fix: Adjust filtering logic for secure contexts; improve tests (#579)

* Fix issue #564: Modify filtering logic and update related tests * chore: fix linting issues * Update packages/block-brokers/src/trustless-gateway/utils.ts Co-authored-by: Russell Dempsey <[email protected]> * refactor: simplify conditional logic in filterNonHTTPMultiaddrs --------- Co-authored-by: Russell Dempsey <[email protected]>
ipfs · Aug 12, 2024 · ac4bdb8 · ac4bdb8
1 parent 777d868
commit ac4bdb8
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 0 deletions.
diff --git a/packages/block-brokers/src/trustless-gateway/utils.ts b/packages/block-brokers/src/trustless-gateway/utils.ts
@@ -21,6 +21,14 @@ export function filterNonHTTPMultiaddrs (multiaddrs: Multiaddr[], allowInsecure:
       return isPrivateIp(ma.toOptions().host) === false
     }
 
+    // When allowInsecure is false and allowLocal is true, allow multiaddrs with "127.0.0.1", "localhost", or any subdomain ending with ".localhost"
+    if (!allowInsecure && allowLocal) {
+      const { host } = ma.toOptions()
+      if (host === '127.0.0.1' || host === 'localhost' || host.endsWith('.localhost')) {
+        return true
+      }
+    }
+
     return false
   })
 }

diff --git a/packages/block-brokers/test/trustless-gateway-utils.spec.ts b/packages/block-brokers/test/trustless-gateway-utils.spec.ts
@@ -27,4 +27,28 @@ describe('trustless-gateway-block-broker-utils', () => {
 
     expect(filtered.length).to.deep.equal(0)
   })
+
+  it('filterNonHTTPMultiaddrs allows 127.0.0.1 when allowInsecure=false', async function () {
+    const localMaddr = uriToMultiaddr('http://127.0.0.1')
+
+    const filtered = filterNonHTTPMultiaddrs([localMaddr], false, true)
+
+    expect(filtered.length).to.deep.equal(1)
+  })
+
+  it('filterNonHTTPMultiaddrs allows localhost when allowInsecure=false', async function () {
+    const localMaddr = uriToMultiaddr('http://localhost')
+
+    const filtered = filterNonHTTPMultiaddrs([localMaddr], false, true)
+
+    expect(filtered.length).to.deep.equal(1)
+  })
+
+  it('filterNonHTTPMultiaddrs allows *.localhost when allowInsecure=false', async function () {
+    const localMaddr = uriToMultiaddr('http://example.localhost')
+
+    const filtered = filterNonHTTPMultiaddrs([localMaddr], false, true)
+
+    expect(filtered.length).to.deep.equal(1)
+  })
 })