Resolve hostnames from whitelist

0bc4396427612fd5e590a78c2792d080cea482c8

Cohee <18619528+Cohee1207@users.noreply.github.com>

Parents: f43b42544b39d21ef50323660f044e46eb5fd220

default/config.yaml+1 -0 Viewed

 whitelist:
   - ::1
   - 127.0.0.1
 +  - host.docker.internal
 # Toggle basic authentication for endpoints
 basicAuthMode: false
 # Basic authentication credentials

src/middleware/whitelist.js+63 -0 Viewed

 import path from 'node:path';
 import fs from 'node:fs';
 import process from 'node:process';
 +import dns from 'node:dns';
 import Handlebars from 'handlebars';
 +import ipRegex from 'ip-regex';
 import ipMatching from 'ip-matching';
 import { getIpFromRequest } from '../express-common.js';

@@ -20,6 +22,8 @@ if (fs.existsSync(whitelistPath)) {
20	22	}
21	23	}
22	24
	25	+await resolveHostnames();
	26	+
23	27	/**
24	28	* Get the client IP address from the request headers.
25	29	* @param {import('express').Request} req Express request object

+}
 /**
 + * Checks if a string is a valid hostname according to RFC 1123
 + * @param {string} hostname The string to test
 + * @returns {boolean} True if the string is a valid hostname
 + */
 +function isValidHostname(hostname) {
 +    const hostnameRegex = /^(([a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])\.)*([a-z0-9]|[a-z0-9][a-z0-9-]*[a-z0-9])$/i;
 +    return hostnameRegex.test(hostname);
 +}
++
 +/**
 + * Checks if a string is an IP address, CIDR notation, or IP wildcard
 + * @param {string} entry The string to test
 + * @returns {boolean} True if the string matches any IP format
 + */
 +function isIpFormat(entry) {
 +    // Match CIDR notation (e.g. 192.168.0.0/24)
 +    if (entry.includes('/')) {
 +        return true;
 +    }
++
 +    // Match exact IP address
 +    if (ipRegex({ exact: true }).test(entry)) {
 +        return true;
 +    }
++
 +    // Match IPv4 with wildcards (e.g. 192.168.*.* or 192.168.0.*)
 +    const ipWildcardRegex = /^(\d{1,3}|\*)\.(\d{1,3}|\*)\.(\d{1,3}|\*)\.(\d{1,3}|\*)$/;
 +    return ipWildcardRegex.test(entry);
 +}
++
 +/**
 + * Validate the IP addresses in the whitelist.
 + * Hostnames are resolved to IP addresses.
 + */
 +async function resolveHostnames() {
 +    for (let i = 0; i < whitelist.length; i++) {
 +        try {
 +            const entry = whitelist[i];
++
 +            // Skip if entry appears to be an IP address, CIDR notation, or IP wildcard
 +            if (isIpFormat(entry)) {
 +                continue;
 +            }
++
 +            if (isValidHostname(entry)) {
 +                const result = await dns.promises.lookup(entry);
++
 +                if (result.address) {
 +                    console.info('Resolved whitelist hostname', entry, 'to IP address', result.address);
 +                    whitelist[i] = result.address;
 +                }
 +            }
 +        } catch {
 +            // Ignore errors when resolving hostnames
 +        }
 +    }
 +}
++
 +/**
  * Returns a middleware function that checks if the client IP is in the whitelist.
  * @returns {import('express').RequestHandler} The middleware function
  */