feat(security): add SSRF URL validation and private IP protection#546
Open
Namraa310806 wants to merge 1 commit into
Open
feat(security): add SSRF URL validation and private IP protection#546Namraa310806 wants to merge 1 commit into
Namraa310806 wants to merge 1 commit into
Conversation
|
@Namraa310806 is attempting to deploy a commit to the firefistisdead's projects Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
📝 WalkthroughWalkthroughAdds ChangesSSRF Defense-in-Depth
Test User Data Update
Sequence Diagram(s)sequenceDiagram
participant Client
participant processFromUrl as /process-from-url
participant validateURLForSSRF
participant dns as dns.promises
participant axios
Client->>processFromUrl: POST {url}
processFromUrl->>validateURLForSSRF: url string
validateURLForSSRF->>validateURLForSSRF: parse, enforce https:, check allowlist
validateURLForSSRF->>dns: resolve4(hostname) + resolve6(hostname)
dns-->>validateURLForSSRF: IP addresses
validateURLForSSRF->>validateURLForSSRF: reject private IPs
validateURLForSSRF-->>processFromUrl: {url, hostname, ips} or SSRFValidationError
processFromUrl->>axios: GET url (maxRedirects:0)
alt 3xx redirect
axios-->>processFromUrl: 3xx + Location header
processFromUrl->>validateURLForSSRF: Location URL (via validateRedirectForSSRF)
validateURLForSSRF-->>processFromUrl: allowed or 403
processFromUrl->>axios: GET redirect URL
axios-->>processFromUrl: PDF buffer
else no Location header
processFromUrl-->>Client: 502
else direct 2xx
axios-->>processFromUrl: PDF buffer
processFromUrl-->>Client: pipeline result
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
backend
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
server.js (1)
28-28: 💤 Low valueRemove unused import
createSSRFSafeAxiosConfig.
createSSRFSafeAxiosConfigis imported but never used. The axios calls at lines 1325 and 1340 manually setmaxRedirects: 0instead of using this helper.Either use the helper for consistency or remove the unused import.
♻️ Suggested fix
-const { validateURLForSSRF, validateRedirectForSSRF, createSSRFSafeAxiosConfig } = require("./src/utils/ssrfValidation"); +const { validateURLForSSRF, validateRedirectForSSRF } = require("./src/utils/ssrfValidation");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@server.js` at line 28, Remove the unused `createSSRFSafeAxiosConfig` function from the destructuring import in the require statement at the top of server.js (where validateURLForSSRF and validateRedirectForSSRF are imported). This function is not used anywhere in the file, and the axios calls that manually set maxRedirects: 0 should either be refactored to use this helper for consistency or left as-is with the import removed.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server.js`:
- Around line 1325-1356: The redirect handling code in the conditional check for
status codes 300-399 is unreachable because axios's default validateStatus
configuration rejects any status outside 200-299 and throws an error before
returning. To fix this, add a validateStatus option to the first axios.get call
(the one making the initial download request with downloadUrl.toString()) that
accepts 3xx responses, either by setting validateStatus: (status) => status <
400, or by using the already-imported createSSRFSafeAxiosConfig helper function
which includes this configuration. This will allow the dlResponse to return with
3xx status codes so the redirect validation logic can actually execute.
In `@src/utils/ssrfValidation.js`:
- Around line 10-16: The PRIVATE_IPV4_RANGES array in the SSRF validation is
missing four critical IPv4 ranges needed for comprehensive protection: 0.0.0.0/8
(this network), 100.64.0.0/10 (Carrier-grade NAT), 224.0.0.0/4 (Multicast), and
240.0.0.0/4 (Reserved). Add these four ranges to the PRIVATE_IPV4_RANGES array
with their corresponding start addresses and prefix values, ensuring the
0.0.0.0/8 range is included as it is particularly important for preventing
bypass attacks on certain operating systems.
---
Nitpick comments:
In `@server.js`:
- Line 28: Remove the unused `createSSRFSafeAxiosConfig` function from the
destructuring import in the require statement at the top of server.js (where
validateURLForSSRF and validateRedirectForSSRF are imported). This function is
not used anywhere in the file, and the axios calls that manually set
maxRedirects: 0 should either be refactored to use this helper for consistency
or left as-is with the import removed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bd76ab22-da02-4a36-85bc-9dc340624beb
📒 Files selected for processing (4)
server.jsserver.test.jssrc/data/users.jsonsrc/utils/ssrfValidation.js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces SSRF protection utilities for validating externally supplied URLs before processing.
The implementation adds multiple layers of validation to reduce the risk of Server-Side Request Forgery (SSRF) attacks and strengthen URL handling security.
Changes Made
URL Validation
domainToASCII().Host Allowlist Protection
DNS Validation
Added DNS resolution before request execution.
Added support for both:
Private Network Protection
Added blocking for private/internal address ranges:
IPv4
IPv6
Redirect Safety Utilities
Added reusable helpers for validating redirect destinations before following them.
Error Handling
Introduced a dedicated:
for safe and consistent validation failures.
Security Impact
These changes improve protection against:
Files Added / Modified
src/utils/ssrfValidation.jsTesting
Validated:
Notes
This PR focuses on introducing reusable SSRF validation utilities and supporting infrastructure. Additional route-level integration and validation coverage may be implemented separately where required.
FIxes: #498
Summary by CodeRabbit
Bug Fixes
Tests