18 lines
1.0 KiB
JavaScript
18 lines
1.0 KiB
JavaScript
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { publicIPv4, targetFor } from "./egress.mjs";
|
|
test("blocks private, metadata, reserved and IPv6 addresses", () => {
|
|
for (const ip of ["127.0.0.1","10.1.2.3","172.16.1.1","192.168.1.1","169.254.169.254","100.64.1.1","0.0.0.0","224.0.0.1","::1","::ffff:127.0.0.1"]) assert.equal(publicIPv4(ip),false,ip);
|
|
assert.equal(publicIPv4("1.1.1.1"),true);
|
|
});
|
|
test("requires exact hostname and HTTPS port", async () => {
|
|
const hosts = new Set(["example.com"]);
|
|
for (const target of ["evil.example.com:443","example.com:80","example.com:443/","127.0.0.1:443","example.com@evil.com:443"])
|
|
await assert.rejects(targetFor(target,hosts));
|
|
});
|
|
test("rejects mixed public/private DNS and pins a validated address", async () => {
|
|
const hosts = new Set(["example.com"]);
|
|
await assert.rejects(targetFor("example.com:443",hosts,async()=>[{address:"1.1.1.1"},{address:"127.0.0.1"}]));
|
|
assert.equal(await targetFor("example.com:443",hosts,async()=>[{address:"1.1.1.1"}]),"1.1.1.1");
|
|
});
|