Pedro CastroandGitHub
d9aef5b6a6
* fix(auth): add URL validation for organization logo fields - Add URL validation utility for server-side fetched URLs - Validate logo URLs in tRPC organization schema - Validate logo URLs in API v2 team DTOs - Add graceful fallback in logo route for invalid URLs - Only allow HTTPS and image data URLs - Add unit tests for URL validation * fix: add missing IP range and type validation - Add RFC 6598 CGNAT range (100.64.0.0/10) to blocked IPs - Add @IsString() decorator before custom URL validators - Add boundary tests for new IP range * fix: address review feedback - Export validateUrlForSSRFSync via @calcom/platform-libraries - Fix nullable/optional order in Zod schema * fix: block localhost hostname and explicit null check - Add localhost to BLOCKED_HOSTNAMES for sync validation - Use explicit null check (url == null) instead of falsy check * fix: allow empty string in URL validation * refactor: extract shared validation logic - Extract validateUrlCore() to eliminate duplication between sync/async versions - Add JSDoc to all exported functions for better discoverability - Remove redundant comments that repeated function names - Simplify existing comments to be more concise * fix: reject empty strings in URL validator Previously if (!url) allowed empty strings to bypass validation. Now explicitly checks for null/undefined only
104 lines
3.3 KiB
TypeScript
104 lines
3.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import {
|
|
isBlockedHostname,
|
|
isPrivateIP,
|
|
isTrustedInternalUrl,
|
|
validateUrlForSSRFSync,
|
|
} from "./ssrfProtection";
|
|
|
|
describe("isPrivateIP", () => {
|
|
it.each([
|
|
"127.0.0.1",
|
|
"10.0.0.1",
|
|
"172.16.0.1",
|
|
"172.31.255.255",
|
|
"192.168.0.1",
|
|
"169.254.169.254", // AWS metadata
|
|
"0.0.0.0",
|
|
"100.64.0.1", // RFC 6598 CGNAT start
|
|
"100.127.255.254", // RFC 6598 CGNAT end
|
|
])("blocks private IPv4 %s", (ip) => {
|
|
expect(isPrivateIP(ip)).toBe(true);
|
|
});
|
|
|
|
it.each([
|
|
"172.15.255.255", // just outside 172.16.0.0/12
|
|
"172.32.0.0", // just outside 172.16.0.0/12
|
|
"8.8.8.8",
|
|
"203.0.113.1",
|
|
"100.63.255.255", // just below RFC 6598
|
|
"100.128.0.0", // just above RFC 6598
|
|
])("allows public IPv4 %s", (ip) => {
|
|
expect(isPrivateIP(ip)).toBe(false);
|
|
});
|
|
|
|
it.each(["::1", "::", "fc00::1", "fd00::1", "fe80::1"])("blocks private IPv6 %s", (ip) => {
|
|
expect(isPrivateIP(ip)).toBe(true);
|
|
});
|
|
|
|
it("allows public IPv6 addresses", () => {
|
|
expect(isPrivateIP("2001:4860:4860::8888")).toBe(false); // Google DNS
|
|
});
|
|
|
|
it("blocks IPv4-mapped IPv6 addresses", () => {
|
|
expect(isPrivateIP("::ffff:127.0.0.1")).toBe(true);
|
|
expect(isPrivateIP("::ffff:10.0.0.1")).toBe(true);
|
|
expect(isPrivateIP("::ffff:169.254.169.254")).toBe(true);
|
|
expect(isPrivateIP("::ffff:8.8.8.8")).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("isBlockedHostname", () => {
|
|
it.each([
|
|
"localhost", // loopback hostname
|
|
"169.254.169.254", // AWS/Azure/DigitalOcean
|
|
"metadata.google.internal", // GCP
|
|
"169.254.169.254.", // trailing dot normalization
|
|
"METADATA.GOOGLE.INTERNAL", // case insensitive
|
|
])("blocks cloud metadata endpoint %s", (hostname) => {
|
|
expect(isBlockedHostname(hostname)).toBe(true);
|
|
});
|
|
|
|
it("allows regular hostnames", () => {
|
|
expect(isBlockedHostname("example.com")).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("validateUrlForSSRFSync", () => {
|
|
it("allows HTTPS URLs", () => {
|
|
expect(validateUrlForSSRFSync("https://example.com/logo.png").isValid).toBe(true);
|
|
});
|
|
|
|
it("allows image data URLs", () => {
|
|
expect(validateUrlForSSRFSync("data:image/png;base64,iVBORw0KGgo=").isValid).toBe(true);
|
|
});
|
|
|
|
it.each([
|
|
["http://example.com/logo.png", "Only HTTPS URLs are allowed"],
|
|
["ftp://example.com/file", "Only HTTPS URLs are allowed"],
|
|
["data:text/html,<script>alert(1)</script>", "Non-image data URL"],
|
|
["https://127.0.0.1/logo.png", "Private IP address"],
|
|
["https://169.254.169.254/latest/meta-data/", "Blocked hostname"],
|
|
["https://localhost/logo.png", "Blocked hostname"],
|
|
["not-a-url", "Invalid URL format"],
|
|
])("blocks %s", (url, expectedError) => {
|
|
const result = validateUrlForSSRFSync(url);
|
|
expect(result).toEqual({ isValid: false, error: expectedError });
|
|
});
|
|
});
|
|
|
|
describe("isTrustedInternalUrl", () => {
|
|
const webappUrl = "https://app.cal.com";
|
|
|
|
it("returns true for same origin", () => {
|
|
expect(isTrustedInternalUrl("https://app.cal.com/logo.png", webappUrl)).toBe(true);
|
|
});
|
|
|
|
it("returns false for different origins and invalid URLs", () => {
|
|
expect(isTrustedInternalUrl("https://evil.com/logo.png", webappUrl)).toBe(false);
|
|
expect(isTrustedInternalUrl("https://app.cal.com.evil.com/x", webappUrl)).toBe(false);
|
|
expect(isTrustedInternalUrl("not-a-url", webappUrl)).toBe(false);
|
|
});
|
|
});
|