Kikobeats / is-local-address / 36692379261

100%

push

github

feat: add site-scoped export (#31)

The default export answers "is this address non-public", which is what an
SSRF guard needs, so it includes bogon ranges that hosts outside the
caller's own network can hold: RFC 6598 shared address space (100.64/10),
Teredo (2001::/32), 6to4 (2002::/16) and NAT64 (64:ff9b::/96). Callers
that need "is this address inside one administrative network", such as
deciding whether to reflect a CORS origin, had to post-filter.

Add `is-local-address/site-scoped`, matching only ranges with RFC 4007
site scope or narrower, with `.ipv4` and `.ipv6` per-family matchers.

To avoid duplicating the matchers, move each family's range list into a
tagged ranges.js and compile it through a create.js factory. The default,
/ipv4 and /ipv6 exports are instantiated from the same factories and their
compiled regexes are byte-identical to before. The IPv6 factory takes the
IPv4 matcher as a parameter so a scoped IPv6 matcher classifies IPv4-mapped
addresses with the equally scoped IPv4 matcher.

The site-scoped export also decodes the dotted IPv4-mapped form so both
spellings classify by the embedded IPv4; the default export's handling of
that form is unchanged.

Co-authored-by: Eric Sampson <1183853+ericsampson@users.noreply.github.com>

43 of 43 branches covered (100.0%)

Branch coverage included in aggregate %.

250 of 250 new or added lines in 7 files covered. (100.0%)

256 of 256 relevant lines covered (100.0%)

36.26 hits per line