refactor(security): one DNS resolver for every SSRF guard, checking all addresses

Five independent `dns.lookup` bodies existed — four in apps/sim
(validateUrlWithDNS, the database-host check, MCP domain-check, 1Password
Connect) and one in apps/desktop's agent url-guard. The four in apps/sim were
copy-paste identical, and two properties diverged in ways that mattered:

They classified ONE address. `resolved.find(family === 4) ?? resolved[0]`
picked an address to pin and then judged only that one, so a host publishing
both a public and a private record passed whenever the public record sorted
first. That is record order, not policy, and validateUrlWithDNS alone is reached
from ~70 call sites. Now every address is classified and the IPv4-preferred one
is still what gets returned to pin — the pinning rationale (Happy Eyeballs
fallback is stripped, and a pinned IPv6 address hangs on IPv4-only egress) is
untouched.

They had no deadline. Only the desktop copy bounded the lookup, so a hung
resolver could hold an apps/sim request handler open indefinitely. The shared
helper carries the 5s deadline, the swallowed late rejection, and the always
cleared timer.

`resolveHostAddresses` lands in `@sim/security/dns` as its own subpath, so the
`node:dns` dependency reaches only the servers that import it — apps/realtime
pulls `@sim/security/compare` and nothing else, and the prune graph is unchanged
at 14 workspaces.

Two lookups deliberately stay as they are: `createSsrfGuardedLookup` is a
socket-connect `LookupFunction` that needs raw entries with their family and
already validates every address, and desktop's per-host verdict cache keeps its
own loopback policy on top of the shared resolver.

The localhost carve-out is tightened as a consequence: it applies only when
every record is loopback, so `localhost` that also resolves to the LAN no longer
rides it.

Author: waleedlatif1

apps/desktop/src/main/browser-agent/url-guard.test.ts

@@ -2,6 +2,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockLookup } = vi.hoisted(() => ({ mockLookup: vi.fn() }))
 
+// The real resolveHostAddresses runs; only the resolver under it is mocked, so
+// its deadline and all-addresses behaviour stay covered here.
 vi.mock('node:dns/promises', () => ({
   default: { lookup: mockLookup },
 }))

apps/desktop/src/main/browser-agent/url-guard.ts

@@ -1,5 +1,5 @@
-import dns from 'node:dns/promises'
 import { createLogger } from '@sim/logger'
+import { resolveHostAddresses } from '@sim/security/dns'
 import {
   isIpLiteral,
   isLoopbackIp,
@@ -12,31 +12,6 @@ import { parseHttpUrl } from '@/main/navigation'
 
 const logger = createLogger('BrowserAgentUrlGuard')
 
-/** Hard deadline on the SSRF DNS lookup so a slow/hung resolver can't suspend
- * the check — and the onBeforeRequest callback that awaits it — indefinitely.
- * A timeout rejects, which fails closed (blocks) via the caller's catch. */
-const DNS_TIMEOUT_MS = 5_000
-
-/** dns.lookup bounded by {@link DNS_TIMEOUT_MS}; the timer is always cleared so a
- * won race never leaves a dangling rejection. */
-async function resolveHost(host: string) {
-  const lookup = dns.lookup(host, { all: true, verbatim: true })
-  // If the timeout wins the race the lookup stays pending; swallow its eventual
-  // settlement so a late rejection can't surface as an unhandled rejection.
-  lookup.catch(() => {})
-  let timer: NodeJS.Timeout | undefined
-  try {
-    return await Promise.race([
-      lookup,
-      new Promise<never>((_, reject) => {
-        timer = setTimeout(() => reject(new Error('DNS lookup timed out')), DNS_TIMEOUT_MS)
-      }),
-    ])
-  } finally {
-    clearTimeout(timer)
-  }
-}
-
 export interface UrlGuardResult {
   ok: boolean
   error?: string
@@ -103,8 +78,8 @@ export async function checkAgentUrl(rawUrl: string): Promise<UrlGuardResult> {
   }
 
