Protect Got requests from SSRF
SSRF is the evil sibling to CSRF that essentially allows RCE against your backends: https://portswigger.net/web-security/ssrf.
This module automatically rejects all suchs requests so you can safely use got without even thinking about it.
npm i got-ssrf
Note that this package is ESM-only; see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c for what to do if you're using CJS (i.e. require()).
import { gotSsrf } from 'got-ssrf'
await gotSsrf(url) // automatically filters requests for safety
If you have any other plugins you want to "mix" got-ssrf with, see https://github.com/sindresorhus/got/blob/main/documentation/examples/advanced-creation.js for how to do so. Example:
import got from 'got'
import { gotSsrf } from 'got-ssrf'
import { gotInstance } from 'some-other-got-plugin'
const merged = got.extend(gotSsrf, gotInstance)
npm test
👤 Jane Jeon me@janejeon.dev
Contributions, issues and feature requests are welcome!
Feel free to check issues page.
Give a ⭐️ if this project helped you!
Copyright © 2021 Jane Jeon me@janejeon.dev.
This project is LGPL-3.0 licensed.
FAQs
Protect Got requests from SSRF
The npm package got-ssrf receives a total of 0 weekly downloads. As such, got-ssrf popularity was classified as not popular.
We found that got-ssrf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.