Function resolveRedirectDomain

server/src/db/domain-resolution-db.ts:240–297

* Follow HTTP redirects to find the canonical domain. * Tries HEAD first (lightweight), falls back to GET if the server rejects HEAD. * Returns the resolved domain, or null on failure. * * SSRF protection: only follows HTTPS, rejects private IPs and non-hostname targets.

(domain: string)

 * SSRF protection: only follows HTTPS, rejects private IPs and non-hostname targets.
 */
async function resolveRedirectDomain(domain: string): Promise<string | null> {
  // Block requests to private/reserved ranges
  if (PRIVATE_IP_RE.test(domain)) return null;

  // Only resolve domains that look like valid hostnames (no IPs, no ports)
  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(domain)) return null;

  for (const method of ['HEAD', 'GET'] as const) {
    try {
      const controller = new AbortController();
      const timeout = setTimeout(() => controller.abort(), 5000);

      const response = await fetch(`https://${domain}`, {
        method,
        redirect: 'manual',
        signal: controller.signal,
      });

      clearTimeout(timeout);

      // HEAD rejected — try GET
      if (method === 'HEAD' && response.status === 405) continue;

      // Only inspect 3xx redirects — read the Location header without following
      const status = response.status;
      if (status < 300 || status >= 400) return null;

      const location = response.headers.get('location');
      if (!location) return null;

      let parsed: URL;
      try {
        parsed = new URL(location, `https://${domain}`);
      } catch {
        return null;
      }

      // Only accept HTTPS redirects to valid hostnames
      if (parsed.protocol !== 'https:') return null;
      if (PRIVATE_IP_RE.test(parsed.hostname)) return null;
      // Validate hostname format (no IPs, no ports in hostname)
      if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(parsed.hostname)) return null;

      const finalDomain = parsed.hostname.replace(/^www\./, '').toLowerCase();
      if (finalDomain !== domain) {
        logger.debug({ from: domain, to: finalDomain }, 'Domain redirect detected');
        return finalDomain;
      }

      return null;
    } catch {
      if (method === 'HEAD') continue; // try GET
      return null; // both failed
    }
  }

  return null;
}