   try {
-    const resolved = await resolveHost(host)
-    if (resolved.some(({ address }) => isBlockedAddress(address))) {
+    const { addresses } = await resolveHostAddresses(host)
+    if (addresses.some((address) => isBlockedAddress(address))) {
       logger.warn('Blocked agent navigation resolving to private IP', { host })
       return BLOCKED
     }
@@ -163,9 +138,9 @@ const MAX_HOST_VERDICTS = 256
  * request that arrived before the first lookup settled to start its own, and
  * `dns.lookup` is `getaddrinfo` on the libuv threadpool — four slots by
  * default, shared with every `fs` call in the main process. A page naming a few
- * hundred hostnames could then queue hundreds of blocking jobs, each up to
- * {@link DNS_TIMEOUT_MS}, and stall unrelated work like the settings write or
- * the credential vault.
+ * hundred hostnames could then queue hundreds of blocking jobs, each up to the
+ * resolver deadline, and stall unrelated work like the settings write or the
+ * credential vault.
  */
 const hostVerdicts = new Map<string, { verdict: Promise<boolean>; expiry: number }>()
 
@@ -227,9 +202,9 @@ export async function isBlockedSubresourceUrl(rawUrl: string): Promise<boolean>
   const cached = hostVerdicts.get(host)
   if (cached && Date.now() < cached.expiry) return cached.verdict
 
-  const verdict = resolveHost(host)
-    .then((resolved) => {
-      const blocked = resolved.some(({ address }) => isBlockedAddress(address))
+  const verdict = resolveHostAddresses(host)
+    .then(({ addresses }) => {
+      const blocked = addresses.some((address) => isBlockedAddress(address))
       if (blocked) {
         logger.warn('Blocked agent subresource resolving to private IP', { host })
       }

apps/sim/app/api/tools/onepassword/utils.ts

@@ -1,4 +1,3 @@
-import dns from 'dns/promises'
 import type {
   FileAttributes,
   Item,
@@ -12,6 +11,7 @@ import type {
   Website,
 } from '@1password/sdk'
 import { createLogger } from '@sim/logger'
+import { resolveHostAddresses } from '@sim/security/dns'
 import { isPrivateIp, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import { toError } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
@@ -312,12 +312,12 @@ export async function validateConnectServerUrl(serverUrl: string): Promise<strin
     return clean
   }
 
+  let addresses: string[]
   let address: string
   try {
-    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
-    // on IPv4-only egress (e.g. AWS NAT gateways).
-    const resolved = await dns.lookup(clean, { all: true, verbatim: true })
-    address = (resolved.find((entry) => entry.family === 4) ?? resolved[0]).address
+    const resolved = await resolveHostAddresses(clean)
+    addresses = resolved.addresses
+    address = resolved.preferred
   } catch (error) {
     connectLogger.warn('DNS lookup failed for 1Password Connect server URL', {
       hostname: clean,
@@ -326,7 +326,11 @@ export async function validateConnectServerUrl(serverUrl: string): Promise<strin
     throw new Error('1Password server URL hostname could not be resolved')
   }
 
-  assertConnectIpAllowed(address, clean)
+  // Asserted on every address, pinned on the IPv4-preferred one: a host with both
+  // a public and a private record must not pass on record order alone.
+  for (const candidate of addresses) {
+    assertConnectIpAllowed(candidate, clean)
+  }
   return address
 }
 

