lib: add warning when binding inspector to public IP #55736
Conversation
Add `isLoopback` function to `internal/net` module to check if a given host is a loopback address. Add a warning when binding the inspector to a public IP with an open port, as it allows external hosts to connect to the inspector. Fixes: nodejs#23444 Refs: https://nodejs.org/api/cli.html#--inspecthostport
|
Review requested:
|
nodejs-github-bot
added
inspector
| } | ||
|
|
||
| for (const address of loopbackNot) { | ||
| assert.strictEqual(net.isLoopback(address), false); |
There was a problem hiding this comment.
You should test the warning not this particular function.
| function isLoopback(host) { | ||
| const hostLower = host.toLowerCase(); | ||
|
|
||
| return ( | ||
| hostLower === 'localhost' || | ||
| hostLower.startsWith('127.') || | ||
| hostLower.startsWith('[::1]') || | ||
| hostLower.startsWith('[0:0:0:0:0:0:0:1]') | ||
| ); | ||
| } |
There was a problem hiding this comment.
Can you add a source for this information?
What about 0.0.0.0 addresses?
There was a problem hiding this comment.
https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml
What about 0.0.0.0 addresses?
According to my understanding 0.0.0.0 should not be considered as loopback address.
https://en.wikipedia.org/wiki/0.0.0.0
https://www.rfc-editor.org/rfc/rfc1122.html
There was a problem hiding this comment.
Thanks for the info! IMO you should add a comment with the IANA links for reference
| '192.168.1.1', | ||
| '10.0.0.1', |
There was a problem hiding this comment.
Should we really warn for these? IMHO binding to IP in private subnet is usually fine.
Add
isLoopbackfunction tointernal/netmodule to check if a given host is a loopback address.Add a warning when binding the inspector to a public IP with an open port, as it allows external hosts to connect to the inspector.
Fixes: #23444
Refs: https://nodejs.org/api/cli.html#--inspecthostport IANA IPv4 Special-Purpose Address Registry
IANA IPv6 Special-Purpose Address Registry
Special-Use Domain Names