fix: address CodeRabbit feedback for DB validation

Author: yash-pouranik

apps/dashboard-api/src/controllers/project.controller.js

@@ -22,7 +22,7 @@ const { encrypt, decrypt } = require("@urbackend/common");
 const { URL } = require("url");
 const path = require("path");
 const axios = require("axios");
-const { getConnection } = require("@urbackend/common");
+const { getConnection, isSafeUri } = require("@urbackend/common");
 const { getCompiledModel } = require("@urbackend/common");
 const { QueryEngine } = require("@urbackend/common");
 const { storageRegistry } = require("@urbackend/common");
@@ -585,123 +585,6 @@ const dropCollectionIfExists = async (connection, collectionName) => {
   }
 };
 
-/**
- * Convert a dotted-decimal IPv4 address string to a 32-bit unsigned integer.
- * @param {string} ip - IPv4 address in dotted-decimal notation (e.g., '192.168.1.1')
- * @returns {number} 32-bit unsigned integer representation of the IPv4 address
- */
-function ipv4ToInt(ip) {
-  return ip.split(".").reduce((acc, octet) => (acc << 8) + parseInt(octet, 10), 0) >>> 0;
-}
-
-/**
- * Check if an IPv4 address falls within any restricted or reserved IP range.
- * Blocks loopback (127.0.0.0/8), RFC-1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16),
- * link-local and cloud metadata (169.254.0.0/16), and unspecified (0.0.0.0/8) addresses to prevent SSRF attacks.
- * @param {string} ip - IPv4 address to validate
- * @returns {boolean} True if the IP is restricted, false otherwise
- */
-function isRestrictedIPv4(ip) {
-  const n = ipv4ToInt(ip);
-  // Loopback 127.0.0.0/8
-  if (n >= ipv4ToInt("127.0.0.0") && n <= ipv4ToInt("127.255.255.255")) return true;
-  // RFC-1918: 10.0.0.0/8
-  if (n >= ipv4ToInt("10.0.0.0") && n <= ipv4ToInt("10.255.255.255")) return true;
-  // RFC-1918: 172.16.0.0/12
-  if (n >= ipv4ToInt("172.16.0.0") && n <= ipv4ToInt("172.31.255.255")) return true;
-  // RFC-1918: 192.168.0.0/16
-  if (n >= ipv4ToInt("192.168.0.0") && n <= ipv4ToInt("192.168.255.255")) return true;
-  // Link-local / cloud instance metadata (AWS, GCP, Azure): 169.254.0.0/16
-  if (n >= ipv4ToInt("169.254.0.0") && n <= ipv4ToInt("169.254.255.255")) return true;
-  // Unspecified: 0.0.0.0/8
-  if (n >= ipv4ToInt("0.0.0.0") && n <= ipv4ToInt("0.255.255.255")) return true;
-  return false;
-}
-
-/**
- * Check if an IPv6 address falls within any restricted or reserved range.
- * Blocks loopback (::1), unspecified (::), link-local (fe80::/10), IPv6 Unique Local Addresses (fc00::/7),
- * and IPv4-mapped IPv6 addresses that resolve to restricted IPv4 ranges to prevent SSRF attacks.
- * @param {string} ip - IPv6 address to validate
- * @returns {boolean} True if the IP is restricted, false otherwise
- */
-function isRestrictedIPv6(ip) {
-  const expanded = ip.replace(/^\[|\]$/g, "").toLowerCase();
-  // IPv6 loopback ::1
-  if (expanded === "::1" || expanded === "0:0:0:0:0:0:0:1") return true;
-  // IPv6 unspecified ::
-  if (expanded === "::" || expanded === "0:0:0:0:0:0:0:0") return true;
-  // IPv4-mapped IPv6 addresses (::ffff:x.x.x.x)
-  const mapped = expanded.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
-  if (mapped && isRestrictedIPv4(mapped[1])) return true;
-  // IPv6 link-local fe80::/10 (fe80: through febf:)
-  if (/^fe[89ab]/.test(expanded)) return true;
-  // IPv6 ULA (Unique Local Address) fc00::/7
-  if (expanded.startsWith("fc") || expanded.startsWith("fd")) return true;
-  return false;
-}
-
-/**
- * Check if an IP address (either IPv4 or IPv6) is restricted or falls within a reserved range.
- * Delegates to isRestrictedIPv4() or isRestrictedIPv6() based on the IP version.
- * @param {string} ip - IP address to validate
- * @returns {boolean} True if the IP is restricted, false otherwise
- */
-function isRestrictedIP(ip) {
-  if (net.isIPv4(ip)) return isRestrictedIPv4(ip);
-  if (net.isIPv6(ip)) return isRestrictedIPv6(ip);
-  return false;
-}
-
-/**
- * Validate a URI to ensure it does not target restricted hosts or IP ranges (SSRF prevention).
- * Performs DNS resolution on hostnames to check both A and AAAA records against restricted ranges.
- * Blocks loopback, RFC-1918 private ranges, cloud metadata endpoints, and other reserved IP ranges.
- * @async
- * @param {string} uri - The URI to validate
- * @returns {Promise<boolean>} True if the URI is safe to connect to, false if it targets a restricted host
- */
-const isSafeUri = async (uri) => {
-  try {
-    const parsed = new URL(uri);
-    const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-
-    // Block well-known loopback and internal hostnames
-    const blockedHostnames = ["localhost", "metadata.google.internal"];
-    if (blockedHostnames.includes(host)) return false;
-
-    // Reject mongodb+srv:// URIs as they perform hidden SRV/TXT discovery
-    // We cannot safely validate all targets without resolving SRV records
-    if (uri.toLowerCase().includes("mongodb+srv://")) return false;
-
-    // If the host is a bare IPv4 or IPv6 address, check all restricted ranges
-    if (net.isIPv4(host) || net.isIPv6(host)) {
-      return !isRestrictedIP(host);
-    }
-
-    // For hostnames, perform DNS resolution to check both A and AAAA records
-    const [ipv4Result, ipv6Result] = await Promise.allSettled([
-      dns.resolve4(host),
-      dns.resolve6(host),
-    ]);
-
-    const resolved = [
-      ...(ipv4Result.status === "fulfilled" ? ipv4Result.value : []),
-      ...(ipv6Result.status === "fulfilled" ? ipv6Result.value : []),
-    ];
-
-    // If no addresses resolved, treat as unsafe
-    if (resolved.length === 0) return false;
-
-    // Check all resolved addresses for restricted ranges
-    if (resolved.some((addr) => isRestrictedIP(addr))) return false;
-
-    return true;
-  } catch (e) {
-    return false;
-  }
-};
-
 module.exports.updateExternalConfig = async (req, res) => {
   try {
     const { projectId } = req.params;
@@ -726,48 +609,66 @@ module.exports.updateExternalConfig = async (req, res) => {
 
