Function validateOutboundUrl

server/modules/outboundTargetPolicy.js:273–355

(targetUrl, context = {})

}

async function validateOutboundUrl(targetUrl, context = {}) {
  let parsedUrl;
  try {
    parsedUrl = new URL(targetUrl);
  } catch (error) {
    throw createPolicyError(
      "invalid_url",
      "Invalid outbound URL provided.",
      targetUrl,
      context
    );
  }

  const protocol = (parsedUrl.protocol || "").toLowerCase();
  if (protocol !== "http:" && protocol !== "https:") {
    throw createPolicyError(
      "invalid_scheme",
      "Only http and https outbound URLs are allowed.",
      targetUrl,
      context
    );
  }

  const normalizedHostname = normalizeHostname(parsedUrl.hostname);
  if (!normalizedHostname) {
    throw createPolicyError(
      "invalid_url",
      "Outbound URL must include a hostname.",
      targetUrl,
      context
    );
  }

  if (isMetadataHostname(normalizedHostname)) {
    throw createPolicyError(
      "metadata_endpoint",
      "Requests to cloud metadata endpoints are blocked.",
      targetUrl,
      context,
      { hostname: normalizedHostname }
    );
  }

  const allowPrivateHost = resolveAllowPrivateHost(context);
  const resolvedAddresses = await resolveTargetAddresses(normalizedHostname);

  let privateAddressMatched = false;
  for (const resolvedAddress of resolvedAddresses) {
    if (isMetadataAddress(resolvedAddress.address)) {
      throw createPolicyError(
        "metadata_endpoint",
        "Requests to cloud metadata endpoints are blocked.",
        targetUrl,
        context,
        { hostname: normalizedHostname, address: resolvedAddress.address }
      );
    }