awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 21:27:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: use hostname for blocking internal IPs

Browse Source
This commit is contained in:
Scott Wilson
2025-04-29 12:26:29 -07:00
parent 9138a9e71d
commit b65f62fda8
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/validator/validate-url.ts
+4 -4
View File
@@ -15,13 +15,13 @@ export const blockLocalAndPrivateIpAddresses = async (url: string) => {
const validUrl = new URL(url); const validUrl = new URL(url);
const inputHostIps: string[] = []; const inputHostIps: string[] = [];
if (isIPv4(validUrl.host)) { if (isIPv4(validUrl.hostname)) {
inputHostIps.push(validUrl.host); inputHostIps.push(validUrl.hostname);
} else { } else {
if (validUrl.host === "localhost" || validUrl.host === "host.docker.internal") { if (validUrl.hostname === "localhost" || validUrl.hostname === "host.docker.internal") {
throw new BadRequestError({ message: "Local IPs not allowed as URL" }); throw new BadRequestError({ message: "Local IPs not allowed as URL" });
} }
const resolvedIps = await dns.resolve4(validUrl.host); const resolvedIps = await dns.resolve4(validUrl.hostname);
inputHostIps.push(...resolvedIps); inputHostIps.push(...resolvedIps);
} }
const isInternalIp = inputHostIps.some((el) => isPrivateIp(el)); const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));