       let dashboardIp = null;
       let publicApiIp = null;
+      let tempConn = null;
 
       try {
-        dashboardIp = await getPublicIp();
-        
-        // 1. Test local connection (Dashboard API)
-        const tempConn = mongoose.createConnection(dbUri, {
-          serverSelectionTimeoutMS: 5000,
-        });
-        await tempConn.asPromise();
-        await tempConn.close();
+        await Promise.race([
+          new Promise((_, reject) => setTimeout(() => reject(new Error("Overall verification timeout exceeded")), 9500)),
+          (async () => {
+            // 1. Test local connection (Dashboard API)
+            tempConn = mongoose.createConnection(dbUri, {
+              serverSelectionTimeoutMS: 5000,
+            });
+            await tempConn.asPromise();
 
-        // 2. Test remote connection (Public API) if PUBLIC_API_URL is configured
-        if (process.env.PUBLIC_API_URL && process.env.INTERNAL_SECRET) {
-            const publicApiRes = await axios.post(`${process.env.PUBLIC_API_URL}/api/internal/test-db`, 
+            // 2. Test remote connection (Public API)
+            if (!process.env.PUBLIC_API_URL || !process.env.INTERNAL_SECRET) {
+              throw new Error("Missing PUBLIC_API_URL or INTERNAL_SECRET for DB verification.");
+            }
+            
+            await axios.post(`${process.env.PUBLIC_API_URL}/api/internal/test-db`, 
                 { dbUri },
                 { headers: { 'x-internal-secret': process.env.INTERNAL_SECRET }, timeout: 8000 }
             );
-            // If it didn't throw, it succeeded.
-        } else {
-            console.warn("Skipping Public API DB verification because PUBLIC_API_URL or INTERNAL_SECRET is missing.");
-        }
-
+          })()
+        ]);
       } catch (connErr) {
         console.error("Verification Connection Failed:", connErr.message);
         let errorMsg = "Could not connect to the provided MongoDB URI.";
 
