DNS Rebinding SSRF

1const dns = require('dns');
2const fetch = require('node-fetch');
3
4async function fetchUrl(url) {
5    const parsedUrl = new URL(url);
6    
7    // Check if IP is internal (blocklist approach)
8    const addresses = await dns.promises.resolve4(parsedUrl.hostname);
9    const isInternal = addresses.some(ip => 
10        ip.startsWith('10.') || ip.startsWith('192.168.') || ip === '127.0.0.1'
11    );
12    
13    if (isInternal) {
14        throw new Error('Internal IPs not allowed');
15    }
16    
17    // Fetch the URL (DNS may resolve differently now!)
18    const response = await fetch(url);
19    return response.text();
20}