From d28c87ee6732e2e3cf4c9daa10a817848afeec53 Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Mon, 5 May 2025 11:56:49 -0700 Subject: [PATCH 1/3] fix: use dns lookup as fallback for dns resolve --- .../dynamic-secret/dynamic-secret-fns.ts | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts index 05d492240..ed4ebc45f 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts @@ -24,8 +24,13 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = if (net.isIPv4(el)) { exclusiveIps.push(el); } else { - const resolvedIps = await dns.resolve4(el); - exclusiveIps.push(...resolvedIps); + try { + const resolvedIps = await dns.resolve4(el); + exclusiveIps.push(...resolvedIps); + } catch { + const resolvedIps = (await dns.lookup(el, { all: true })).map(({ address }) => address); + exclusiveIps.push(...resolvedIps); + } } } } @@ -38,8 +43,13 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = if (normalizedHost === "localhost" || normalizedHost === "host.docker.internal") { throw new BadRequestError({ message: "Invalid db host" }); } - const resolvedIps = await dns.resolve4(host); - inputHostIps.push(...resolvedIps); + try { + const resolvedIps = await dns.resolve4(host); + inputHostIps.push(...resolvedIps); + } catch { + const resolvedIps = (await dns.lookup(host, { all: true })).map(({ address }) => address); + inputHostIps.push(...resolvedIps); + } } if (!isGateway && !(appCfg.DYNAMIC_SECRET_ALLOW_INTERNAL_IP || appCfg.ALLOW_INTERNAL_IP_CONNECTIONS)) { From 7851bb8710d157bf8ddd88026011667032c13aae Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Mon, 5 May 2025 12:23:18 -0700 Subject: [PATCH 2/3] improvement: address feedback --- .../dynamic-secret/dynamic-secret-fns.ts | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts index ed4ebc45f..3a4fecc3c 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts @@ -9,7 +9,7 @@ import { getDbConnectionHost } from "@app/lib/knex"; export const verifyHostInputValidity = async (host: string, isGateway = false) => { const appCfg = getConfig(); - if (appCfg.isDevelopmentMode) return [host]; + // if (appCfg.isDevelopmentMode) return [host]; const reservedHosts = [appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI)].concat( (appCfg.DB_READ_REPLICAS || []).map((el) => getDbConnectionHost(el.DB_CONNECTION_URI)), @@ -27,8 +27,11 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = try { const resolvedIps = await dns.resolve4(el); exclusiveIps.push(...resolvedIps); - } catch { - const resolvedIps = (await dns.lookup(el, { all: true })).map(({ address }) => address); + } catch (error) { + // only try lookup if not found + if ((error as { code: string })?.code !== "ENOTFOUND") throw error; + + const resolvedIps = (await dns.lookup(el, { all: true, family: 4 })).map(({ address }) => address); exclusiveIps.push(...resolvedIps); } } @@ -46,8 +49,11 @@ export const verifyHostInputValidity = async (host: string, isGateway = false) = try { const resolvedIps = await dns.resolve4(host); inputHostIps.push(...resolvedIps); - } catch { - const resolvedIps = (await dns.lookup(host, { all: true })).map(({ address }) => address); + } catch (error) { + // only try lookup if not found + if ((error as { code: string })?.code !== "ENOTFOUND") throw error; + + const resolvedIps = (await dns.lookup(host, { all: true, family: 4 })).map(({ address }) => address); inputHostIps.push(...resolvedIps); } } From 210f1dc2a2d4ff3092833076aa8e8f427d50cbcd Mon Sep 17 00:00:00 2001 From: Scott Wilson Date: Mon, 5 May 2025 12:24:12 -0700 Subject: [PATCH 3/3] fix: revert dev comment out --- backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts index 3a4fecc3c..f653d0c0c 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-fns.ts @@ -9,7 +9,7 @@ import { getDbConnectionHost } from "@app/lib/knex"; export const verifyHostInputValidity = async (host: string, isGateway = false) => { const appCfg = getConfig(); - // if (appCfg.isDevelopmentMode) return [host]; + if (appCfg.isDevelopmentMode) return [host]; const reservedHosts = [appCfg.DB_HOST || getDbConnectionHost(appCfg.DB_CONNECTION_URI)].concat( (appCfg.DB_READ_REPLICAS || []).map((el) => getDbConnectionHost(el.DB_CONNECTION_URI)),