Files
renovate/lib/config/presets/npm/index.spec.ts
Jamie Tanna 29a7b9c5f5 fix(util/http): allow blocking requests to internal hosts
To harden Renovate from being able to access internal hosts, we can add
a level of enforcement on all outgoing requests.

We can split this into two types of traffic:

- where the response becomes configuration (i.e. `extends`)
- where the response does not become configuration (i.e.
  `customDatasources`)

To harden this, we enforce on every outbound HTTP request:

- check the resolved URL before anything, including cache lookups, can
  proceed
  - catching IP-literal hosts in every spelling the WHATWG URL parser normalizes
  - blocking known Cloud metadata IPs, too
- a `dnsLookup` wrapper validates every address a hostname resolves to,
  on every new connection, which also defeats DNS rebinding
- a `beforeRedirect` hook re-runs the URL check on each redirect
  target, with the new host getting its own grant lookup rather than
  inheriting the original host's verdict

We default this enforcement to `warn`, to not break existing deployments
and instead give them visibility into required configuration before a
future major version (major+1) enables `block` by default.

We'll also remove allow in a future major version (major+2), to give
time for admins to migrate over.

When a request is blocked, this degrades like an unreachable registry,
so a Renovate run isn't aborted by a blocked request.

As part of this, we can also provide a worked example of the different
cases that do/do not need allowing via `hostRules`.

Requests through an admin-configured proxy resolve DNS at the proxy, so
`dnsLookup` never runs for them, so we can resolve the hostname locally
and validate every address before the request instead.

This doesn't catch everything, especially as the proxy may resolve the
name to a different result, and if we can't resolve the name - possible
in locked-down corporate environments - we fail open.

Child processes aren't currently able to route traffic through
Renovate's HTTP layer, so are unrestricted.

Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Opus 5 <jamie.tanna+claude-code@mend.io>
Co-authored-by: Claude Sonnet 5 <jamie.tanna+claude-code@mend.io>
2026-09-10 14:52:01 +01:00

166 lines
4.5 KiB
TypeScript

import { hostRules } from '~test/host-rules.ts';
import * as httpMock from '~test/http-mock.ts';
import { HOST_BLOCKED } from '../../../constants/error-messages.ts';
import { defaultRegistryUrl } from '../../../modules/datasource/npm/common.ts';
import { setNpmrc } from '../../../modules/datasource/npm/npmrc.ts';
import { GlobalConfig } from '../../global.ts';
import * as npm from './index.ts';
describe('config/presets/npm/index', () => {
beforeEach(() => {
GlobalConfig.reset();
setNpmrc();
});
it('should throw if no package', async () => {
httpMock.scope(defaultRegistryUrl).get('/nopackage').reply(404);
await expect(
npm.getPreset({ repo: 'nopackage', presetName: 'default' }),
).rejects.toThrow(/dep not found/);
});
it('should throw if no renovate-config', async () => {
const presetPackage = {
name: 'norenovateconfig',
versions: {
'0.0.1': {
foo: 1,
},
'0.0.2': {
foo: 2,
deprecated: 'This is deprecated',
},
},
repository: {
type: 'git',
url: 'git://github.com/renovateapp/dummy.git',
},
'dist-tags': {
latest: '0.0.2',
},
time: {
'0.0.1': '2018-05-06T07:21:53+02:00',
'0.0.2': '2018-05-07T07:21:53+02:00',
},
};
httpMock
.scope(defaultRegistryUrl)
.get('/norenovateconfig')
.reply(200, presetPackage);
await expect(
npm.getPreset({ repo: 'norenovateconfig', presetName: 'default' }),
).rejects.toThrow(/preset renovate-config not found/);
});
it('should throw if preset name not found', async () => {
const presetPackage = {
name: 'presetnamenotfound',
versions: {
'0.0.1': {
foo: 1,
},
'0.0.2': {
foo: 2,
deprecated: 'This is deprecated',
'renovate-config': { default: { rangeStrategy: 'auto' } },
},
},
repository: {
type: 'git',
url: 'git://github.com/renovateapp/dummy.git',
},
'dist-tags': {
latest: '0.0.2',
},
time: {
'0.0.1': '2018-05-06T07:21:53+02:00',
'0.0.2': '2018-05-07T07:21:53+02:00',
},
};
httpMock
.scope(defaultRegistryUrl)
.get('/presetnamenotfound')
.reply(200, presetPackage);
await expect(
npm.getPreset({
repo: 'presetnamenotfound',
presetName: 'missing',
}),
).rejects.toThrow(/preset not found/);
});
it('should return preset', async () => {
const presetPackage = {
name: 'workingpreset',
versions: {
'0.0.1': {
foo: 1,
},
'0.0.2': {
foo: 2,
deprecated: 'This is deprecated',
'renovate-config': { default: { rangeStrategy: 'auto' } },
},
},
repository: {
type: 'git',
url: 'https://github.com/renovateapp/dummy.git',
},
'dist-tags': {
latest: '0.0.2',
},
time: {
'0.0.1': '2018-05-06T07:21:53+02:00',
'0.0.2': '2018-05-07T07:21:53+02:00',
},
};
httpMock
.scope(defaultRegistryUrl)
.get('/workingpreset')
.reply(200, presetPackage);
const res = await npm.getPreset({ repo: 'workingpreset' });
expect(res).toEqual({ rangeStrategy: 'auto' });
});
describe('internal registry hosts', () => {
const presetPackage = {
name: 'internalpreset',
versions: {
'0.0.1': {
'renovate-config': { default: { rangeStrategy: 'auto' } },
},
},
'dist-tags': { latest: '0.0.1' },
};
beforeEach(() => {
GlobalConfig.set({ internalHostAccess: 'block' });
// the repository's own `npmrc` picks the registry, so this is a repo-controlled URL
setNpmrc('registry=http://10.1.2.3/');
});
it('is blocked when the admin only named the registry host', async () => {
hostRules.add({ matchHost: '10.1.2.3' }, { trusted: true });
await expect(npm.getPreset({ repo: 'internalpreset' })).rejects.toThrow(
HOST_BLOCKED,
);
});
it('is fetched under a scoped grant', async () => {
hostRules.add(
{ hostType: 'npm', matchHost: '10.1.2.3', allowInternal: true },
{ trusted: true },
);
httpMock
.scope('http://10.1.2.3')
.get('/internalpreset')
.reply(200, presetPackage);
const res = await npm.getPreset({ repo: 'internalpreset' });
expect(res).toEqual({ rangeStrategy: 'auto' });
});
});
});