Function assertNotLocal

src/lib/target-url.ts:31–87

(rawUrl: string)

 * Silently returns on allowed URLs.
 */
export function assertNotLocal(rawUrl: string): void {
  let parsed: URL;
  try {
    parsed = new URL(rawUrl);
  } catch {
    throw localTargetError('target-url', 'must be a valid URL');
  }

  // Scheme check.
  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
    throw localTargetError('target-url', 'must use http or https scheme');
  }

  const host = parsed.hostname.toLowerCase();

  // Loopback / unspecified.
  if (host === 'localhost' || host === '0.0.0.0') {
    throw localTargetError('target-url', 'localhost targets are not allowed', LOCAL_DEV_HINT);
  }
  // IPv6 literals. Node's URL parser wraps IPv6 hosts in brackets and
  // normalizes IPv4-mapped forms to hex (`http://[::ffff:127.0.0.1]` →
  // hostname `[::ffff:7f00:1]`). A dotted-form string check alone would miss
  // the normalized variant, so we strip the brackets and classify the
  // address family explicitly.
  if (host.startsWith('[') && host.endsWith(']')) {
    assertNotLocalIpv6(host.slice(1, -1));
  }

  // 127.0.0.0/8 loopback range.
  if (/^127\.\d+\.\d+\.\d+$/.test(host)) {
    throw localTargetError('target-url', 'loopback addresses are not allowed', LOCAL_DEV_HINT);
  }

  // AWS instance-metadata service (168 and 169 prefixes used for IMDS).
  if (host === '169.254.169.254') {
    throw localTargetError(
      'target-url',
      '169.254.169.254 (AWS metadata service) is not allowed',
      LOCAL_DEV_HINT,
    );
  }

  // 169.254.x.x link-local (IPv4).
  if (/^169\.254\.\d+\.\d+$/.test(host)) {
    throw localTargetError('target-url', 'link-local addresses are not allowed', LOCAL_DEV_HINT);
  }

  // RFC1918 literal IP addresses only — hostnames that resolve to private
  // IPs are the backend's concern (DNS resolution is expensive CLI-side).
  if (isRfc1918Literal(host)) {
    throw localTargetError(
      'target-url',
      'private/RFC1918 addresses are not allowed',
      LOCAL_DEV_HINT,
    );
  }
}