@algolia/dns-filter - npm Package Compare versions

Comparing version 1.1.3 to 1.1.11

CHANGELOG.md

@@ -0,1 +1,52 @@
+## [1.1.11](https://github.com/algolia/dns-filter/compare/v1.1.10...v1.1.11) (2020-11-24)
+
+## [1.1.10](https://github.com/algolia/dns-filter/compare/v1.1.9...v1.1.10) (2020-11-24)
+
+
+### Bug Fixes
+
+* **deps:** refresh yarn.lock ([#39](https://github.com/algolia/dns-filter/issues/39)) ([129be5d](https://github.com/algolia/dns-filter/commit/129be5dfc495249c879c68375c12a7d0bac06418))
+
+## [1.1.9](https://github.com/algolia/dns-filter/compare/v1.1.8...v1.1.9) (2020-11-09)
+
+
+### Bug Fixes
+
+* **deps:** update dependency ip-address to v7 ([#35](https://github.com/algolia/dns-filter/issues/35)) ([e0cb8ff](https://github.com/algolia/dns-filter/commit/e0cb8ff3dc42805f05f2c04b0e3a04430a549199))
+
+## [1.1.8](https://github.com/algolia/dns-filter/compare/v1.1.7...v1.1.8) (2020-09-13)
+
+
+### Bug Fixes
+
+* **deps:** update dependency ip-address to v6.4.0 ([abfdc99](https://github.com/algolia/dns-filter/commit/abfdc998d05363db7e1359a4f0db2034059e4ada))
+
+## [1.1.7](https://github.com/algolia/dns-filter/compare/v1.1.6...v1.1.7) (2020-05-11)
+
+
+### Bug Fixes
+
+* **dep-sec:** upgrade npm dependency to secure version ([#16](https://github.com/algolia/dns-filter/issues/16)) ([e9de144](https://github.com/algolia/dns-filter/commit/e9de1445cc2ec89c682a64adcc991585abf96ef5))
+
+## [1.1.6](https://github.com/algolia/dns-filter/compare/v1.1.5...v1.1.6) (2020-04-04)
+
+
+### Bug Fixes
+
+* **deps:** update dependency ip-address to v6.3.0 ([e1f7c57](https://github.com/algolia/dns-filter/commit/e1f7c57874f7edbe764a2ba915796cc23aab5839))
+
+## [1.1.5](https://github.com/algolia/dns-filter/compare/v1.1.4...v1.1.5) (2020-01-04)
+
+
+### Bug Fixes
+
+* **deps:** update dependency ip-address to v6.2.0 ([9401b63](https://github.com/algolia/dns-filter/commit/9401b63734bc370e7e5dc96df72925a915d0092b))
+
+## [1.1.4](https://github.com/algolia/dns-filter/compare/v1.1.3...v1.1.4) (2019-10-23)
+
+
+### Bug Fixes
+
+* **circle-ci:** remove npm publish ([e947575](https://github.com/algolia/dns-filter/commit/e9475752564e4870d89835f3eff015b46a91c49b))
+
 ## [1.1.3](https://github.com/algolia/dns-filter/compare/v1.1.2...v1.1.3) (2019-10-23)
@@ -2,0 +53,0 @@

dist/errors/BlacklistedIP.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.BlacklistedIPError = void 0;
 const Custom_1 = require("./Custom");
@@ -10,3 +11,3 @@ class BlacklistedIPError extends Custom_1.CustomError {
         if (context) {
-            Object.keys(context).forEach(key => {
+            Object.keys(context).forEach((key) => {
                 this[key] = context[key];
@@ -13,0 +14,0 @@ });

dist/errors/Custom.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CustomError = void 0;
 class CustomError extends Error {
@@ -4,0 +5,0 @@ constructor(message) {

dist/errors/DNSResolve.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DNSResolveError = void 0;
 const Custom_1 = require("./Custom");
@@ -4,0 +5,0 @@ class DNSResolveError extends Custom_1.CustomError {

