Function validateHostResolution

server/src/utils/url-security.ts:39–67

(hostname: string)

 * Checks all A and AAAA records to prevent multi-record bypass attacks.
 */
export async function validateHostResolution(hostname: string): Promise<void> {
  if (isPrivateHostname(hostname)) {
    throw new Error('URLs pointing to private or internal networks are not allowed');
  }

  // If already an IP literal, the string check above is sufficient
  if (isIP(hostname)) return;

  // Resolve all DNS records and check every address
  const [ipv4Result, ipv6Result] = await Promise.allSettled([
    dns.resolve4(hostname),
    dns.resolve6(hostname),
  ]);

  const allAddresses = [
    ...(ipv4Result.status === 'fulfilled' ? ipv4Result.value : []),
    ...(ipv6Result.status === 'fulfilled' ? ipv6Result.value : []),
  ];

  if (allAddresses.length === 0) {
    throw new Error('Could not resolve hostname');
  }

  for (const address of allAddresses) {
    if (isPrivateHostname(address)) {
      throw new Error('URL resolved to a private or internal IP address');
    }
  }
}

/**
 * Validate a URL for safe server-side fetching.