Function validateUrlWithDNS

apps/sim/lib/core/security/input-validation.server.ts:79–144

(
  url: string | null | undefined,
  paramName = 'url',
  options: { allowHttp?: boolean } = {}
)

 * @returns AsyncValidationResult with resolved IP for DNS pinning
 */
export async function validateUrlWithDNS(
  url: string | null | undefined,
  paramName = 'url',
  options: { allowHttp?: boolean } = {}
): Promise<AsyncValidationResult> {
  const basicValidation = validateExternalUrl(url, paramName, options)
  if (!basicValidation.isValid) {
    return basicValidation
  }

  const parsedUrl = new URL(url!)
  const hostname = parsedUrl.hostname

  const hostnameLower = hostname.toLowerCase()
  const cleanHostname =
    hostnameLower.startsWith('[') && hostnameLower.endsWith(']')
      ? hostnameLower.slice(1, -1)
      : hostnameLower

  let isLocalhost = cleanHostname === 'localhost'
  if (ipaddr.isValid(cleanHostname)) {
    const processedIP = ipaddr.process(cleanHostname).toString()
    if (processedIP === '127.0.0.1' || processedIP === '::1') {
      isLocalhost = true
    }
  }

  try {
    const { address } = await dns.lookup(cleanHostname, { verbatim: true })

    const resolvedIsLoopback =
      ipaddr.isValid(address) &&
      (() => {
        const ip = ipaddr.process(address).toString()
        return ip === '127.0.0.1' || ip === '::1'
      })()

    if (isPrivateOrReservedIP(address) && !(isLocalhost && resolvedIsLoopback && !isHosted)) {
      logger.warn('URL resolves to blocked IP address', {
        paramName,
        hostname,
        resolvedIP: address,
      })
      return {
        isValid: false,
        error: `${paramName} resolves to a blocked IP address`,
      }
    }

    return {
      isValid: true,
      resolvedIP: address,
      originalHostname: hostname,
    }
  } catch (error) {
    logger.warn('DNS lookup failed for URL', {
      paramName,
      hostname,