SSRF-Safe URL Admission

// Admission returns the address the transport MUST connect to.
async function authorize(input: string) {
  const url = new URL(input)
  if (url.protocol !== 'https:') throw new Error('protocol denied')
  const hostname = url.hostname.replace(/^\[|\]$/g, '')
  const family = net.isIP(hostname)
  const answers = family
    ? [{ address: hostname, family }]
    : await dns.promises.lookup(hostname, { all: true, verbatim: true })
  const allowed = answers.filter(({ address }) => isPublicRoutable(normalizeIp(address)))
  if (!allowed.length) throw new Error('destination denied')
  return { url, hostname, ...allowed[crypto.randomInt(allowed.length)] }
}

const target = await authorize(input)
const request = https.request({
  hostname: target.address, family: target.family,
  port: target.url.port || 443,
  path: target.url.pathname + target.url.search,
  headers: { host: target.url.host },
  servername: net.isIP(target.hostname) ? undefined : target.hostname,
  rejectUnauthorized: true, signal: AbortSignal.timeout(2_000),
})
request.end()
// Disable automatic redirects. Re-run authorize() for every Location.
// Enforce a response-byte ceiling before buffering the body.
// A proxy can bypass this pin: enforce the same policy at actual egress.