Function hostVariants

src/compiled/providers/ssrf_guard.js:35–53

(host)

// like `[::ffff:169.254.169.254]` slips a dotted-quad regex but resolves
// directly to 169.254.169.254 at connect time.
function hostVariants(host) {
    const out = new Set();
    const lower = host.toLowerCase();
    out.add(lower);
    let h = lower;
    if (h.startsWith("[") && h.endsWith("]")) {
        h = h.slice(1, -1);
        out.add(h);
    }
    const dotted = h.match(/^(?:::ffff:|::)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
    if (dotted)
        out.add(dotted[1]);
    const hex = h.match(/^(?:::ffff:|::)([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
    if (hex) {
        const a = parseInt(hex[1], 16), b = parseInt(hex[2], 16);
        out.add(`${(a >> 8) & 0xff}.${a & 0xff}.${(b >> 8) & 0xff}.${b & 0xff}`);
    }
    return [...out];
}
function isLoopbackOne(h) {
    if (h === "localhost" || h === "::1" || h === "::")
        return true;