register

1import t from "ava";
2import fs from "fs-extra";
3import path from "path";
4 
5import disallowedCNAMEs from "../util/disallowed-cnames.json" with { type: "json" };
6 
7const validRecordTypes = new Set(["A", "AAAA", "CAA", "CNAME", "DS", "MX", "NS", "SRV", "TLSA", "TXT", "URL"]);
8const hostnameRegex = /^(?=.{1,253}$)(?:(?:[_a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)\.)+[a-zA-Z]{2,63}$/;
9const ipv4Regex = /^(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/;
10const ipv6Regex =
11    /^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$|^::(?:[0-9a-fA-F]{1,4}:){0,6}[0-9a-fA-F]{1,4}$|^(?:[0-9a-fA-F]{1,4}:){1,7}:$|^(?:[0-9a-fA-F]{1,4}:){0,6}::(?:[0-9a-fA-F]{1,4}:){0,5}[0-9a-fA-F]{1,4}$/;
12 
13const domainsPath = path.resolve("domains");
14const files = fs.readdirSync(domainsPath).filter((file) => file.endsWith(".json"));
15 
16const domainCache = {};
17 
18function getDomainData(file) {
19    if (domainCache[file]) {
20        return domainCache[file];
21    }
22 
23    try {
24        const data = fs.readJsonSync(path.join(domainsPath, file));
25        domainCache[file] = data;
26        return data;
27    } catch (error) {
28        throw new Error(`Failed to read JSON for ${file}: ${error.message}`);
29    }
30}
31 
32function expandIPv6(ip) {
33    let segments = ip.split(":");
34    const emptyIndex = segments.indexOf("");
35 
36    if (emptyIndex !== -1) {
37        const nonEmptySegments = segments.filter((seg) => seg !== "");
38        const missingSegments = 8 - nonEmptySegments.length;
39 
40        segments = [
41            ...nonEmptySegments.slice(0, emptyIndex),
42            ...Array(missingSegments).fill("0000"),
43            ...nonEmptySegments.slice(emptyIndex)
44        ];
45    }
46 
47    return segments.map((segment) => segment.padStart(4, "0")).join(":");
48}
49 
50function validateIPv4(ip, proxied) {
51    const parts = ip.split(".").map(Number);
52 
53    if (parts.length !== 4 || parts.some((part) => isNaN(part) || part < 0 || part > 255)) return false;
54    if (ip === "192.0.2.1" && proxied) return true;
55 
56    return !(
57        parts[0] === 10 ||
58        (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) ||
59        (parts[0] === 192 && parts[1] === 168) ||
60        (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127) ||
61        (parts[0] === 169 && parts[1] === 254) ||
62        (parts[0] === 192 && parts[1] === 0 && parts[2] === 0) ||
63        (parts[0] === 192 && parts[1] === 0 && parts[2] === 2) ||
64        (parts[0] === 198 && parts[1] === 18) ||
65        (parts[0] === 198 && parts[1] === 51 && parts[2] === 100) ||
66        (parts[0] === 203 && parts[1] === 0 && parts[2] === 113) ||
67        parts[0] >= 224
68    );
69}
70 
71function validateIPv6(ip) {
72    return !(
73        ip.toLowerCase().startsWith("fc") ||
74        ip.toLowerCase().startsWith("fd") ||
75        ip.toLowerCase().startsWith("fe80") ||
76        ip.toLowerCase().startsWith("::1") ||
77        ip.toLowerCase().startsWith("2001:db8")
78    );
79}
80 
81function validateRecordType(recordType) {
82    return validRecordTypes.has(recordType);
83}
84 
85function isValidHostname(hostname) {
86    return hostnameRegex.test(hostname);
87}
88 
89function isValidHexadecimal(value) {
90    return /^[0-9a-fA-F]+$/.test(value);
91}
92 
93function validateRecordValues(t, data, file) {
94    const subdomain = file.replace(/\.json$/, "");
95 
96    Object.entries(data.records).forEach(([key, value]) => {
97        // General validation for arrays
98        if (["A", "AAAA", "MX", "NS"].includes(key)) {
99            t.true(Array.isArray(value), `${file}: Record value for ${key} should be an array`);
100 
101            value.forEach((record, idx) => {
102                t.true(
103                    typeof record === "string" || typeof record === "object",
104                    `${file}: Record value for ${key} should be a string or an object at index ${idx}`
105                );
106 
107                if (key === "A") {
108                    t.true(ipv4Regex.test(record), `${file}: Invalid IPv4 address for ${key} at index ${idx}`);
109                    t.true(
110                        validateIPv4(record, data.proxied),
111                        `${file}: Invalid IPv4 address for ${key} at index ${idx}`
112                    );
113                } else if (key === "AAAA") {
114                    const expandedIPv6 = expandIPv6(record);
115                    t.true(ipv6Regex.test(expandedIPv6), `${file}: Invalid IPv6 address for ${key} at index ${idx}`);
116                    t.true(validateIPv6(expandedIPv6), `${file}: Invalid IPv6 address for ${key} at index ${idx}`);
117                } else if (key === "MX") {
118                    t.true(
119                        typeof record === "object" || typeof record === "string",
120                        `${file}: Record value for ${key} should be an object or a string at index ${idx}`
121                    );
122 
123                    if (typeof record === "string") {
124                        t.true(isValidHostname(record), `${file}: Invalid hostname for ${key} at index ${idx}`);
125                    } else {
126                        t.true(isValidHostname(record.target), `${file}: Invalid target for ${key} at index ${idx}`);
127                        t.true(
128                            Number.isInteger(record.priority) && record.priority >= 0 && record.priority <= 65535,
