fix(core): normalize external ref host policy checks

Author: mattzcarey

packages/core-internal/src/validators/externalRefResolver.ts

@@ -115,6 +115,10 @@ function ipv6LiteralFromHost(host: string): string | undefined {
     return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : undefined;
 }
 
+function normalizeHostForPolicy(host: string): string {
+    return ipv6LiteralFromHost(host) === undefined ? host.replace(/\.+$/, '') : host;
+}
+
 function isBlockedIPv6Literal(host: string): boolean {
     if (host === '::' || host === '::1' || host.startsWith('::ffff:')) {
         return true;
@@ -139,10 +143,10 @@ function assertHostAllowed(url: URL, options: ResolvedOptions): void {
         );
     }
 
-    const host = url.hostname.toLowerCase();
+    const host = normalizeHostForPolicy(url.hostname.toLowerCase());
 
     if (options.allowlist) {
-        const allowlist = new Set(options.allowlist.map(allowedHost => allowedHost.toLowerCase()));
+        const allowlist = new Set(options.allowlist.map(allowedHost => normalizeHostForPolicy(allowedHost.toLowerCase())));
         if (!allowlist.has(host)) {
             throw new Error(`Refusing to dereference "${url.href}": host "${host}" is not in the allowlist.`);
         }

packages/core-internal/test/validators/externalRefResolver.test.ts

@@ -74,6 +74,20 @@ describe('resolveExternalSchemaRefs', () => {
         });
     });
 
+    it('matches allowlist hosts with a trailing DNS root dot', async () => {
+        const schema: JsonSchemaType = { $ref: 'https://schemas.example.com./forecast.json' };
+        const fetchImpl = fetchStub({
+            'https://schemas.example.com./forecast.json': { type: 'string' }
+        });
+
+        const resolved = await resolveExternalSchemaRefs(schema, { allowlist: ['schemas.example.com'], fetch: fetchImpl });
+
+        expect(resolved).toEqual({
+            $ref: '#/$defs/__externalRef_0',
+            $defs: { __externalRef_0: { type: 'string' } }
+        });
+    });
+
     it.each([
         ['AJV', () => new AjvJsonSchemaValidator()],
         ['CfWorker', () => new CfWorkerJsonSchemaValidator()]
@@ -191,9 +205,11 @@ describe('resolveExternalSchemaRefs', () => {
 
         it.each([
             'https://localhost/x.json',
+            'https://localhost./x.json',
             'https://127.0.0.1/x.json',
             'https://10.0.0.5/x.json',
             'https://169.254.169.254/x.json',
+            'https://metadata.google.internal./computeMetadata/v1',
             'https://[::1]/x.json',
             'https://[fd00::1]/x.json',
             'https://[fe80::1]/x.json',