fix: drop is-localhost-ip, added PR to private-ip at <frenchbread/pri…

…vate-ip#27>

app/models/domains.js

@@ -19,7 +19,6 @@ const dayjs = require('dayjs-with-plugins');
 const getDmarcRecord = require('mailauth/lib/dmarc/get-dmarc-record');
 const isBase64 = require('is-base64');
 const isFQDN = require('is-fqdn');
-const isLocalhost = require('is-localhost-ip');
 const isSANB = require('is-string-and-not-blank');
 const localhostUrl = require('localhost-url-regex');
 const mongoose = require('mongoose');
@@ -44,6 +43,7 @@ const retryRequest = require('#helpers/retry-request');
 const verificationRecordOptions = require('#config/verification-record');
 const { encrypt, decrypt } = require('#helpers/encrypt-decrypt');
 
+// <https://github.com/frenchbread/private-ip/pull/27>
 // dynamically import private-ip
 let isPrivateIP;
 import('private-ip').then((obj) => {
@@ -961,8 +961,7 @@ Domains.pre('save', async function (next) {
       .replace('https://', '');
     if (
       localhostUrl().test(punycode.toASCII(this.bounce_webhook)) ||
-      isPrivateIP(value) ||
-      (await isLocalhost(punycode.toASCII(value)))
+      isPrivateIP(value)
     )
       throw Boom.badRequest(
         i18n.translateError('INVALID_LOCALHOST_URL', this.locale)

helpers/is-allowlisted.js

@@ -6,7 +6,6 @@
 const punycode = require('node:punycode');
 const { isIP } = require('node:net');
 
-const isLocalhost = require('is-localhost-ip');
 const localhostUrl = require('localhost-url-regex');
 const pWaitFor = require('p-wait-for');
 const { boolean } = require('boolean');
@@ -19,6 +18,7 @@ const logger = require('#helpers/logger');
 const parseHostFromDomainOrAddress = require('#helpers/parse-host-from-domain-or-address');
 const parseRootDomain = require('#helpers/parse-root-domain');
 
+// <https://github.com/frenchbread/private-ip/pull/27>
 // dynamically import private-ip
 let isPrivateIP;
 import('private-ip').then((obj) => {
@@ -38,8 +38,7 @@ async function isAllowlisted(val, client, resolver) {
   if (!isPrivateIP) await pWaitFor(() => Boolean(isPrivateIP));
 
   // if it's localhost or local IP address then return early
-  if (localhostUrl().test(val) || isPrivateIP(val) || (await isLocalhost(val)))
-    return true;
+  if (localhostUrl().test(val) || isPrivateIP(val)) return true;
 
   // if it is a FQDN and ends with restricted domain
   if (

package.json

@@ -151,7 +151,6 @@
     "is-ci": "3.0.1",
     "is-fqdn": "2.0.1",
     "is-html": "2.0.0",
-    "is-localhost-ip": "2.0.0",
     "is-stream": "2.0.1",
     "is-string-and-not-blank": "0.0.2",
     "isbot": "3.7.1",