4d96605144
Close open uploads, image-proxy SSRF, fail-open AI quotas in production, auth gaps on app routes, and MCP tenant isolation issues. Co-authored-by: Cursor <cursoragent@cursor.com>
23 lines
903 B
TypeScript
23 lines
903 B
TypeScript
/** Block hosts that must not be fetched by server-side proxies. */
|
|
export function isBlockedFetchHost(hostname: string): boolean {
|
|
const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
|
|
|
|
if (!host || host === 'localhost' || host.endsWith('.localhost')) return true
|
|
if (host === '0.0.0.0' || host === '::' || host === '::1') return true
|
|
if (host.endsWith('.local') || host.endsWith('.internal')) return true
|
|
|
|
const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host)
|
|
if (ipv4) {
|
|
const octets = ipv4.slice(1, 5).map(Number)
|
|
if (octets.some((n) => n > 255)) return true
|
|
const [a, b] = octets
|
|
if (a === 10 || a === 127 || a === 0) return true
|
|
if (a === 169 && b === 254) return true
|
|
if (a === 172 && b >= 16 && b <= 31) return true
|
|
if (a === 192 && b === 168) return true
|
|
if (a === 100 && b >= 64 && b <= 127) return true
|
|
}
|
|
|
|
return false
|
|
}
|