From 3f00359459750d22e1c6ad271cb339ec8c9cbed3 Mon Sep 17 00:00:00 2001
From: x <x032205@gmail.com>
Date: Thu, 24 Apr 2025 23:53:20 -0400
Subject: [PATCH] implemented blockLocalAndPrivateIpAddresses

---
 .../hc-vault/hc-vault-connection-fns.ts             | 13 +++++++++++--
 .../secret-sync/hc-vault/hc-vault-sync-fns.ts       |  8 ++++----
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
index a7fa21996..a6bea104a 100644
--- a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
+++ b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts
@@ -3,6 +3,7 @@ import { AxiosError } from "axios";
 import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 
 import { HCVaultConnectionMethod } from "./hc-vault-connection-enums";
@@ -13,6 +14,14 @@ import {
   TValidateHCVaultConnectionCredentials
 } from "./hc-vault-connection-types";
 
+export const getHCVaultInstanceUrl = async (config: THCVaultConnectionConfig) => {
+  const instanceUrl = removeTrailingSlash(config.credentials.instanceUrl);
+
+  await blockLocalAndPrivateIpAddresses(instanceUrl);
+
+  return instanceUrl;
+};
+
 export const getHCVaultConnectionListItem = () => ({
   name: "HCVault" as const,
   app: AppConnection.HCVault as const,
@@ -58,7 +67,7 @@ export const getHCVaultAccessToken = async (connection: TValidateHCVaultConnecti
 };
 
 export const validateHCVaultConnectionCredentials = async (config: THCVaultConnectionConfig) => {
-  const instanceUrl = removeTrailingSlash(config.credentials.instanceUrl);
+  const instanceUrl = await getHCVaultInstanceUrl(config);
 
   try {
     const accessToken = await getHCVaultAccessToken(config);
@@ -82,7 +91,7 @@ export const validateHCVaultConnectionCredentials = async (config: THCVaultConne
 };
 
 export const listHCVaultMounts = async (appConnection: THCVaultConnection) => {
-  const instanceUrl = removeTrailingSlash(appConnection.credentials.instanceUrl);
+  const instanceUrl = await getHCVaultInstanceUrl(appConnection);
   const accessToken = await getHCVaultAccessToken(appConnection);
 
   const { data } = await request.get<THCVaultMountResponse>(`${instanceUrl}/v1/sys/mounts`, {
diff --git a/backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts b/backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts
index 649ab3812..6764d0afd 100644
--- a/backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts
+++ b/backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts
@@ -1,6 +1,6 @@
 import { request } from "@app/lib/config/request";
 import { removeTrailingSlash } from "@app/lib/fn";
-import { getHCVaultAccessToken } from "@app/services/app-connection/hc-vault";
+import { getHCVaultAccessToken, getHCVaultInstanceUrl } from "@app/services/app-connection/hc-vault";
 import {
   THCVaultListVariables,
   THCVaultListVariablesResponse,
@@ -47,7 +47,7 @@ export const HCVaultSyncFns = {
     } = secretSync;
 
     const accessToken = await getHCVaultAccessToken(connection);
-    const { instanceUrl } = connection.credentials;
+    const instanceUrl = await getHCVaultInstanceUrl(connection);
 
     const variables = await listHCVaultVariables({ instanceUrl, accessToken, mount, path });
     let tainted = false;
@@ -87,7 +87,7 @@ export const HCVaultSyncFns = {
     } = secretSync;
 
     const accessToken = await getHCVaultAccessToken(connection);
-    const { instanceUrl } = connection.credentials;
+    const instanceUrl = await getHCVaultInstanceUrl(connection);
 
     const variables = await listHCVaultVariables({ instanceUrl, accessToken, mount, path });
 
@@ -112,7 +112,7 @@ export const HCVaultSyncFns = {
     } = secretSync;
 
     const accessToken = await getHCVaultAccessToken(connection);
-    const { instanceUrl } = connection.credentials;
+    const instanceUrl = await getHCVaultInstanceUrl(connection);
 
     const variables = await listHCVaultVariables({
       instanceUrl,