fix: auto-load .env, resolves #2987

packages/utils/src/url-security.node.ts

@@ -0,0 +1,105 @@
+import { isIP } from "node:net";
+
+function normalizeHostname(hostname: string) {
+	return hostname.trim().toLowerCase();
+}
+
+function stripIpv6Brackets(hostname: string): string {
+	return hostname.replace(/^\[/, "").replace(/\]$/, "");
+}
+
+function isLoopbackOrLocalHostname(hostname: string) {
+	const normalized = normalizeHostname(hostname);
+	return (
+		normalized === "localhost" || normalized === "::1" || normalized === "[::1]" || normalized.endsWith(".localhost")
+	);
+}
+
+function isPrivateIPv4(hostname: string) {
+	const [first = 0, second = 0] = hostname.split(".").map((part) => Number.parseInt(part, 10));
+	if (Number.isNaN(first) || Number.isNaN(second)) return false;
+
+	if (first === 10) return true;
+	if (first === 127) return true;
+	if (first === 169 && second === 254) return true;
+	if (first === 172 && second >= 16 && second <= 31) return true;
+	if (first === 192 && second === 168) return true;
+	if (first === 0) return true;
+
+	return false;
+}
+
+function isPrivateIPv6(hostname: string) {
+	const normalized = stripIpv6Brackets(normalizeHostname(hostname));
+	return (
+		normalized === "::1" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe80:")
+	);
+}
+
+export function isPrivateOrLoopbackHost(hostname: string) {
+	const normalized = stripIpv6Brackets(normalizeHostname(hostname));
+	if (isLoopbackOrLocalHostname(normalized)) return true;
+
+	const ipVersion = isIP(normalized);
+	if (ipVersion === 4) return isPrivateIPv4(normalized);
+	if (ipVersion === 6) return isPrivateIPv6(normalized);
+
+	return false;
+}
+
+function isOAuthLoopbackRedirectHost(hostname: string) {
+	const normalized = stripIpv6Brackets(normalizeHostname(hostname));
+	return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+
+export function parseUrl(input: string) {
+	try {
+		return new URL(input);
+	} catch {
+		return null;
+	}
+}
+
+export function parseAllowedHostList(value?: string) {
+	if (!value) return new Set<string>();
+
+	const hosts = value
+		.split(",")
+		.map((entry) => entry.trim().toLowerCase())
+		.filter(Boolean);
+
+	return new Set(hosts);
+}
+
+export function isAllowedExternalUrl(input: string, allowedHosts: Set<string>) {
+	const parsed = parseUrl(input);
+	if (!parsed) return false;
+	if (parsed.protocol !== "https:") return false;
+	if (parsed.username || parsed.password) return false;
+	if (isPrivateOrLoopbackHost(parsed.hostname)) return false;
+
+	const hostname = normalizeHostname(parsed.hostname);
+	if (allowedHosts.has(hostname)) return true;
+
+	const origin = parsed.origin.toLowerCase();
+	return allowedHosts.has(origin);
+}
+
+export function isAllowedOAuthRedirectUri(input: string, trustedOrigins: string[], allowedHosts: Set<string>) {
+	const parsed = parseUrl(input);
+	if (!parsed) return false;
+	if (parsed.username || parsed.password) return false;
+	if (parsed.hash) return false;
+
+	const origin = parsed.origin.toLowerCase();
+	const hostname = normalizeHostname(parsed.hostname);
+
+	if (parsed.protocol === "http:") return isOAuthLoopbackRedirectHost(hostname);
+	if (parsed.protocol !== "https:") return false;
+	if (isPrivateOrLoopbackHost(hostname)) return false;
+
+	if (trustedOrigins.includes(origin)) return true;
+	if (allowedHosts.has(origin)) return true;
+
+	return allowedHosts.has(hostname);
+}