apps/sim/lib/core/security/input-validation.server.test.ts

@@ -0,0 +1,75 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockResolve } = vi.hoisted(() => ({ mockResolve: vi.fn() }))
+
+vi.mock('@sim/security/dns', () => ({
+  resolveHostAddresses: mockResolve,
+}))
+
+vi.mock('@/lib/core/config/env-flags', () => ({
+  isHosted: false,
+  isPrivateDatabaseHostsAllowed: false,
+  getProxyUrl: () => undefined,
+}))
+
+import { validateUrlWithDNS } from '@/lib/core/security/input-validation.server'
+
+/** Shapes a resolver answer the way `resolveHostAddresses` does. */
+function resolved(addresses: string[]) {
+  return { addresses, preferred: addresses[0] }
+}
+
+describe('validateUrlWithDNS address classification', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('rejects a host that also publishes a private record', async () => {
+    // The gap this closes: only one address used to be classified, so a host
+    // publishing both got through whenever the public record sorted first.
+    mockResolve.mockResolvedValue(resolved(['93.184.216.34', '10.0.0.5']))
+
+    const result = await validateUrlWithDNS('https://mixed.example/api')
+
+    expect(result.isValid).toBe(false)
+    expect(result.error).toContain('blocked IP address')
+  })
+
+  it('rejects it regardless of which record comes first', async () => {
+    mockResolve.mockResolvedValue(resolved(['10.0.0.5', '93.184.216.34']))
+
+    expect((await validateUrlWithDNS('https://mixed.example/api')).isValid).toBe(false)
+  })
+
+  it('accepts a host whose every record is public, pinning the preferred one', async () => {
+    mockResolve.mockResolvedValue(resolved(['93.184.216.34', '93.184.216.35']))
+
+    const result = await validateUrlWithDNS('https://example.com/api')
+
+    expect(result.isValid).toBe(true)
+    expect(result.resolvedIP).toBe('93.184.216.34')
+  })
+
+  it('keeps the self-hosted localhost carve-out when every record is loopback', async () => {
+    mockResolve.mockResolvedValue(resolved(['127.0.0.1', '::1']))
+
+    expect((await validateUrlWithDNS('https://localhost/api')).isValid).toBe(true)
+  })
+
+  it('denies localhost the carve-out when it also resolves off-loopback', async () => {
+    // `localhost` pointing at the LAN as well is not the case the carve-out was
+    // written for, and riding it there would reach another machine.
+    mockResolve.mockResolvedValue(resolved(['127.0.0.1', '10.0.0.5']))
+
+    expect((await validateUrlWithDNS('https://localhost/api')).isValid).toBe(false)
+  })
+
+  it('reports an unresolvable host rather than treating it as public', async () => {
+    mockResolve.mockRejectedValue(new Error('ENOTFOUND'))
+
+    expect((await validateUrlWithDNS('https://missing.example/api')).isValid).toBe(false)
+  })
+})

apps/sim/lib/core/security/input-validation.server.ts

@@ -1,10 +1,11 @@
+import dns from 'node:dns/promises'
 import { Readable } from 'node:stream'
 import zlib from 'node:zlib'
-import dns from 'dns/promises'
 import http from 'http'
 import https from 'https'
 import type { LookupFunction } from 'net'
 import { createLogger } from '@sim/logger'
+import { resolveHostAddresses } from '@sim/security/dns'
 import { isLoopbackIp, isPrivateIp, isPrivateIpHost, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import { toError } from '@sim/utils/errors'
 import { omit } from '@sim/utils/object'
@@ -65,19 +66,23 @@ export async function validateUrlWithDNS(
   const isLocalhost = cleanHostname === 'localhost' || isLoopbackIp(cleanHostname)
 
   try {
-    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
-    // on IPv4-only egress (e.g. AWS NAT gateways) — still-pinned consumers (providers, SSO,
-    // A2A) depend on this ordering.
-    const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
-    const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0]
-
-    const resolvedIsLoopback = isLoopbackIp(address)
-
-    if (isPrivateIp(address) && !(isLocalhost && resolvedIsLoopback && !isHosted)) {
+    // Every address is classified, but only the IPv4-preferred one is returned to
+    // pin: checking a single address let a host publishing both a public and a
+    // private record through whenever the public one sorted first, which is
+    // record order rather than policy.
+    const { addresses, preferred } = await resolveHostAddresses(cleanHostname)
+    const blocked = addresses.filter((address) => isPrivateIp(address))
+
+    // The localhost carve-out still applies only when every address is loopback,
+    // so `localhost` with an extra RFC1918 record does not ride it.
+    if (
+      blocked.length > 0 &&
+      !(isLocalhost && !isHosted && blocked.every((address) => isLoopbackIp(address)))
+    ) {
       logger.warn('URL resolves to blocked IP address', {
         paramName,
         hostname,
-        resolvedIP: address,
+        resolvedIP: blocked[0],
       })
       return {
         isValid: false,
@@ -87,7 +92,7 @@ export async function validateUrlWithDNS(
 