+        try {
+          dashboardIp = await getPublicIp();
+        } catch (ipErr) {
+          console.error("Failed to fetch Dashboard API IP:", ipErr.message);
+        }
+        
         // If the error came from Axios (Public API verification failed)
-        if (connErr.response && connErr.response.data && !connErr.response.data.success) {
-            errorMsg = connErr.response.data.message;
-            if (connErr.response.data.serverIp) {
-                publicApiIp = connErr.response.data.serverIp;
+        if (connErr.response) {
+            if (connErr.response.data && connErr.response.data.success === false && connErr.response.status === 400) {
+              // It's a database-URI-specific verification failure
+              errorMsg = connErr.response.data.message;
+              if (connErr.response.data.data && connErr.response.data.data.serverIp) {
+                  publicApiIp = connErr.response.data.data.serverIp;
+              } else if (connErr.response.data.serverIp) {
+                  publicApiIp = connErr.response.data.serverIp;
+              }
+            } else {
+              // Infrastructure error
+              errorMsg = "Public API verification failed.";
             }
         } else if (
           connErr.message.includes("Server selection timed out") ||
-          connErr.message.includes("Could not connect")
+          connErr.message.includes("Could not connect") ||
+          connErr.message.includes("Overall verification timeout exceeded")
         ) {
           // Local failure
           errorMsg = `Access Denied: Please whitelist Server IPs in MongoDB Atlas.`;
+        } else if (connErr.message.includes("Missing PUBLIC_API_URL")) {
+          return res.status(500).json({ success: false, data: {}, message: "Server misconfiguration: DB verification failed." });
         }
 
         // Fetch Public API IP if we don't have it yet, to show both in the error message
-        if (!publicApiIp && process.env.PUBLIC_API_URL) {
+        if (!publicApiIp && process.env.PUBLIC_API_URL && errorMsg.includes("whitelist Server IPs")) {
             try {
                 const ipRes = await axios.get(`${process.env.PUBLIC_API_URL}/api/server-ip`, { timeout: 3000 });
                 if (ipRes.data && ipRes.data.ip) publicApiIp = ipRes.data.ip;
@@ -776,12 +677,16 @@ module.exports.updateExternalConfig = async (req, res) => {
             }
         }
 
-        if (dashboardIp || publicApiIp) {
+        if (errorMsg.includes("whitelist Server IPs") && (dashboardIp || publicApiIp)) {
             const ips = [dashboardIp, publicApiIp].filter(Boolean).join(", ");
             errorMsg = `Access Denied: Please whitelist Server IPs [${ips}] in MongoDB Atlas.`;
         }
 
         return res.status(400).json({ success: false, data: {}, message: errorMsg });
+      } finally {
+        if (tempConn) {
+          await tempConn.close();
+        }
       }
     }
 

apps/public-api/src/app.js

@@ -79,6 +79,9 @@ app.use('/api/storage', limiter, logger, storageRoute);
 app.use('/api/mail', limiter, logger, mailRoute);
 app.use('/api/health', limiter, logger, healthRoute);
 
+// IMPORTANT: Restrict the /api/internal route exposed below to trusted internal network sources 
+// at the infrastructure layer (e.g., VPC, Security Groups, or ingress rules).
+// Ensure this path is unreachable from the public internet.
 const internalRoute = require('./routes/internal');
 app.use('/api/internal', internalRoute);
 

apps/public-api/src/routes/internal.js

@@ -1,19 +1,25 @@
 const express = require('express');
 const mongoose = require('mongoose');
-const { getPublicIp } = require('@urbackend/common');
+const crypto = require('crypto');
+const { getPublicIp, isSafeUri } = require('@urbackend/common');
 const router = express.Router();
 
 // Middleware to protect internal routes
 const internalAuth = (req, res, next) => {
     const secret = process.env.INTERNAL_SECRET;
     if (!secret) {
         console.error("INTERNAL_SECRET is not configured on Public API");
-        return res.status(500).json({ success: false, message: "Server misconfiguration" });
+        return res.status(500).json({ success: false, data: {}, message: "Server misconfiguration" });
     }
 
