Prevent SSRF on html requests

[bcomnes]

https://github.com/danielcompton/ip-range-check
https://chat.openai.com/c/5066d9e8-e44e-48f2-a442-c8def93b5cbd

Add in redirect chain and then check the resolved IP address to ensure its not on a local network address.

import dns from 'dns'
import ipRangeCheck from 'ip-range-check'
 const requestURL = new URL(url)

    // Check if the hostname resolves to a blocked IP
    const hostname = requestURL.hostname
    const ip = await dns.promises.lookup(hostname)
    if (ipRangeCheck(ip.address, blockedRanges)) {
      throw new Error('Request to private IP addresses is not allowed.')
    }
// Private IP ranges to be blocked
const blockedRanges = [
  "10.0.0.0/8",
  "172.16.0.0/12",
  "192.168.0.0/16",
  "127.0.0.0/8",
  "::1/128",
  "fc00::/7",
  "fe80::/10",
  "0.0.0.0/8",
  "100.64.0.0/10",
  "169.254.0.0/16",
  "192.0.0.0/24",
  "192.0.2.0/24",
  "198.18.0.0/15",
  "198.51.100.0/24",
  "203.0.113.0/24",
  "224.0.0.0/4",
  "240.0.0.0/4",
  "::/128",
  "::ffff:0:0/96",
  "100::/64",
  "2001::/32",
  "2001:db8::/32",
  "2020::/4",
  "3ffe::/16",
  "5f00::/8",
  "600::/3",
];