Function validateTargetUrl

apps/worker/src/services/preflight.ts:497–582

Check that the target URL is reachable from inside the container.

(targetUrl: string, logger: ActivityLogger)

/** Check that the target URL is reachable from inside the container. */
async function validateTargetUrl(targetUrl: string, logger: ActivityLogger): Promise<Result<void, PentestError>> {
  logger.info('Checking target URL reachability...');

  // 1. Parse URL
  let parsed: URL;
  try {
    parsed = new URL(targetUrl);
  } catch {
    return err(
      new PentestError(
        `Invalid target URL: ${targetUrl}`,
        'config',
        false,
        { targetUrl },
        ErrorCode.TARGET_UNREACHABLE,
      ),
    );
  }

  // 2. Resolve all records once — reused (pinned) for the connection below.
  const hostname = parsed.hostname;
  let addresses: LookupAddress[];
  try {
    addresses = await lookup(hostname, { all: true });
  } catch {
    return err(
      new PentestError(
        `Target URL ${targetUrl} is not reachable. Verify the URL is correct and the site is up.`,
        'network',
        false,
        { targetUrl, hostname },
        ErrorCode.TARGET_UNREACHABLE,
      ),
    );
  }

  // 3. Reject the link-local metadata range (169.254.0.0/16).
  const blocked = addresses.find((entry) => isBlockedAddress(entry.address));
  if (blocked) {
    return err(
      new PentestError(
        `Target URL ${targetUrl} resolves to ${blocked.address}, a link-local address ` +
          `(169.254.0.0/16). This range hosts the cloud instance metadata service and cannot be scanned.`,
        'config',
        false,
        { targetUrl, hostname, address: blocked.address },
        ErrorCode.TARGET_UNREACHABLE,
      ),
    );
  }

  // 4. HTTP reachability check (socket pinned to the resolved addresses).
  try {
    await httpHead(targetUrl, TARGET_URL_TIMEOUT_MS, addresses);

    logger.info('Target URL OK');
    return ok(undefined);
  } catch (error) {