129                            `${file}: Invalid priority for ${key} at index ${idx}`
130                        );
131                    }
132                } else if (key === "NS") {
133                    t.true(isValidHostname(record), `${file}: Invalid hostname for ${key} at index ${idx}`);
134                }
135            });
136        }
137 
138        // CNAME and URL validations
139        if (["CNAME", "URL"].includes(key)) {
140            t.true(typeof value === "string", `${file}: Record value for ${key} should be a string`);
141 
142            if (key === "CNAME") {
143                t.true(isValidHostname(value), `${file}: Invalid hostname for ${key}`);
144                t.true(value !== `${subdomain}.is-a.dev`, `${file}: ${key} cannot point to itself`);
145                t.true(value !== "is-a.dev", `${file}: ${key} cannot point to is-a.dev`);
146 
147                for (const disallowed of disallowedCNAMEs) {
148                    if (disallowed.startsWith(".")) {
149                        t.false(value.endsWith(disallowed), `${file}: ${key} cannot end with ${disallowed}`);
150                    } else {
151                        t.false(value === disallowed, `${file}: ${key} cannot be ${disallowed}`);
152                    }
153                }
154            } else if (key === "URL") {
155                t.true(
156                    value.startsWith("http://") || value.startsWith("https://"),
157                    `${file}: Record value for ${key} must start with http:// or https://`
158                );
159                t.notThrows(() => new URL(value), `${file}: Invalid URL for ${key}`);
160 
161                // Check for self-referencing redirects
162                const urlHost = new URL(value).host;
163                t.false(urlHost === `${subdomain}.is-a.dev`, `${file}: ${key} cannot point to itself`);
164            }
165        }
166 
167        // CAA, DS, SRV, TLSA validations
168        if (["CAA", "DS", "SRV", "TLSA"].includes(key)) {
169            t.true(Array.isArray(value), `${file}: Record value for ${key} should be an array`);
170 
171            value.forEach((record, idx) => {
172                t.true(
173                    typeof record === "object",
174                    `${file}: Record value for ${key} should be an object at index ${idx}`
175                );
176 
177                if (key === "CAA") {
178                    t.true(
179                        ["issue", "issuewild", "iodef"].includes(record.tag),
180                        `${file}: Invalid tag for ${key} at index ${idx}`
181                    );
182                    t.true(typeof record.value === "string", `${file}: Invalid value for ${key} at index ${idx}`);
183                    t.true(
184                        isValidHostname(record.value) || record.value === ";",
185                        `${file}: Value must be a hostname or semicolon for ${key} at index ${idx}`
186                    );
187                } else if (key === "DS") {
188                    t.true(
189                        Number.isInteger(record.key_tag) && record.key_tag >= 0 && record.key_tag <= 65535,
190                        `${file}: Invalid key_tag for ${key} at index ${idx}`
191                    );
192                    t.true(
193                        Number.isInteger(record.algorithm) && record.algorithm >= 0 && record.algorithm <= 255,
194                        `${file}: Invalid algorithm for ${key} at index ${idx}`
195                    );
196                    t.true(
197                        Number.isInteger(record.digest_type) && record.digest_type >= 0 && record.digest_type <= 255,
198                        `${file}: Invalid digest_type for ${key} at index ${idx}`
199                    );
200                    t.true(isValidHexadecimal(record.digest), `${file}: Invalid digest for ${key} at index ${idx}`);
201                } else if (key === "SRV") {
202                    t.true(
203                        Number.isInteger(record.priority) && record.priority >= 0 && record.priority <= 65535,
204                        `${file}: Invalid priority for ${key} at index ${idx}`
205                    );
206                    t.true(
207                        Number.isInteger(record.weight) && record.weight >= 0 && record.weight <= 65535,
208                        `${file}: Invalid weight for ${key} at index ${idx}`
209                    );
210                    t.true(
211                        Number.isInteger(record.port) && record.port >= 0 && record.port <= 65535,
212                        `${file}: Invalid port for ${key} at index ${idx}`
213                    );
214                    t.true(isValidHostname(record.target), `${file}: Invalid target for ${key} at index ${idx}`);
215                } else if (key === "TLSA") {
216                    t.true(
217                        Number.isInteger(record.usage) && record.usage >= 0 && record.usage <= 255,
218                        `${file}: Invalid usage for ${key} at index ${idx}`
219                    );
220                    t.true(
221                        Number.isInteger(record.selector) && record.selector >= 0 && record.selector <= 255,
222                        `${file}: Invalid selector for ${key} at index ${idx}`
223                    );
224                    t.true(
