Function assertPublicTarget

server/src/training-agent/webhook-fetch.ts:80–112

(url: URL)

}

async function assertPublicTarget(url: URL): Promise<void> {
  if (url.protocol !== 'https:' && url.protocol !== 'http:') {
    throw new SsrfRefusedError(url.toString(), `scheme ${url.protocol} not allowed`);
  }
  // `url.hostname` strips brackets from `[::1]` → `::1`. Userinfo (user:pass@)
  // never leaks into hostname per WHATWG, so we don't need to scrub that.
  const hostname = url.hostname;
  if (!hostname || hostname === 'localhost' || hostname.endsWith('.localhost')) {
    throw new SsrfRefusedError(url.toString(), 'hostname resolves to loopback');
  }
  const version = isIP(hostname);
  if (version !== 0) {
    if (isPrivateIpAddress(hostname)) {
      throw new SsrfRefusedError(url.toString(), 'literal private/loopback address');
    }
    return;
  }
  if (isNumericHostname(hostname)) {
    throw new SsrfRefusedError(url.toString(), 'numeric-encoded hostname not allowed');
  }
  try {
    const records = await lookup(hostname, { all: true, verbatim: true });
    if (records.length === 0) {
      throw new SsrfRefusedError(url.toString(), 'hostname did not resolve');
    }
    if (records.some(r => isPrivateIpAddress(r.address))) {
      throw new SsrfRefusedError(url.toString(), 'hostname resolves to private address');
    }
  } catch (err) {
    if (err instanceof SsrfRefusedError) throw err;
    throw new SsrfRefusedError(url.toString(), `DNS lookup failed: ${err instanceof Error ? err.message : String(err)}`);
  }
}

/** Build a `fetch`-shaped function gated by the SSRF guard.
 *