Defending against SSRF attacks

app.js

const express = require("express");
const axios = require("axios");
const fs = require("fs").promises;
const path = require("path");

const app = express();
const port = 3000;

// Function to fetch private resource
const fetchPrivateResource = async () => {
  try {
    const content = await fs.readFile("data.json", "utf-8");
    return content;
  } catch (error) {
    console.error("Error reading private resource:", error.message);
    throw error;
  }
};

app.get("/fetch", async (req, res) => {
  const url = req.query.url;

  try {
    const response = await axios.get(url);
    const responseData = JSON.stringify(response.data);

    const filename = path.basename(url);
    const textFilePath = path.join(__dirname, "uploads", "upload-data.txt");

    await fs.writeFile(textFilePath, responseData, "utf-8");

    res.send("Upload Successful");
  } catch (error) {
    console.error("Error:", error.message);
    res.status(500).send("Internal Server Error");
  }
});


// Serve uploaded files over the internet
app.get("/uploads/:filename", async (req, res) => {
  const filename = req.params.filename;
  const filePath = path.join(__dirname, "uploads", filename);
  console.log(filePath);

  try {
    // Check if file exists
    await fs.access(filePath);

    // If file exists, send it to the client
    res.sendFile(filePath);
    
  } catch (error) {
    res.status(404).send("File not found: " + error);
  }
});

// middleware to protect admin API
app.use("/admin", async (req, res, next) => {
  const isLocalhost =
    req.hostname === "localhost" || req.hostname === "127.0.0.1";

  if (isLocalhost) {
    next();
  } else {
    res.status(403).send("Forbidden");
  }
});

// Route to access the admin API
app.get("/admin", async (req, res) => {
  try {
    const content = await fetchPrivateResource();
    res.send(content);
  } catch (error) {
    res.status(500).send("Internal Server Error");
  }
});

app.listen(port, () => {
  console.log(`Server is running on http://localhost:${port}`);
});

data.json

{
  "name": "Hamdaan Ali Quatil",
  "password": "violinblackeye"
}