fix: enhance IP addresses hostname validation
| @@ -1,5 +1,6 @@ | ||
| 1 | 1 | import fetch from 'node-fetch'; |
| 2 | 2 | import express from 'express'; |
| 3 | +import ipRegex from 'ip-regex'; | |
| 3 | 4 | |
| 4 | 5 | import { decode } from 'html-entities'; |
| 5 | 6 | import { readSecret, SECRET_KEYS } from './secrets.js'; |
| @@ -416,7 +417,7 @@ router.post('/visit', async (request, response) => { | ||
| 416 | 417 | } |
| 417 | 418 | |
| 418 | 419 | // Reject IP addresses |
| 419 | - if (urlObj.hostname.match(/^\d+\.\d+\.\d+\.\d+$/)) { | |
| 420 | + if (ipRegex.v4({ exact: true }).test(urlObj.hostname) || ipRegex.v6({ exact: true }).test(urlObj.hostname)) { | |
| 420 | 421 | throw new Error('Invalid hostname'); |
| 421 | 422 | } |
| 422 | 423 | } catch (error) { |