{"id":19162230,"url":"https://github.com/hanover-computing/got-ssrf","last_synced_at":"2025-04-05T21:10:40.688Z","repository":{"id":37784096,"uuid":"399315897","full_name":"hanover-computing/got-ssrf","owner":"hanover-computing","description":"Protect untrusted requests from SSRF","archived":false,"fork":false,"pushed_at":"2025-03-17T12:59:17.000Z","size":798,"stargazers_count":48,"open_issues_count":11,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-29T19:06:42.183Z","etag":null,"topics":["client","got","http","http-client","https","https-client","https-proxy","javascript","nodejs","npm-package","security","ssrf"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hanover-computing.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-08-24T02:55:51.000Z","updated_at":"2025-02-04T21:25:02.000Z","dependencies_parsed_at":"2024-01-31T16:35:00.841Z","dependency_job_id":"fc3f240e-28ff-46ef-a83f-780ee2fb98d1","html_url":"https://github.com/hanover-computing/got-ssrf","commit_stats":{"total_commits":187,"total_committers":5,"mean_commits":37.4,"dds":"0.36898395721925137","last_synced_commit":"dd8e4efeb65bcd0d01b8f4f66eca01e68695e95c"},"previous_names":["janejeon/got-ssrf"],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hanover-computing%2Fgot-ssrf","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hanover-computing%2Fgot-ssrf/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hanover-computing%2Fgot-ssrf/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hanover-computing%2Fgot-ssrf/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hanover-computing","download_url":"https://codeload.github.com/hanover-computing/got-ssrf/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247399885,"owners_count":20932880,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["client","got","http","http-client","https","https-client","https-proxy","javascript","nodejs","npm-package","security","ssrf"],"created_at":"2024-11-09T09:08:24.249Z","updated_at":"2025-04-05T21:10:40.668Z","avatar_url":"https://github.com/hanover-computing.png","language":"TypeScript","readme":"\u003ch1 align=\"center\"\u003eWelcome to got-ssrf 👋\u003c/h1\u003e\n\n[![GitHub Actions](https://github.com/hanover-computing/got-ssrf/actions/workflows/ci.yml/badge.svg)](https://github.com/hanover-computing/got-ssrf/actions/workflows/ci.yml)\n[![codecov](https://codecov.io/gh/hanover-computing/got-ssrf/branch/master/graph/badge.svg)](https://codecov.io/gh/hanover-computing/got-ssrf)\n[![Version](https://img.shields.io/npm/v/got-ssrf)](https://www.npmjs.com/package/got-ssrf)\n[![Downloads](https://img.shields.io/npm/dt/got-ssrf)](https://www.npmjs.com/package/got-ssrf)\n\n\u003e Protect Got requests from SSRF\n\n### 🏠 [Homepage](https://github.com/hanover-computing/got-ssrf)\n\n## Why does this matter?\n\nSSRF is the evil sibling to CSRF that essentially allows RCE against your backends: https://portswigger.net/web-security/ssrf.\n\nThis module automatically rejects all such requests so you can safely use got without even thinking about it.\n\n## Install\n\n```sh\nnpm i got-ssrf\n```\n\n## Usage\n\n\u003e Note that this package is ESM-only; see https://gist.github.com/sindresorhus/a39789f98801d908bbc7ff3ecc99d99c for what to do if you're using CJS (i.e. `require()`).\n\n```js\nimport { gotSsrf } from 'got-ssrf'\n\nawait gotSsrf(url) // automatically filters requests for safety\n```\n\nIf you have any other plugins you want to \"mix\" got-ssrf with, see https://github.com/sindresorhus/got/blob/main/documentation/examples/advanced-creation.js for how to do so. Example:\n\n```js\nimport got from 'got'\nimport { gotSsrf } from 'got-ssrf'\nimport { gotInstance } from 'some-other-got-plugin'\n\nconst merged = got.extend(gotSsrf, gotInstance)\n```\n\n### Security\n\nThis library is tested against a whole host of weird edge cases (a URL is not as straightforward as it seems). To see what behaviours are expected, please see the test suite.\n\nAs this library doesn't parse the URLs itself (but rather relies on got, which relies on the node `URL` module), a good rule of thumb is that whatever you'd expect from the node `URL` module, you can expect of this library as well.\n\nIf you want to disallow \"weird\" URLs (and trust me, there are _many_), as people may try to 'smuggle' hostnames in them (and cause SSRF that may not be caught by the `URL` module), you'll need to do an input validation of the URL (and reject the \"weird\" ones) _before_ passing it into got/got-ssrf.\n\n## Run tests\n\n```sh\nnpm test\n```\n\n## Author\n\n👤 **Jane Jeon \u003cgit@janejeon.com\u003e**\n\n- Website: janejeon.dev\n- Github: [@JaneJeon](https://github.com/JaneJeon)\n\n## 🤝 Contributing\n\nContributions, issues and feature requests are welcome!\u003cbr /\u003eFeel free to check [issues page](https://github.com/JaneJeon/got-csrf/issues).\n\n## Show your support\n\nGive a ⭐️ if this project helped you!\n\n## 📝 License\n\nCopyright © 2023 [Jane Jeon \u003cgit@janejeon.com\u003e](https://github.com/JaneJeon).\u003cbr /\u003e\nThis project is [LGPL-3.0](https://github.com/JaneJeon/got-csrf/blob/master/LICENSE) licensed.\n\nTL;DR: you are free to import and use this library \"as-is\" in your code, without needing to make your code source-available or to license it under the same license as this library; however, if you do change this library and you distribute it (directly or as part of your code consuming this library), please do contribute back any improvements for this library and this library alone.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhanover-computing%2Fgot-ssrf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhanover-computing%2Fgot-ssrf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhanover-computing%2Fgot-ssrf/lists"}