added functionality to stop request even if socket is closed to preve…

…nt url redirection attack
azu · Mar 29, 2022 · dd1f4fe · dd1f4fe
1 parent 37513d7
commit dd1f4fe
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/src/request-filtering-agent.ts b/src/request-filtering-agent.ts
@@ -25,6 +25,8 @@ export interface RequestFilteringAgentOptions {
     // Deny address list
     // Default: []
     denyIPAddressList?: string[];
+
+    stopUrlRedirectionAttack?: boolean;
 }
 
 /**
@@ -108,7 +110,9 @@ export function applyRequestFilter<T extends http.Agent | https.Agent>(
             options && options.allowPrivateIPAddress !== undefined ? options.allowPrivateIPAddress : false,
         allowMetaIPAddress: options && options.allowMetaIPAddress !== undefined ? options.allowMetaIPAddress : false,
         allowIPAddressList: options && options.allowIPAddressList ? options.allowIPAddressList : [],
-        denyIPAddressList: options && options.denyIPAddressList ? options.denyIPAddressList : []
+        denyIPAddressList: options && options.denyIPAddressList ? options.denyIPAddressList : [],
+        stopUrlRedirectionAttack:
+            options && options.stopUrlRedirectionAttack !== undefined ? options.stopUrlRedirectionAttack : false
     };
     // override http.Agent#createConnection
     // https://nodejs.org/api/http.html#http_agent_createconnection_options_callback
@@ -117,6 +121,23 @@ export function applyRequestFilter<T extends http.Agent | https.Agent>(
     const createConnection = agent.createConnection;
     // @ts-expect-error - @types/node does not defined createConnection
     agent.createConnection = (options: TcpNetConnectOpts, connectionListener?: (error?: Error) => void) => {
+        if (requestFilterOptions.stopUrlRedirectionAttack) {
+            // Prevents malicious user from identifying which ports are open
+            const { host, family } = options;
+            if (host) {
+                if (net.isIP(host)) {
+                    const addr = ipaddr.parse(host);
+                    const range = addr.range();
+
+                    if (range !== "unicast") {
+                        throw new Error(
+                            `DNS lookup ${host}(family:${family}, host:${host}) is not allowed. Because, It is private IP address.`
+                        );
+                    }
+                }
+            }
+        }
+
         const socket = createConnection.call(agent, options, () => {
             // https://nodejs.org/api/net.html#net_socket_connect_options_connectlistener
             const { host } = options;

diff --git a/test/request-filtering-agent.test.ts b/test/request-filtering-agent.test.ts
@@ -143,6 +143,7 @@ describe("request-filtering-agent", function () {
                 if (error instanceof ReferenceError) {
                     assert.fail(error);
                 }
+                assert.match(error.message, /failed, reason: DNS lookup/);
                 assert.strictEqual(error.type, "system", `Failed at ${ipAddress}, error: ${error}`);
             }
         }