dist/errors/index.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkError = exports.MalformedURLError = exports.DNSResolveError = exports.BlacklistedIPError = void 0;
 const BlacklistedIP_1 = require("./BlacklistedIP");
-exports.BlacklistedIPError = BlacklistedIP_1.BlacklistedIPError;
+Object.defineProperty(exports, "BlacklistedIPError", { enumerable: true, get: function () { return BlacklistedIP_1.BlacklistedIPError; } });
 const DNSResolve_1 = require("./DNSResolve");
-exports.DNSResolveError = DNSResolve_1.DNSResolveError;
+Object.defineProperty(exports, "DNSResolveError", { enumerable: true, get: function () { return DNSResolve_1.DNSResolveError; } });
 const MalformedURL_1 = require("./MalformedURL");
-exports.MalformedURLError = MalformedURL_1.MalformedURLError;
+Object.defineProperty(exports, "MalformedURLError", { enumerable: true, get: function () { return MalformedURL_1.MalformedURLError; } });
 const Network_1 = require("./Network");
-exports.NetworkError = Network_1.NetworkError;
+Object.defineProperty(exports, "NetworkError", { enumerable: true, get: function () { return Network_1.NetworkError; } });
 exports.default = {
@@ -12,0 +13,0 @@ BlacklistedIPError: BlacklistedIP_1.BlacklistedIPError,

dist/errors/MalformedURL.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MalformedURLError = void 0;
 const Custom_1 = require("./Custom");
@@ -4,0 +5,0 @@ class MalformedURLError extends Custom_1.CustomError {

dist/errors/Network.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkError = void 0;
 const Custom_1 = require("./Custom");
@@ -4,0 +5,0 @@ // Generic error to not expose the attempted hack detection

dist/index.d.ts

 import { BlacklistedIPError, DNSResolveError, MalformedURLError } from './errors';
+export declare const PRIVATE_IP_PREFIXES: string[];
 interface ValidationParams<T extends Record<string, any>> {
@@ -7,4 +8,3 @@ url: string;
 }
-export declare function validateURL<T extends Record<string, any>>({ url, ipPrefixes, context }: ValidationParams<T>): Promise<boolean>;
-export declare const PRIVATE_IP_PREFIXES: string[];
+export declare function validateURL<T extends Record<string, any>>({ url, ipPrefixes, context, }: ValidationParams<T>): Promise<boolean>;
 export { BlacklistedIPError, DNSResolveError, MalformedURLError };

dist/index.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MalformedURLError = exports.DNSResolveError = exports.BlacklistedIPError = exports.validateURL = exports.PRIVATE_IP_PREFIXES = void 0;
 const dns_1 = require("dns");
 const url_1 = require("url");
 const util_1 = require("util");
+const ip_address_1 = require("ip-address");
 const errors_1 = require("./errors");
-exports.BlacklistedIPError = errors_1.BlacklistedIPError;
-exports.DNSResolveError = errors_1.DNSResolveError;
-exports.MalformedURLError = errors_1.MalformedURLError;
+Object.defineProperty(exports, "BlacklistedIPError", { enumerable: true, get: function () { return errors_1.BlacklistedIPError; } });
+Object.defineProperty(exports, "DNSResolveError", { enumerable: true, get: function () { return errors_1.DNSResolveError; } });
+Object.defineProperty(exports, "MalformedURLError", { enumerable: true, get: function () { return errors_1.MalformedURLError; } });
 const dnsLookupPromisified = util_1.promisify(dns_1.lookup);
-const createBlacklistedIPError = (url, restrictedIP, context) => new errors_1.BlacklistedIPError(url, restrictedIP, context);
-async function validateURL({ url, ipPrefixes = exports.PRIVATE_IP_PREFIXES, context }) {
-    let parsedURL;
-    try {
-        parsedURL = new url_1.URL(url);
-    }
-    catch (e) {
-        throw new errors_1.MalformedURLError(url);
-    }
-    const { hostname } = parsedURL;
-    let ip;
-    try {
-        const { address } = await dnsLookupPromisified(hostname);
-        // I don't believe this can happen, but just in case
-        if (typeof address !== 'string' || address.length === 0) {
-            throw new Error('Invalid address');
-        }
-        ip = address;
-    }
-    catch (err) {
-        throw new errors_1.DNSResolveError(err);
-    }
-    if (isRestrictedIP(ip, ipPrefixes)) {
-        throw createBlacklistedIPError(url, ip, context);
-    }
-    return true;
-}
-exports.validateURL = validateURL;
 // https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
@@ -71,2 +45,34 @@ // https://en.wikipedia.org/wiki/Private_network
 ];
+const createBlacklistedIPError = (url, restrictedIP, context) => {
+    return new errors_1.BlacklistedIPError(url, restrictedIP, context);
+};
+async function validateURL({ url, ipPrefixes = exports.PRIVATE_IP_PREFIXES, context, }) {
+    let parsedURL;
+    try {
+        parsedURL = new url_1.URL(url);
+    }
+    catch (e) {
+        throw new errors_1.MalformedURLError(url);
+    }
+    const { hostname } = parsedURL;
+    let ip;
+    try {
+        const res = await dnsLookupPromisified(hostname);
+        const { address, family } = res;
+        // I don't believe this can happen, but just in case
+        if (typeof address !== 'string' || address.length === 0) {
+            throw new Error('Invalid address');
+        }
+        const formattedIP = family === 4 ? new ip_address_1.Address4(address) : new ip_address_1.Address6(address);
+        ip = formattedIP.correctForm();
+    }
+    catch (err) {
+        throw new errors_1.DNSResolveError(err);
+    }
+    if (isRestrictedIP(ip, ipPrefixes)) {
+        throw createBlacklistedIPError(url, ip, context);
+    }
+    return true;
+}
+exports.validateURL = validateURL;
 function isRestrictedIP(ip, ipPrefixes = exports.PRIVATE_IP_PREFIXES) {
@@ -73,0 +79,0 @@ const sanitizedIP = ip.trim().toLowerCase();

