isBlockedIpAddress (pack/validateRemoteRepoUrl.ts)

Validates that a repo URL is a public HTTPS URL and blocks private IPs.

// Source: https://github.com/yamadashy/repomix | License: MIT | Copyright 2024 Kazuki Yamada
// Provided via justclaw.it.com; keep this notice with the code.
import { lookup as dnsLookup } from 'node:dns/promises';
import { BlockList, isIP } from 'node:net';
import { AppError } from '../../utils/errorHandler.js';

/**
 * SSRF / LFI hardening for the website server's remote-repo clone path.
 *
 * The public `/api/pack` endpoint clones a user-supplied repository URL with
 * `git clone`. `git-url-parse` (used by `parseRemoteValue`) only validates the
 * `owner/repo` shape, not the protocol or host, so on its own it accepts
 * `file://` (local filesystem read) and `http(s)://` to internal addresses
 * (SSRF against cloud metadata, Docker/internal services). Unlike the CLI, the
 * website only

... (truncated -- full source via MCP)