225                        Number.isInteger(record.matching_type) && record.matching_type >= 0 && record.matching_type <= 255,
226                        `${file}: Invalid matching_type for ${key} at index ${idx}`
227                    );
228                    t.true(
229                        isValidHexadecimal(record.certificate),
230                        `${file}: Invalid certificate for ${key} at index ${idx}`
231                    );
232                }
233            });
234        }
235 
236        // TXT validation
237        if (key === "TXT") {
238            const values = Array.isArray(value) ? value : [value];
239            values.forEach((record, idx) => {
240                t.true(typeof record === "string", `${file}: TXT record value should be a string at index ${idx}`);
241            });
242        }
243    });
244 
245    if (data.redirect_config) {
246        const customPaths = Object.keys(data.redirect_config.custom_paths || {});
247        const pathRegex = /^\/[a-zA-Z0-9\-_\.\/]+(?<!\/)$/;
248 
249        customPaths.forEach((customPath, idx) => {
250            const customRedirectURL = data.redirect_config.custom_paths[customPath];
251            const urlMessage = `${file}: Custom path in redirect_config`;
252 
253            // Validate the custom path
254            t.true(
255                pathRegex.test(customPath),
256                `${urlMessage} must start with a slash, contain only alphanumeric characters, hyphens, underscores, periods, and slashes, and cannot end with a slash at index ${idx}`
257            );
258            t.true(
259                customPath.length >= 2 && customPath.length <= 255,
260                `${urlMessage} should be 2-255 characters long at index ${idx}`
261            );
262 
263            // Validate the redirect URL
264            t.true(
265                data.records.URL !== customRedirectURL,
266                `${urlMessage} should be different from the URL record at index ${idx}`
267            );
268            t.true(
269                customRedirectURL.startsWith("http://") || customRedirectURL.startsWith("https://"),
270                `${urlMessage} must start with http:// or https:// at index ${idx}`
271            );
272            t.notThrows(() => new URL(customRedirectURL), `${urlMessage} contains an invalid URL at index ${idx}`);
273 
274            // Check for self-referencing redirects
275            const urlHost = new URL(customRedirectURL).host;
276            t.false(urlHost === `${subdomain}.is-a.dev`, `${urlMessage} cannot point to itself at index ${idx}`);
277        });
278    }
279}
280 
281t("All files should have valid records", (t) => {
282    files.forEach((file) => {
283        const data = getDomainData(file);
284        const recordKeys = Object.keys(data.records);
285 
286        recordKeys.forEach((key) => {
287            t.true(validateRecordType(key), `${file}: Invalid record type: ${key}`);
288        });
289 
290        // Record type combinations validation
291        if (recordKeys.includes("CNAME")) {
292            if (!data.proxied) {
293                t.is(recordKeys.length, 1, `${file}: CNAME records cannot be combined with other records unless proxied`);
294            } else {
295                t.true(!recordKeys.includes("A") && !recordKeys.includes("AAAA"), `${file}: CNAME records cannot be combined with A or AAAA records`);
296            }
297        }
298        if (recordKeys.includes("NS")) {
299            t.true(
300                recordKeys.length === 1 || (recordKeys.length === 2 && recordKeys.includes("DS")),
301                `${file}: NS records cannot be combined with other records, except for DS records`
302            );
303        }
304        if (recordKeys.includes("DS")) {
305            t.true(recordKeys.includes("NS"), `${file}: DS records must be combined with NS records`);
306        }
307        if (recordKeys.includes("URL")) {
308            t.true(
309                !recordKeys.includes("A") && !recordKeys.includes("AAAA") && !recordKeys.includes("CNAME"),
310                `${file}: URL records cannot be combined with A, AAAA, or CNAME records`
311            );
312        }
313        if (data.redirect_config) {
314            t.true(
315                recordKeys.includes("URL") || data.proxied,
316                `${file}: Redirect config must be combined with a URL record or the domain must be proxied`
317            );
318            if (data.redirect_config.redirect_paths) {
319                t.true(recordKeys.includes("URL"), `${file}: redirect_config.redirect_paths requires a URL record`);
320            }
321        }
322 
323        validateRecordValues(t, data, file);
324    });
325 
326    t.pass();
327});
328 
329t("Root subdomains should have at least one usable record", (t) => {
330    const usableRecordTypes = ["A", "AAAA", "CNAME", "MX", "NS", "URL"];
331 
332    files.forEach((file) => {
333        const subdomain = file.replace(/\.json$/, "");
334        if (subdomain.includes(".") || subdomain.startsWith("_")) return;
335 
336        const data = getDomainData(file);
337        const recordKeys = Object.keys(data.records);
338 
339        t.true(
340            usableRecordTypes.some((record) => recordKeys.includes(record)),
341            `${file}: Root subdomains must have at least one A, AAAA, CNAME, MX, NS, or URL record`
342        );
343    });
344});
345