28 lines
1.7 KiB
JavaScript
28 lines
1.7 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import { isPublicAddress, resolvePublic } from "../src/host-guard.js";
|
|
|
|
test("tells public addresses from the ones a server inside a network must not be sent to", () => {
|
|
for (const address of ["8.8.8.8", "1.1.1.1", "172.32.0.1", "2606:4700:4700::1111", "::ffff:8.8.8.8"]) {
|
|
assert.equal(isPublicAddress(address), true, address);
|
|
}
|
|
for (const address of ["10.1.2.3", "192.168.0.5", "172.16.5.5", "127.0.0.1", "169.254.169.254", "100.64.1.1", "0.0.0.0",
|
|
"::1", "::", "fd00::1", "fe80::1", "::ffff:10.0.0.1", "::ffff:127.0.0.1", "224.0.0.1", "not-an-address"]) {
|
|
assert.equal(isPublicAddress(address), false, address);
|
|
}
|
|
});
|
|
|
|
test("an IP given as the host is checked as it is, without asking DNS", async () => {
|
|
const lookup = async () => { throw new Error("must not be asked"); };
|
|
assert.deepEqual(await resolvePublic("203.0.114.1", lookup), { address: "203.0.114.1" });
|
|
await assert.rejects(resolvePublic("10.0.0.1", lookup), /not a public address/);
|
|
await assert.rejects(resolvePublic("[::1]", lookup), /not a public address/);
|
|
});
|
|
|
|
test("a name is resolved, and refused if any of its addresses is not public", async () => {
|
|
assert.deepEqual(await resolvePublic("db.example.org", async () => [{ address: "8.8.4.4" }, { address: "2606:4700::1" }]), { address: "8.8.4.4" });
|
|
await assert.rejects(resolvePublic("sneaky.example.org", async () => [{ address: "8.8.4.4" }, { address: "10.0.0.7" }]), /not a public one/);
|
|
await assert.rejects(resolvePublic("gone.example.org", async () => { throw new Error("ENOTFOUND"); }), /does not resolve/);
|
|
await assert.rejects(resolvePublic("empty.example.org", async () => []), /does not resolve/);
|
|
});
|