-    const providedSecret = req.headers['x-internal-secret'];
-    if (!providedSecret || providedSecret !== secret) {
-        return res.status(403).json({ success: false, message: "Forbidden: Invalid internal secret" });
+    const providedSecret = req.headers['x-internal-secret'] || '';
+    
+    // Convert both to buffers of the same length to use timingSafeEqual
+    const secretBuffer = Buffer.from(secret, 'utf8');
+    const providedBuffer = Buffer.from(providedSecret, 'utf8');
+    
+    if (secretBuffer.length !== providedBuffer.length || !crypto.timingSafeEqual(secretBuffer, providedBuffer)) {
+        return res.status(403).json({ success: false, data: {}, message: "Forbidden: Invalid internal secret" });
     }
 
     next();
@@ -22,17 +28,25 @@ const internalAuth = (req, res, next) => {
 router.post('/test-db', internalAuth, async (req, res) => {
     const { dbUri } = req.body;
     if (!dbUri) {
-        return res.status(400).json({ success: false, message: "dbUri is required" });
+        return res.status(400).json({ success: false, data: {}, message: "dbUri is required" });
+    }
+    
+    if (!(await isSafeUri(dbUri))) {
+        return res.status(400).json({
+            success: false,
+            data: {},
+            message: "DB URI is pointing to a restricted host, internal network, or unsupported URI format.",
+        });
     }
 
     console.log("[Internal] Verifying connection for external DB...");
+    let tempConn = null;
     try {
-        const tempConn = mongoose.createConnection(dbUri, {
+        tempConn = mongoose.createConnection(dbUri, {
             serverSelectionTimeoutMS: 5000,
         });
         await tempConn.asPromise();
-        await tempConn.close();
-        return res.status(200).json({ success: true, message: "Connection verified" });
+        return res.status(200).json({ success: true, data: {}, message: "Connection verified" });
     } catch (connErr) {
         console.error("[Internal] Verification Connection Failed:", connErr.message);
         let errorMsg = "Could not connect to the provided MongoDB URI.";
@@ -42,11 +56,19 @@ router.post('/test-db', internalAuth, async (req, res) => {
             connErr.message.includes("Server selection timed out") ||
             connErr.message.includes("Could not connect")
         ) {
-            serverIp = await getPublicIp();
-            errorMsg = `Access Denied: Please whitelist Server IP [${serverIp}] in MongoDB Atlas.`;
+            try {
+                serverIp = await getPublicIp();
+                errorMsg = `Access Denied: Please whitelist Server IP [${serverIp}] in MongoDB Atlas.`;
+            } catch (ipErr) {
+                console.error("Failed to fetch Public API IP:", ipErr.message);
+            }
         }
 
-        return res.status(400).json({ success: false, message: errorMsg, serverIp });
+        return res.status(400).json({ success: false, data: { serverIp }, message: errorMsg });
+    } finally {
+        if (tempConn) {
+            await tempConn.close();
+        }
     }
 });
 

apps/web-dashboard/src/components/Settings/DatabaseConfigForm.jsx

@@ -21,9 +21,17 @@ export default function DatabaseConfigForm({ project, projectId, onProjectUpdate
         const fetchIp = async () => {
             try { 
                 const { PUBLIC_API_URL } = await import('../../config');
+                const controller = new AbortController();
+                const timeoutId = setTimeout(() => controller.abort(), 3000);
+
                 const [res1, res2] = await Promise.allSettled([
                     api.get(`/api/server-ip`),
-                    fetch(`${PUBLIC_API_URL}/api/server-ip`).then(r => r.json())
+                    fetch(`${PUBLIC_API_URL}/api/server-ip`, { signal: controller.signal })
+                        .then(r => {
+                            if (!r.ok) throw new Error("Public API unresponsive");
+                            return r.json();
+                        })
+                        .finally(() => clearTimeout(timeoutId))
                 ]);
 
                 const ips = [];

packages/common/src/index.js

@@ -107,7 +107,7 @@ const {
   clearCompiledModel,
   createUniqueIndexes,
 } = require("./utils/injectModel");
-const { getPublicIp } = require("./utils/network");
+const { getPublicIp, isSafeUri } = require("./utils/network");
 const {
   isProjectStorageExternal,
   isProjectDbExternal,
@@ -198,6 +198,7 @@ module.exports = {
   clearCompiledModel,
   createUniqueIndexes,
   getPublicIp,
+  isSafeUri,
   isProjectStorageExternal,
   isProjectDbExternal,
   getBucket,