Make sure a Url is safe to call from your service

isSafeUrl.js

import hostnameIsPrivate from "hostname-is-private";
import { promisify } from "util";

const isSafeUrl = async (untrustedUrl, protocols = ["http", "https"]) => {
  try {
    // will throw error on malfomed url
    const url = new URL(untrustedUrl);

    // no protocol, no fun
    if (!url.protocol) return false;

    // make sure the protocol is allowed, no file://, ftp:// etc
    if (
      !protocols.filter(
        (p) => `${p.toLowerCase()}:` == url.protocol.toLowerCase()
      ).length
    ) {
      return false;
    }

    // here it gets interesting, we need to check if the hostname exists,
    // is reachable, and is not private. We need especially to be sure it
    // won't resolve to localhost :-))

    const notAllowed = await promisify(
      hostnameIsPrivate.isPrivateIncludingPublicIp
    )(url.hostname);
    if (notAllowed) {
      throw new Error(`Url "${url.hostname} is not allowed`);
    }
    return true;
  } catch (err) {
    console.error(err);
    return false;
  }
};