Monitor websites uptime using Cloudflare Workers
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112import { isIP } from 'node:net';import { lookup } from 'node:dns/promises';
/** Apply the API's pre-save URL policy; Workers validate again at probe time. */export function assertPublicHttpUrl(value: string): URL { let url: URL; try { url = new URL(value); } catch { throw new UrlPolicyError('invalid_url', 'A valid absolute HTTP(S) URL is required'); } if (url.protocol !== 'http:' && url.protocol !== 'https:') { throw new UrlPolicyError('invalid_scheme', 'URL must use HTTP or HTTPS'); } if (url.username || url.password) { throw new UrlPolicyError('url_credentials', 'URLs with embedded credentials are not allowed'); } if (!url.hostname) { throw new UrlPolicyError('invalid_url', 'URL must include a hostname'); } if (isForbiddenIp(url.hostname)) { throw new UrlPolicyError('forbidden_address', 'URL resolves to a private or reserved address'); } return url;}
export async function assertResolvablePublicHttpUrl(value: string): Promise<URL> { const url = assertPublicHttpUrl(value); if (isIP(url.hostname)) return url; let addresses: { address: string }[]; try { addresses = await lookup(url.hostname, { all: true, verbatim: true }); } catch { throw new UrlPolicyError('dns_unresolved', 'URL hostname could not be resolved'); } if (addresses.length === 0 || addresses.some(({ address }) => isForbiddenIp(address))) { throw new UrlPolicyError('forbidden_address', 'URL resolves to a private or reserved address'); } return url;}
export class UrlPolicyError extends Error { constructor( readonly code: string, message: string, ) { super(message); }}
/** Rejects loopback, link-local, private, CGNAT, documentation, multicast, and reserved ranges. */export function isForbiddenIp(host: string): boolean { const normalized = host.replace(/^\[|\]$/g, '').toLowerCase(); const kind = isIP(normalized); if (kind === 4) { const parts = normalized.split('.').map(Number); if ( parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255) ) return true; const value = parts.reduce((result, part) => (result * 256 + part) >>> 0, 0); return forbiddenIpv4Cidrs.some(([network, prefix]) => inIpv4Cidr(value, network, prefix)); } if (kind === 6) { return ( normalized === '::' || normalized === '::1' || normalized.startsWith('fc') || normalized.startsWith('fd') || normalized.startsWith('fe8') || normalized.startsWith('fe9') || normalized.startsWith('fea') || normalized.startsWith('feb') || normalized.startsWith('ff') || normalized.startsWith('2001:db8') || normalized.startsWith('2001:2:') || normalized.startsWith('100:') || // IPv4-mapped forms can encode a private IPv4 in hexadecimal. The public // use case has no reason to use this representation, so reject all of it. normalized.startsWith('::ffff:') ); } return false;}
const forbiddenIpv4Cidrs = [ ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],] as const;
function inIpv4Cidr(value: number, network: string, prefix: number): boolean { const networkValue = network .split('.') .map(Number) .reduce((result, part) => (result * 256 + part) >>> 0, 0); const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0; return (value & mask) === (networkValue & mask);}