feat: Add configurable proxy for outgoing traffic to prevent SSRF

server/start.sh

@@ -18,7 +18,106 @@ load_secret() {
   fi
 }
 
-if [[ -n "${DATABASE_URL}" ]]; then
+start_outgoing_proxy_if_needed() {
+  # If a custom outgoing proxy is set, do not start internal proxy
+  if [[ -n "${OUTGOING_PROXY:-}" ]]; then
+    return
+  fi
+
+  # Minimum safe defaults
+  if [[ -z "${OUTGOING_BLOCKED_HOSTS+x}" ]]; then
+    OUTGOING_BLOCKED_HOSTS="localhost,postgres"
+  fi
+
+  # If no blocked/allowed rules exist, do not start internal proxy
+  if [[ -z "${OUTGOING_BLOCKED_IPS:-}" && -z "${OUTGOING_BLOCKED_HOSTS:-}" && -z "${OUTGOING_ALLOWED_IPS:-}" && -z "${OUTGOING_ALLOWED_HOSTS:-}" ]]; then
+    return
+  fi
+
+  SQUID_CONF="/tmp/squid.conf"
+  SQUID_PID="/tmp/squid.pid"
+
+  : > "$SQUID_CONF"
+
+  # Basic settings
+  echo "pid_filename $SQUID_PID" >> "$SQUID_CONF"
+  echo "http_port 3128" >> "$SQUID_CONF"
+  echo "acl all src all" >> "$SQUID_CONF"
+
+  # Disable caching
+  echo "cache deny all" >> "$SQUID_CONF"
+  echo "cache_mem 0" >> "$SQUID_CONF"
+  echo "memory_pools off" >> "$SQUID_CONF"
+  echo "cache_swap_low 0" >> "$SQUID_CONF"
+  echo "cache_swap_high 0" >> "$SQUID_CONF"
+
+  # Disable logs
+  echo "access_log /tmp/test.log" >> "$SQUID_CONF"
+  echo "cache_store_log none" >> "$SQUID_CONF"
+  echo "cache_log /dev/null" >> "$SQUID_CONF"
+  echo "logfile_rotate 0" >> "$SQUID_CONF"
+  echo "debug_options ALL,1" >> "$SQUID_CONF"
+
+  # Make it pass-through like
+  echo "forwarded_for delete" >> "$SQUID_CONF"
+  echo "via off" >> "$SQUID_CONF"
+  echo "request_header_access X-Forwarded-For deny all" >> "$SQUID_CONF"
+  echo "request_header_access Via deny all" >> "$SQUID_CONF"
+  echo "request_header_access Cache-Control deny all" >> "$SQUID_CONF"
+
+  # Blocked IPs
+  if [[ -n "${OUTGOING_BLOCKED_IPS:-}" ]]; then
+    IFS=',' read -ra BLOCKED_IPS <<< "$OUTGOING_BLOCKED_IPS"
+    for ip in "${BLOCKED_IPS[@]}"; do
+      echo "acl blocked_ip dst $ip" >> "$SQUID_CONF"
+    done
+    echo "http_access deny blocked_ip" >> "$SQUID_CONF"
+  fi
+
+  # Blocked hostnames
+  if [[ -n "${OUTGOING_BLOCKED_HOSTS:-}" ]]; then
+    IFS=',' read -ra BLOCKED_HOSTS <<< "$OUTGOING_BLOCKED_HOSTS"
+    for host in "${BLOCKED_HOSTS[@]}"; do
+      echo "acl blocked_host dstdomain $host" >> "$SQUID_CONF"
+    done
+    echo "http_access deny blocked_host" >> "$SQUID_CONF"
+  fi
+
+  # Allowed IPs
+  if [[ -n "${OUTGOING_ALLOWED_IPS:-}" ]]; then
+    IFS=',' read -ra ALLOWED_IPS <<< "$OUTGOING_ALLOWED_IPS"
+    for ip in "${ALLOWED_IPS[@]}"; do
+      echo "acl allowed_ip dst $ip" >> "$SQUID_CONF"
+    done
+    echo "http_access allow allowed_ip" >> "$SQUID_CONF"
+  fi
+
+  # Allowed hostnames
+  if [[ -n "${OUTGOING_ALLOWED_HOSTS:-}" ]]; then
+    IFS=',' read -ra ALLOWED_HOSTS <<< "$OUTGOING_ALLOWED_HOSTS"
+    for host in "${ALLOWED_HOSTS[@]}"; do
+      echo "acl allowed_host dstdomain $host" >> "$SQUID_CONF"
+    done
+    echo "http_access allow allowed_host" >> "$SQUID_CONF"
+  fi
+
+  # If any allowed rules exist, everything else is denied
+  if [[ -n "${OUTGOING_ALLOWED_IPS+x}${OUTGOING_ALLOWED_HOSTS+x}" ]]; then
+    echo "http_access deny all" >> "$SQUID_CONF"
+  else
+    # If no allowed rules exist, everything else is allowed
+    echo "http_access allow all" >> "$SQUID_CONF"
+  fi
+
+  # Start Squid
+  rm -f "$SQUID_PID"
+  squid -N -f "$SQUID_CONF" &
+
+  # Set environment variable
+  export OUTGOING_PROXY="http://127.0.0.1:3128"
+}
+
+if [[ -n "${DATABASE_URL:-}" ]]; then
   if [[ -z "${DATABASE_PASSWORD:-}" && -e "${DATABASE_PASSWORD__FILE:-}" ]]; then
     DATABASE_PASSWORD="$(read_secret "${DATABASE_PASSWORD__FILE}")"
     export DATABASE_URL="${DATABASE_URL/\$\{DATABASE_PASSWORD\}/${DATABASE_PASSWORD}}"
@@ -31,6 +130,8 @@ load_secret S3_SECRET_ACCESS_KEY
 load_secret OIDC_CLIENT_SECRET
 load_secret SMTP_PASSWORD
 
+start_outgoing_proxy_if_needed
+
 export NODE_ENV=production
 
 node db/init.js