     return {
       isValid: true,
-      resolvedIP: address,
+      resolvedIP: preferred,
       originalHostname: hostname,
     }
   } catch (error) {
@@ -206,16 +211,15 @@ export async function validateDatabaseHost(
   }
 
   try {
-    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
-    // on IPv4-only egress (e.g. AWS NAT gateways).
-    const resolved = await dns.lookup(cleanHost, { all: true, verbatim: true })
-    const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0]
+    const { addresses, preferred } = await resolveHostAddresses(cleanHost)
+    const address = preferred
+    const blockedAddress = addresses.find((candidate) => isPrivateIp(candidate))
 
-    if (isPrivateIp(address) && !isPrivateDatabaseHostsAllowed) {
+    if (blockedAddress !== undefined && !isPrivateDatabaseHostsAllowed) {
       logger.warn('Database host resolves to blocked IP address', {
         paramName,
         hostname: host,
-        resolvedIP: address,
+        resolvedIP: blockedAddress,
       })
       return {
         isValid: false,

apps/sim/lib/mcp/domain-check.ts

@@ -1,5 +1,5 @@
-import dns from 'dns/promises'
 import { createLogger } from '@sim/logger'
+import { resolveHostAddresses } from '@sim/security/dns'
 import { isIpLiteral, isLoopbackIp, isPrivateIp, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import { toError } from '@sim/utils/errors'
 import { getAllowedMcpDomainsFromEnv, isHosted } from '@/lib/core/config/env-flags'
@@ -172,12 +172,12 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise<st
     return cleanHostname
   }
 
+  let addresses: string[]
   let address: string
   try {
-    // Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address
-    // (which `verbatim` returns first for dual-stack hosts) hangs on IPv4-only egress.
-    const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
-    address = (resolved.find((entry) => entry.family === 4) ?? resolved[0]).address
+    const resolved = await resolveHostAddresses(cleanHostname)
+    addresses = resolved.addresses
+    address = resolved.preferred
   } catch (error) {
     logger.warn('DNS lookup failed for MCP server URL', {
       hostname,
@@ -186,20 +186,25 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise<st
     throw new McpDnsResolutionError(cleanHostname)
   }
 
-  if (isLoopbackIp(address)) {
-    if (isHosted) {
-      logger.warn('MCP server URL resolves to loopback address', {
+  // Every address is judged, not just the pinned one: a host publishing both a
+  // public and a private record would otherwise pass on record order alone. The
+  // pin stays on the IPv4-preferred address, which is what callers connect to.
+  for (const candidate of addresses) {
+    if (isLoopbackIp(candidate)) {
+      if (isHosted) {
+        logger.warn('MCP server URL resolves to loopback address', {
+          hostname,
+          resolvedIP: candidate,
+        })
+        throw new McpSsrfError('MCP server URL resolves to a loopback address')
+      }
+    } else if (isPrivateIp(candidate)) {
+      logger.warn('MCP server URL resolves to blocked IP address', {
         hostname,
-        resolvedIP: address,
+        resolvedIP: candidate,
       })
-      throw new McpSsrfError('MCP server URL resolves to a loopback address')
+      throw new McpSsrfError('MCP server URL resolves to a blocked IP address')
     }
-  } else if (isPrivateIp(address)) {
-    logger.warn('MCP server URL resolves to blocked IP address', {
-      hostname,
-      resolvedIP: address,
-    })
-    throw new McpSsrfError('MCP server URL resolves to a blocked IP address')
   }
 
   return address

packages/security/package.json

@@ -14,6 +14,10 @@
       "types": "./src/compare.ts",
       "default": "./src/compare.ts"
     },
+    "./dns": {
+      "types": "./src/dns.ts",
+      "default": "./src/dns.ts"
+    },
     "./encryption": {
       "types": "./src/encryption.ts",
       "default": "./src/encryption.ts"