ALL-8523: relax ssrf checks and allow tatum gateway nodes (#1125)

* ALL-8523: relax ssrf checks and allow tatum gateway nodes * ALL-8523: bump version --------- Co-authored-by: Filip Kaštovský <[email protected]>
tatumio · Aug 25, 2024 · 17f9511 · 17f9511
1 parent c355bdd
commit 17f9511
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 6 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## [4.2.40] - 2024.8.25
+
+### Fixed
+
+- Relax SSRF checks and allow tatum gateway nodes
+
 ## [4.2.39] - 2024.8.14
 
 ### Updated
@@ -71,7 +77,6 @@
 
 - Support for Avalanche Notifications
 
-
 ## [4.2.27] - 2024.5.6
 
 ### Added
@@ -82,7 +87,6 @@
 
 - Polygon Mumbai
 
-
 ## [4.2.26] - 2024.5.6
 
 ### Added
@@ -95,7 +99,6 @@
 
 - Added support for Iota API calls
 
-
 ## [4.2.23] - 2024.4.10
 
 ### Updated

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@tatumio/tatum",
-  "version": "4.2.39",
+  "version": "4.2.40",
   "description": "Tatum JS SDK",
   "author": "Tatum",
   "repository": "https://github.com/tatumio/tatum-js",

diff --git a/src/service/rpc/generic/LoadBalancer.ts b/src/service/rpc/generic/LoadBalancer.ts
@@ -338,7 +338,7 @@ export class LoadBalancer implements AbstractRpcInterface {
   private checkSSRF(url: string): boolean {
     try {
       const parsedUrl = new URL(url)
-      return parsedUrl.hostname.endsWith('rpc.tatum.io')
+      return parsedUrl.hostname.endsWith('tatum.io')
     } catch (e) {
       Utils.log({
         id: this.id,
@@ -358,7 +358,7 @@ export class LoadBalancer implements AbstractRpcInterface {
         return typeMatch
       }
 
-      // If noSSRFCheck is false or undefined, check if the URL ends with 'rpc.tatum.io'.
+      // If noSSRFCheck is false or undefined, check if the URL ends with 'tatum.io'.
       const ssrfCheckPassed = this.checkSSRF(node.url)
 
       // Log if the URL doesn't pass the SSRF check