package.json

 {
   "name": "@algolia/dns-filter",
-  "version": "1.1.3",
+  "version": "1.1.11",
   "description": "A small utility library to test whether requests try to access predefined IPs",
@@ -24,27 +24,30 @@ "main": "dist/index.js",
   "devDependencies": {
-    "@semantic-release/changelog": "^3.0.4",
-    "@semantic-release/git": "^7.0.16",
-    "@semantic-release/npm": "^5.2.0",
-    "@types/ip-address": "^5.8.2",
-    "@types/jest": "^24.0.19",
-    "@types/node": "^12.11.1",
-    "@typescript-eslint/eslint-plugin": "^2.4.0",
-    "@typescript-eslint/parser": "^2.4.0",
-    "babel-eslint": "^10.0.3",
-    "eslint": "^6.5.1",
-    "eslint-config-algolia": "^15.0.0",
-    "eslint-config-prettier": "^6.4.0",
-    "eslint-plugin-eslint-comments": "^3.1.2",
-    "eslint-plugin-import": "^2.18.2",
-    "eslint-plugin-jest": "^22.19.0",
-    "eslint-plugin-prettier": "^3.1.1",
-    "jest": "^24.9.0",
-    "prettier": "^1.18.2",
-    "semantic-release": "^15.13.27",
-    "ts-jest": "^24.1.0",
-    "typescript": "^3.6.4"
+    "@semantic-release/changelog": "5.0.1",
+    "@semantic-release/git": "9.0.0",
+    "@semantic-release/npm": "7.0.8",
+    "@types/ip-address": "6.0.0",
+    "@types/jest": "26.0.15",
+    "@types/node": "12.19.6",
+    "@typescript-eslint/eslint-plugin": "4.8.1",
+    "@typescript-eslint/parser": "4.8.1",
+    "babel-eslint": "10.1.0",
+    "eslint": "7.14.0",
+    "eslint-config-algolia": "16.0.0",
+    "eslint-config-prettier": "6.15.0",
+    "eslint-plugin-eslint-comments": "3.2.0",
+    "eslint-plugin-import": "2.22.1",
+    "eslint-plugin-jest": "24.1.3",
+    "eslint-plugin-prettier": "3.1.4",
+    "jest": "26.6.3",
+    "prettier": "2.2.0",
+    "semantic-release": "17.3.0",
+    "ts-jest": "26.4.4",
+    "typescript": "4.1.2"
   },
   "dependencies": {
-    "ip-address": "^6.1.0"
+    "ip-address": "7.1.0"
+  },
+  "resolutions": {
+    "npm": "6.14.9"
   }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Number of package files

25

increased by4.17%

Lines of code

229

increased by5.53%

Worsened metrics

Total package byte prevSize

24806

decreased by-92.25%

Dependency changes

• + Addedip-address@7.1.0(transitive)

• - Removedip-address@6.4.0(transitive)

• - Removedlodash.find@4.6.0(transitive)

• - Removedlodash.max@4.0.1(transitive)

• - Removedlodash.merge@4.6.2(transitive)

• - Removedlodash.padstart@4.6.1(transitive)

• - Removedlodash.repeat@4.1.0(transitive)

• Updatedip-address@7.1.0