Use http-proxy-middleware for CORS proxy.

By delegating all proxy functionality to an existing library,
we avoid the need for extra tests and checks on our side.

Author: RubenVerborgh

lib/handlers/proxy.js

@@ -1,85 +1,60 @@
-module.exports = addProxy
+module.exports = addCorsProxyHandler
 
+const proxy = require('http-proxy-middleware')
 const cors = require('cors')
-const http = require('http')
-const https = require('https')
 const debug = require('../debug')
 const url = require('url')
 const isIp = require('is-ip')
 const ipRange = require('ip-range-check')
 const validUrl = require('valid-url')
 
-function addProxy (app, path) {
-  debug.settings('XSS/CORS Proxy listening at /' + path + '?uri={uri}')
-  app.get(
-    path,
-    cors({
-      methods: ['GET'],
-      exposedHeaders: 'Authorization, User, Location, Link, Vary, Last-Modified, Content-Length',
-      maxAge: 1728000,
-      origin: true
-    }),
-    (req, res) => {
-      if (!validUrl.isUri(req.query.uri)) {
-        return res
-          .status(406)
-          .send('The uri passed is not valid')
-      }
-
-      debug.settings('proxy received: ' + req.originalUrl)
-
-      const hostname = url.parse(req.query.uri).hostname
-
-      if (isIp(hostname) && (
-          ipRange(hostname, '10.0.0.0/8') ||
-          ipRange(hostname, '172.16.0.0/12') ||
-          ipRange(hostname, '192.168.0.0/16')
-        )) {
-        return res
-          .status(406)
-          .send('Cannot proxy this IP')
-      }
-      const uri = req.query.uri
-      if (!uri) {
-        return res
-          .status(400)
-          .send('Proxy has no uri param ')
-      }
-
-      debug.settings('Proxy destination URI: ' + uri)
-
-      const protocol = uri.split(':')[0]
-      let request
-      if (protocol === 'http') {
-        request = http.get
-      } else if (protocol === 'https') {
-        request = https.get
-      } else {
-        return res.send(400)
-      }
-
-      // Set the headers and uri of the proxied request
-      const opts = url.parse(uri)
-      opts.headers = req.headers
-      // See https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html
-      delete opts.headers.connection
-      delete opts.headers.host
+const CORS_SETTINGS = {
+  methods: 'GET',
+  exposedHeaders: 'Authorization, User, Location, Link, Vary, Last-Modified, Content-Length',
+  maxAge: 1728000,
+  origin: true
+}
+const PROXY_SETTINGS = {
+  target: 'dynamic',
+  logLevel: 'silent',
+  router: req => req.destination.target,
+  pathRewrite: (path, req) => req.destination.path
+}
+const LOCAL_IP_RANGES = ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16']
 
-      const _req = request(opts, (_res) => {
-        res.status(_res.statusCode)
-        // Set the response with the same header of proxied response
-        Object.keys(_res.headers).forEach((header) => {
-          if (!res.get(header)) {
-            res.setHeader(header.trim(), _res.headers[header])
-          }
-        })
-        _res.pipe(res)
-      })
+// Adds a CORS proxy handler to the application on the given path
+function addCorsProxyHandler (app, path) {
+  const corsHandler = cors(CORS_SETTINGS)
+  const proxyHandler = proxy(PROXY_SETTINGS)
 
-      _req.on('error', (e) => {
-        res.send(500, 'Cannot proxy')
-      })
+  debug.settings(`CORS proxy listening at ${path}?uri={uri}`)
+  app.get(path, extractProxyConfig, corsHandler, proxyHandler)
+}
 
-      _req.end()
-    })
+// Extracts proxy configuration parameters from the request
+function extractProxyConfig (req, res, next) {
+  // Retrieve and validate the destination URL
+  const uri = req.query.uri
+  debug.settings(`Proxy request for ${uri}`)
+  if (!uri) {
+    return res.status(400)
+      .send('Proxy has no uri param ')
+  }
+  if (!validUrl.isUri(uri)) {
+    return res.status(406)
+      .send('The uri passed is not valid')
+  }
+
+  // Ensure the host is not a local IP
+  // TODO: guard against hostnames such as 'localhost' as well
+  const { protocol, host, hostname, path } = url.parse(uri)
+  if (isIp(hostname) && LOCAL_IP_RANGES.some(r => ipRange(hostname, r))) {
+    return res
+      .status(406)
+      .send('Cannot proxy this IP')
+  }
+
+  // Add the proxy configuration to the request
+  req.destination = { path, target: `${protocol}//${host}` }
+  next()
 }

package.json

@@ -46,6 +46,7 @@
     "fs-extra": "^2.1.0",
     "glob": "^7.1.1",
     "handlebars": "^4.0.6",
+    "http-proxy-middleware": "^0.17.4",
     "inquirer": "^1.0.2",
     "ip-range-check": "0.0.1",
     "is-ip": "^1.0.0",