Spaces:
Running
Running
| import { beforeEach, describe, expect, it, vi } from "vitest"; | |
| const lookupMock = vi.hoisted(() => vi.fn()); | |
| vi.mock("node:dns/promises", () => ({ | |
| default: { lookup: lookupMock }, | |
| lookup: lookupMock, | |
| })); | |
| import { isBlockedAddress, resolvePublicUrl } from "./publicUrl"; | |
| function resolvesTo(...addresses: string[]) { | |
| lookupMock.mockResolvedValue( | |
| addresses.map((address) => ({ | |
| address, | |
| family: address.includes(":") ? 6 : 4, | |
| })), | |
| ); | |
| } | |
| describe("isBlockedAddress", () => { | |
| it.each([ | |
| "0.0.0.0", | |
| "10.1.2.3", | |
| "100.64.0.1", | |
| "127.0.0.1", | |
| "169.254.169.254", | |
| "172.16.0.1", | |
| "172.31.255.255", | |
| "192.168.1.1", | |
| "198.18.0.1", | |
| "224.0.0.1", | |
| "255.255.255.255", | |
| "::", | |
| "::1", | |
| "fc00::1", | |
| "fd12:3456::1", | |
| "fe80::1", | |
| "ff02::1", | |
| "::ffff:127.0.0.1", | |
| "::127.0.0.1", | |
| "2002:7f00:1::", | |
| "64:ff9b::7f00:1", | |
| ])("blocks %s", (address) => { | |
| expect(isBlockedAddress(address)).toBe(true); | |
| }); | |
| it.each([ | |
| "8.8.8.8", | |
| "1.1.1.1", | |
| "172.32.0.1", | |
| "192.169.0.1", | |
| "99.64.0.1", | |
| "2606:4700:4700::1111", | |
| "::ffff:8.8.8.8", | |
| ])("allows %s", (address) => { | |
| expect(isBlockedAddress(address)).toBe(false); | |
| }); | |
| it("blocks anything it cannot parse as an address", () => { | |
| expect(isBlockedAddress("not-an-address")).toBe(true); | |
| expect(isBlockedAddress("999.1.1.1")).toBe(true); | |
| expect(isBlockedAddress("")).toBe(true); | |
| }); | |
| }); | |
| describe("resolvePublicUrl", () => { | |
| beforeEach(() => { | |
| lookupMock.mockReset(); | |
| resolvesTo("93.184.216.34"); | |
| }); | |
| it("returns the parsed URL for a host that resolves publicly", async () => { | |
| const url = await resolvePublicUrl("https://example.com/article?a=1"); | |
| expect(url.hostname).toBe("example.com"); | |
| expect(lookupMock).toHaveBeenCalledWith("example.com", { all: true }); | |
| }); | |
| it("rejects schemes other than HTTP and HTTPS", async () => { | |
| await expect(resolvePublicUrl("file:///etc/passwd")).rejects.toThrow( | |
| "Unsupported URL scheme", | |
| ); | |
| await expect(resolvePublicUrl("ftp://example.com")).rejects.toThrow( | |
| "Unsupported URL scheme", | |
| ); | |
| }); | |
| it("rejects a malformed URL", async () => { | |
| await expect(resolvePublicUrl("not a url")).rejects.toThrow( | |
| "Malformed URL", | |
| ); | |
| }); | |
| it("rejects a literal private address without asking DNS", async () => { | |
| await expect( | |
| resolvePublicUrl("http://127.0.0.1:8888/search"), | |
| ).rejects.toThrow("non-public address"); | |
| expect(lookupMock).not.toHaveBeenCalled(); | |
| }); | |
| it("rejects a bracketed IPv6 loopback literal", async () => { | |
| await expect(resolvePublicUrl("http://[::1]/")).rejects.toThrow( | |
| "non-public address", | |
| ); | |
| }); | |
| it("rejects a name that resolves into a blocked range", async () => { | |
| resolvesTo("169.254.169.254"); | |
| await expect(resolvePublicUrl("http://metadata.internal/")).rejects.toThrow( | |
| "169.254.169.254", | |
| ); | |
| }); | |
| it("rejects when only one of several answers is private", async () => { | |
| resolvesTo("93.184.216.34", "10.0.0.5"); | |
| await expect( | |
| resolvePublicUrl("https://split-horizon.test/"), | |
| ).rejects.toThrow("10.0.0.5"); | |
| }); | |
| it("rejects a host with no DNS answer", async () => { | |
| lookupMock.mockResolvedValue([]); | |
| await expect(resolvePublicUrl("https://nowhere.test/")).rejects.toThrow( | |
| "Could not resolve host", | |
| ); | |
| }); | |
| }); | |