如何在 NodeJS 中识别提供的主机名/URL 是私有的
我正在寻找一种方法/NPM 包来验证输入的主机名作为 REST 端点的输入，然后将其存储在数据库中。 这是避免 SSRF 攻击所必需的。 到目前为止，我只是根据正则表达式过滤掉主机名。如果我发现主机名以 IP 开头，我会阻止它，但在某些情况下，此修复不会像环回地址那样起作用。我找不到任何执行所有这些验证的 NPM 库。有一些软件包，但他们期望 IP 作为输入，并且我已经在过滤。我什至从正则表达式转移到 ipaddr.js 包，因为正则表达式变得复杂且难以理解。
任何人都可以为我指明如何验证私有/环回地址的 URL 的正确方向吗？
I am looking for a way/NPM package to validate for private/local/bad addresses the entered hostname coming as an input to my REST endpoint before storing it in the DB.
This is required to avoid SSRF attacks.
So far, I am only filtering out the hostnames based on the regex. If I find that the hostname starts with an IP, I block it but there are certain cases where this fix won't work like loopback addresses. I couldn't find any NPM library that does all these validations. There were a few packages but they expect IP as input and that I am already filtering. I even moved from regex to the ipaddr.js package as that regex was getting complex and difficult to understand.
Can anyone point me in the right direction here on how to validate the URL for private/loopback address?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您的一台机器要向用户定义的 URL 发出请求，并且您希望避免人们在您的专用网络中输入地址，则需要首先解析主机名并找出目标 IP。
仅通过查看主机名无法知道主机名是否针对私有地址，因为我可以注册“blabla.com”并将其解析为
10.0.0.1。对于这个东西的最佳实践是制作一个与您的专用网络完全隔离的专用盒子来执行所有请求。
If one of your machines is going to do requests to URL that are defined by a user, and you want to avoid that people enter addresses in your private network, you need to resolve the hostname first and figure out the target ip.
You can't know if a hostname targets a private address by just looking at the hostname, because I can register 'blabla.com' and have it resolve to
10.0.0.1.The best practice for this stuff is to make a dedicated box that is completely isolated from your private network to do all the requests.