Defending Against SSRF

import dns from 'node:dns/promises';
import net from 'node:net';
import ipaddr from 'ipaddr.js';

const ALLOWED_SCHEMES = new Set(['https:']);
const ALLOWED_PORTS = new Set([443]);

// Ranges that must never be reachable. Both address families.
const BLOCKED_RANGES = [
  'unspecified', 'broadcast', 'multicast', 'linkLocal', 'loopback',
  'private', 'reserved', 'carrierGradeNat', 'uniqueLocal', 'ipv4Mapped',
  'rfc6145', 'rfc6052', '6to4', 'teredo',
];

export function assertPublicAddress(ip) {
  const parsed = ipaddr.parse(ip);

  // An IPv6-mapped IPv4 address must be judged on its IPv4 form:
  // ::ffff:169.254.169.254 is link-local, not "some ipv6 address".
  const effective = parsed.kind() === 'ipv6' && parsed.isIPv4MappedAddress()
    ? parsed.toIPv4Address()
    : parsed;

  const range = effective.range();
  if (BLOCKED_RANGES.includes(range)) {
    throw new BadRequestError(`address_not_allowed:${range}`);
  }

  // Belt and braces for the cloud metadata addresses specifically.
  const str = effective.toString();
  if (['169.254.169.254', '100.100.100.200', 'fd00:ec2::254'].includes(str)) {
    throw new BadRequestError('address_not_allowed:metadata');
  }
}

export async function resolveAndValidate(rawUrl) {
  let url;
  try {
    url = new URL(rawUrl);
  } catch {
    throw new BadRequestError('invalid_url');
  }

  // 1. Scheme and port
  if (!ALLOWED_SCHEMES.has(url.protocol)) throw new BadRequestError('scheme_not_allowed');
  const port = Number(url.port || 443);
  if (!ALLOWED_PORTS.has(port)) throw new BadRequestError('port_not_allowed');

  // 2. Credentials in the URL are a confusion trick — refuse them.
  if (url.username || url.password) throw new BadRequestError('credentials_in_url');

  // 3. A literal IP is validated directly; a name is resolved.
  const host = url.hostname.replace(/^\[|\]$/g, '');
  let addresses;
  if (net.isIP(host)) {
    addresses = [{ address: host }];
  } else {
    // ALL records — a name can resolve to several addresses, and ONE internal
    // answer is enough.
    addresses = await dns.lookup(host, { all: true, verbatim: true })
      .catch(() => { throw new BadRequestError('dns_resolution_failed'); });
  }
  if (!addresses.length) throw new BadRequestError('dns_resolution_failed');

  for (const { address } of addresses) assertPublicAddress(address);

  // 4. Return the address we validated. The caller connects to THIS,
  //    not to the hostname — that is what closes rebinding.
  return { url, host, address: addresses[0].address, port };
}

import https from 'node:https';

export async function safeFetch(rawUrl, { maxBytes = 5_000_000, timeoutMs = 5000 } = {}) {
  const { url, host, address, port } = await resolveAndValidate(rawUrl);

  return new Promise((resolve, reject) => {
    const req = https.request({
      host: address,              // ← connect to the VALIDATED ip
      port,
      path: url.pathname + url.search,
      method: 'GET',
      // Virtual hosting and certificate validation still work:
      headers: { Host: host, 'User-Agent': 'abc-fetcher/1.0', Accept: 'image/*' },
      servername: host,           // SNI + certificate hostname check
      timeout: timeoutMs,
      // No cookies, no Authorization, no internal headers. Ever.
    }, (res) => {
      // Redirects are NOT followed. A 302 to an internal address is the
      // simplest bypass of any URL validation.
      if (res.statusCode >= 300 && res.statusCode < 400) {
        res.destroy();
        return reject(new BadRequestError('redirects_not_followed'));
      }
      if (res.statusCode !== 200) {
        res.destroy();
        return reject(new BadRequestError(`upstream_status_${res.statusCode}`));
      }

      // Bound the response as it arrives — Content-Length is a claim.
      const chunks = [];
      let total = 0;
      res.on('data', (chunk) => {
        total += chunk.length;
        if (total > maxBytes) {
          res.destroy();
          return reject(new BadRequestError('response_too_large'));
        }
        chunks.push(chunk);
      });
      res.on('end', () => resolve({
        buffer: Buffer.concat(chunks),
        contentType: res.headers['content-type'],
      }));
    });

    req.on('timeout', () => { req.destroy(); reject(new BadRequestError('timeout')); });
    req.on('error', () => reject(new BadRequestError('fetch_failed')));
    req.end();
  });
}

// If you genuinely must follow redirects, validate EVERY hop with the same
// rules and cap the count:
export async function safeFetchFollowing(rawUrl, maxHops = 3) {
  let current = rawUrl;
  for (let hop = 0; hop <= maxHops; hop++) {
    const res = await safeFetchOnce(current);        // validates before connecting
    if (!res.redirectTo) return res;
    current = new URL(res.redirectTo, current).toString();   // re-validated next loop
  }
  throw new BadRequestError('too_many_redirects');
}

# Application checks can be bypassed. Network segmentation cannot be bypassed
# by a bug in your URL parser.

# ── Run URL-fetching work in its own segment ─────────────────────────
# docker-compose.yml
services:
  fetcher:
    image: url-fetcher:latest
    networks: [egress-only]        # NOT on the internal application network
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 256m

networks:
  egress-only:
    driver: bridge
    # No route to the app network, the database, or Redis.

# ── Block the metadata address at the host ───────────────────────────
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner fetcher -j REJECT

# ── Or in AWS: a private subnet with a NAT gateway and nothing else ──
#   fetcher subnet: 10.0.9.0/24
#   route table:    0.0.0.0/0 → NAT gateway    (internet, yes)
#                   10.0.0.0/8 → BLACKHOLE      (internal, no)
#   security group egress: 0.0.0.0/0:443 only
#   IMDSv2 required, hop limit 1

# ── Or an egress proxy, which gives you an audit trail too ───────────
#   fetcher has NO direct internet route.
#   All outbound traffic goes through squid/envoy, which:
#     - resolves and validates the destination itself
#     - denies RFC1918, loopback and link-local
#     - logs every request with the calling service
#     - enforces per-service allowlists where the destinations are known

# Now: a bypass in the URL validator reaches a network with no route to
# anything worth reaching. That is the difference between a bug and a breach.