Only capture hostname when the request is not blocked because of SSRF

[timokoessler]

This change also results in a different behavior when saving hostnames after a redirect using Undici / Fetch. Previously they were ignored, while redirects using the internal http or https module were already added to the list of outgoing hostnames.

[codecov]

Codecov Report

Attention: Patch coverage is 85.33333% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
library/sinks/HTTPRequest.ts	44.44%	5 Missing ⚠️
library/sinks/Undici.ts	68.75%	5 Missing ⚠️
library/sinks/undici/wrapDispatch.ts	90.90%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[hansott]

A bit weird to have an assertion outside a test? Let's move that line?

[hansott]

Looking for a way to avoid the sprinkled onConnectHostname

Easy to forget when adding a new if statement here or there, right?

undici & fetch

const response = await fetch("url")

When response is returned and the fetch call didn't throw, we know the request succeeded, can we maybe hook into the return value and call agent.onConnectHostname(hostname, port); there?

http/https module

We could wrap the on("response", (...) => {}) handler but we should NEVER add it when no response handler is (See #346)

So I think we have no choice to use the DNS lookup indeed, instead of adding the logic in inspectDNSLookupCalls, can we add a separate wrapper for this?

optionObj.lookup = inspectDNSLookupCalls(
      nativeLookup,
      agent,
      module,
      `${module}.request`,
      url,
      stackTraceCallingLocation
    ) as NonNullable<RequestOptions["lookup"]>;

becomes

optionObj.lookup = addHostnameToAgent(
     agent,
     inspectDNSLookupCalls(
      nativeLookup,
      agent,
      module,
      `${module}.request`,
      url,
      stackTraceCallingLocation
    )
);

function addHostnameToAgent(agent: Agent, lookup: Function) {
  return function addHostnameToAgent(...args: unknown[]) {
    // see if DNS lookup succeeded
    
    if (!error) {
      agent.onConnectHostname(hostname, port);
    }
  }
}