Remove range_check dependency

lib/ipfilter.js

@@ -10,7 +10,6 @@
  * Module dependencies.
  */
 const iputil = require('neoip')
-const rangeCheck = require('range_check')
 const IpDeniedError = require('./deniedError')
 const proxyaddr = require('proxy-addr')
 
@@ -97,8 +96,27 @@ module.exports = function ipfilter(ips, opts) {
     }
   }
 
+  const inCidr = (addr, cidr) => {
+    const [network, prefixStr] = cidr.split('/')
+    const prefix = parseInt(prefixStr, 10)
+    const addrBytes = iputil.toUInt8Array(addr)
+    const netBytes = iputil.toUInt8Array(network)
+    if (addrBytes.length !== netBytes.length) return false
+    const fullBytes = Math.floor(prefix / 8)
+    for (let i = 0; i < fullBytes; i++) {
+      if (addrBytes[i] !== netBytes[i]) return false
+    }
+    const remainBits = prefix % 8
+    if (remainBits > 0) {
+      const mask = 0xff << (8 - remainBits)
+      if ((addrBytes[fullBytes] & mask) !== (netBytes[fullBytes] & mask))
+        return false
+    }
+    return true
+  }
+
   const testCidrBlock = (ip, constraint, mode) => {
-    if (rangeCheck.inRange(ip, constraint)) {
+    if (inCidr(stripPort(ip), constraint)) {
       return mode === 'allow'
     } else {
       return mode === 'deny'
@@ -154,7 +172,7 @@ module.exports = function ipfilter(ips, opts) {
 
     // Check if it is an array or a string
     if (typeof constraint === 'string') {
-      if (rangeCheck.isRange(constraint)) {
+      if (constraint.includes('/')) {
         return testCidrBlock(ip, constraint, mode)
       } else {
         return testExplicitIp(ip, constraint, mode)

package.json

@@ -50,14 +50,15 @@
   },
   "dependencies": {
     "neoip": "^3.1.0",
-    "proxy-addr": "^2.0.7",
-    "range_check": "^2.0.4"
+    "proxy-addr": "^2.0.7"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
     "eslint": "^10.0.3",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jest": "^29.12.1",
     "eslint-plugin-prettier": "^5.5.4",
+    "globals": "^17.4.0",
     "husky": "^9.1.7",
     "jest": "^30.2.0",
     "lint-staged": "^16.2.7",

test/ipfilter.spec.js

@@ -1103,6 +1103,152 @@ describe('an array of cidr blocks', () => {
   })
 })
 
+describe('cidr boundary checks', () => {
+  describe('IPv4 /28 boundaries', () => {
+    beforeEach(() => {
+      // 192.168.1.0/28 covers 192.168.1.0 - 192.168.1.15
+      ipfilter = IpFilter(['192.168.1.0/28'], {
+        log: false,
+        mode: 'allow',
+      })
+      req = {
+        session: {},
+        headers: [],
+        connection: {
+          remoteAddress: '',
+        },
+      }
+    })
+
+    it('should allow ip at network address', (done) => {
+      req.connection.remoteAddress = '192.168.1.0'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should allow ip at broadcast address', (done) => {
+      req.connection.remoteAddress = '192.168.1.15'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should allow ip in middle of block', (done) => {
+      req.connection.remoteAddress = '192.168.1.8'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should deny ip one above block', (done) => {
+      req.connection.remoteAddress = '192.168.1.16'
+      checkError(ipfilter, req, done)
+    })
+
+    it('should deny ip in different subnet', (done) => {
+      req.connection.remoteAddress = '192.168.2.1'
+      checkError(ipfilter, req, done)
+    })
+  })
+
+  describe('IPv6 /64 boundaries', () => {
+    beforeEach(() => {
+      ipfilter = IpFilter(['2001:db8:1234:5678::/64'], {
+        log: false,
+        mode: 'allow',
+      })
+      req = {
+        session: {},
+        headers: [],
+        connection: {
+          remoteAddress: '',
+        },
+      }
+    })
+
+    it('should allow ip within the /64 block', (done) => {
+      req.connection.remoteAddress = '2001:db8:1234:5678::1'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should allow ip at end of /64 block', (done) => {
+      req.connection.remoteAddress = '2001:db8:1234:5678:ffff:ffff:ffff:ffff'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should deny ip in different /64 block', (done) => {
+      req.connection.remoteAddress = '2001:db8:1234:5679::1'
+      checkError(ipfilter, req, done)
+    })
+
+    it('should deny IPv4 address against IPv6 cidr', (done) => {
+      req.connection.remoteAddress = '192.168.1.1'
+      checkError(ipfilter, req, done)
+    })
+  })
+
+  describe('IPv6 /128 single address', () => {
+    beforeEach(() => {
+      ipfilter = IpFilter(['2001:db8::1/128'], {
+        log: false,
+        mode: 'allow',
+      })
+      req = {
+        session: {},
+        headers: [],
+        connection: {
+          remoteAddress: '',
+        },
+      }
+    })
+
+    it('should allow the exact address', (done) => {
+      req.connection.remoteAddress = '2001:db8::1'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should deny any other address', (done) => {
+      req.connection.remoteAddress = '2001:db8::2'
+      checkError(ipfilter, req, done)
+    })
+  })
+
+  describe('IPv4 /32 single address', () => {
+    beforeEach(() => {
+      ipfilter = IpFilter(['10.0.0.1/32'], {
+        log: false,
+        mode: 'allow',
+      })
+      req = {
+        session: {},
+        headers: [],
+        connection: {
+          remoteAddress: '',
+        },
+      }
+    })
+
+    it('should allow the exact address', (done) => {
+      req.connection.remoteAddress = '10.0.0.1'
+      ipfilter(req, {}, () => {
+        done()
+      })
+    })
+
+    it('should deny any other address', (done) => {
+      req.connection.remoteAddress = '10.0.0.2'
+      checkError(ipfilter, req, done)
+    })
+  })
+})
+
 describe('mixing different types of filters', () => {
   describe('with a whitelist', () => {
     beforeEach(() => {