SSRF defense for screenshot APIs

import { lookup } from "node:dns/promises";
import { isIP } from "node:net";

async function validateTarget(raw: string) {
  const url = new URL(raw);
  if (!new Set(["http:", "https:"]).has(url.protocol)) throw new Error("scheme blocked");

  const records = isIP(url.hostname)
    ? [{ address: url.hostname }]
    : await lookup(url.hostname, { all: true, verbatim: true });

  if (records.length === 0 || records.some(({ address }) => isPrivateOrSpecial(address))) {
    throw new Error("destination blocked");
  }
  return { url, addresses: records.map(({ address }) => address) };
}

// Production still needs canonical IP parsing, redirect revalidation,
// DNS pinning and request interception. A regex is not an IP policy.