title: How to prevent untrusted input from connecting to private IP addresses in node.js
body: <p>I have a Node.js server that accepts an arbitrary URL as input from the user, and then issues a GET request to that URL using <a href="https://www.npmjs.com/package/node-fetch" rel="nofollow noreferrer">node-fetch</a>.</p>
  <p>How do I prevent this from connecting to private IP addresses? Examples of IP ranges that should be blocked are: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1/128, fe80::/10, fc00::/7.</p>
  <p>Here is a Golang version that I wrote: <a href="https://gist.github.com/stefansundin/32e8399f0c67c07c372b5ab51560e004" rel="nofollow noreferrer">https://gist.github.com/stefansundin/32e8399f0c67c07c372b5ab51560e004</a></p>
  <p>Here is a Ruby version: <a href="https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib%2Fgitlab%2Furl_blocker.rb" rel="nofollow noreferrer">https://gitlab.com/gitlab-org/gitlab-foss/blob/master/lib%2Fgitlab%2Furl_blocker.rb</a></p>
  <p>The Golang version is great because there is just a single DNS request. I think the Ruby version results in two DNS requests and there is a slim chance that a DNS rebinding attack would succeed. I can't find a similar way to hook into DNS resolution in Node.js.</p>
  <p>What is the best way to do it in Node.js?</p>