Method validateFetchTarget

server/src/validator.ts:607–635

(url: URL)

  }

  private async validateFetchTarget(url: URL): Promise<string | null> {
    if (url.protocol !== "https:") {
      return "URL must use HTTPS";
    }

    if (url.username || url.password || (url.port !== "" && url.port !== "443")) {
      return "URL must not include credentials or non-default ports";
    }

    const hostname = this.normalizeDomain(url.hostname);
    if (!hostname || hostname === "localhost" || hostname.endsWith(".localhost")) {
      return "URL must resolve to a public internet host";
    }

    if (this.isPrivateIpAddress(hostname)) {
      return "URL must resolve to a public internet host";
    }

    try {
      const records = await dns.lookup(hostname, { all: true, verbatim: true });
      if (records.length === 0 || records.some((record) => this.isPrivateIpAddress(record.address))) {
        return "URL must resolve to a public internet host";
      }
    } catch {
      return "URL hostname could not be resolved";
    }

    return null;
  }

  private isPrivateIpAddress(address: string): boolean {
    const ipVersion = net.isIP(address);