpv4, IPv6
range tests) see the canonical form.
Adds 6 vitest cases covering loopback FQDN forms (localhost.,
foo.localhost., 127.0.0.1.) and SSRF FQDN bypasses (169.254.169.254.,
192.168.1.5., 10.0.0.5.).
Refs nexu-io/open-design#1119 review feedback (P2 from @lefarcen).
* test(connectionTest): tighten trailing-dot coverage per #1122 review
Two issues from #1122 review:
1. (P2 from @mrcfps + codex bot) The original `foo.localhost.` case
asserted error===undefined on validateBaseUrl, which only proves the
URL passed validation — not that the host is identified as loopback.
Replaced with direct isLoopbackApiHost(...) assertions on the actual
loopback FQDN forms (localhost., 127.0.0.1., 127.0.0.5.) so the test
exercises the loopback path the comment claims.
2. (P3 from @lefarcen) Original blocked-FQDN tests covered only 3 of 7
ranges that isBlockedIpv4 handles. Added a dedicated case per range
(0.0.0.0/8, 10/8, 100.64/10, 169.254/16, 172.16/12, 192.168/16,
multicast >=224) so future regressions in normalizeBracketedIpv6
surface against the full coverage.
* docs: drop misleading foo.localhost./endsWith claim in normalizer comment
@lefarcen review feedback: isLoopbackApiHost only accepts exact 'localhost',
'::1', loopback IPv4, and mapped loopback IPv4 — there's no subdomain or
endsWith handling, so referencing 'foo.localhost.' overstates what the
trailing-dot strip enables. Rewrite the comment to match actual call sites
(isLoopbackApiHost equality + isBlockedIpv4 numeric parse).