Function validateDownloadSourceUrl

src/platforms/install-source.ts:189–212

(parsedUrl: URL)

}

export async function validateDownloadSourceUrl(parsedUrl: URL): Promise<void> {
  if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
    throw new AppError('INVALID_ARGS', `Unsupported source URL protocol: ${parsedUrl.protocol}`);
  }
  const hostname = parsedUrl.hostname.toLowerCase();
  if (isBlockedSourceHostname(hostname)) {
    throw new AppError('INVALID_ARGS', `Source URL host is not allowed: ${parsedUrl.hostname}`, {
      hint: 'Use a public artifact URL.',
    });
  }

  const resolved = await dns
    .lookup(parsedUrl.hostname, { all: true, verbatim: true })
    .catch(() => []);
  if (resolved.some((entry) => isBlockedIpAddress(entry.address))) {
    throw new AppError(
      'INVALID_ARGS',
      `Source URL host resolved to a private or loopback address: ${parsedUrl.hostname}`,
      {
        hint: 'Use a public artifact URL.',
      },
    );
  }
}

export function isTrustedInstallSourceUrl(sourceUrl: string | URL): boolean {
  const parsed = sourceUrl instanceof URL ? sourceUrl : new URL(sourceUrl);