|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + * |
| 4 | + * End-to-end over a real socket: the guard resolves, classifies, pins, and |
| 5 | + * connects. Nothing about the transport is mocked, which is what makes this the |
| 6 | + * check that the policy is actually wired to the wire. |
| 7 | + * |
| 8 | + * Uses a private address on a real interface rather than a public DNS name that |
| 9 | + * resolves to loopback, so the suite needs no outbound DNS. |
| 10 | + */ |
| 11 | +import { createServer, type Server } from 'node:http' |
| 12 | +import type { AddressInfo } from 'node:net' |
| 13 | +import { networkInterfaces } from 'node:os' |
| 14 | +import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing' |
| 15 | +import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest' |
| 16 | +import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server' |
| 17 | + |
| 18 | +/** A non-loopback RFC1918 address on this machine, or null when there is none. */ |
| 19 | +function privateInterfaceAddress(): string | null { |
| 20 | + for (const addresses of Object.values(networkInterfaces())) { |
| 21 | + for (const address of addresses ?? []) { |
| 22 | + if (address.family !== 'IPv4' || address.internal) continue |
| 23 | + if (/^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/.test(address.address)) { |
| 24 | + return address.address |
| 25 | + } |
| 26 | + } |
| 27 | + } |
| 28 | + return null |
| 29 | +} |
| 30 | + |
| 31 | +const host = privateInterfaceAddress() |
| 32 | + |
| 33 | +let server: Server |
| 34 | +let port = 0 |
| 35 | + |
| 36 | +beforeAll(async () => { |
| 37 | + if (!host) return |
| 38 | + server = createServer((request, response) => { |
| 39 | + request.resume() |
| 40 | + response.writeHead(200, { 'content-type': 'text/plain' }) |
| 41 | + response.end('reached') |
| 42 | + }) |
| 43 | + await new Promise<void>((resolve) => server.listen(0, host, resolve)) |
| 44 | + port = (server.address() as AddressInfo).port |
| 45 | +}) |
| 46 | + |
| 47 | +afterAll(async () => { |
| 48 | + if (server) await new Promise<void>((resolve) => server.close(() => resolve())) |
| 49 | + resetEnvFlagsMock() |
| 50 | +}) |
| 51 | + |
| 52 | +afterEach(resetEnvFlagsMock) |
| 53 | + |
| 54 | +// Skipped on a host with no private interface (some CI sandboxes); the policy |
| 55 | +// itself is covered without a socket in packages/security. |
| 56 | +describe.skipIf(!host)('issue #7200 — reaching a service on a private network', () => { |
| 57 | + it('refuses an unlisted destination and names the setting that would permit it', async () => { |
| 58 | + await expect( |
| 59 | + secureFetchWithValidation(`http://${host}:${port}/`, { profile: 'requestTarget' }) |
| 60 | + ).rejects.toThrow(/EGRESS_ALLOWED_HOSTS/) |
| 61 | + }) |
| 62 | + |
| 63 | + it('reaches it over plain HTTP once the operator names the range', async () => { |
| 64 | + setEnvFlags({ egressAllowedIpRanges: `${host}/32` }) |
| 65 | + |
| 66 | + const response = await secureFetchWithValidation(`http://${host}:${port}/`, { |
| 67 | + profile: 'requestTarget', |
| 68 | + }) |
| 69 | + |
| 70 | + expect(response.status).toBe(200) |
| 71 | + expect(await response.text()).toBe('reached') |
| 72 | + }) |
| 73 | + |
| 74 | + it('does not extend that reach to a content-provenance URL', async () => { |
| 75 | + setEnvFlags({ egressAllowedIpRanges: `${host}/32` }) |
| 76 | + |
| 77 | + await expect( |
| 78 | + secureFetchWithValidation(`http://${host}:${port}/`, { profile: 'contentFetch' }) |
| 79 | + ).rejects.toThrow() |
| 80 | + }) |
| 81 | + |
| 82 | + it('reaches a loopback service without any allowlist, as a self-hosted deployment does', async () => { |
| 83 | + const local = createServer((request, response) => { |
| 84 | + request.resume() |
| 85 | + response.end('local') |
| 86 | + }) |
| 87 | + await new Promise<void>((resolve) => local.listen(0, '127.0.0.1', resolve)) |
| 88 | + const localPort = (local.address() as AddressInfo).port |
| 89 | + try { |
| 90 | + const response = await secureFetchWithValidation(`http://localhost:${localPort}/`, { |
| 91 | + profile: 'selfHostedService', |
| 92 | + }) |
| 93 | + expect(await response.text()).toBe('local') |
| 94 | + } finally { |
| 95 | + await new Promise<void>((resolve) => local.close(() => resolve())) |
| 96 | + } |
| 97 | + }) |
| 98 | +}) |
0 commit comments