fix: remove ip dependency and use node blocklist to check for 10.0.0.0/8 range

.eslintrc

@@ -1,7 +1,8 @@
 {
     "env": {
         "es6": true,
-        "mocha": true
+        "mocha": true,
+        "node": true
     },
     "extends": "airbnb-base",
     "rules": {

package.json

@@ -19,7 +19,7 @@
   "publishConfig": {
     "registry": "https://artifactory.brandwatch.com/artifactory/api/npm/npm"
   },
-  "dependencies": {
-    "ip": "^2.0.1"
+  "engines": {
+    "node": ">=14.18.0"
   }
 }

src/index.js

@@ -1,7 +1,7 @@
 /**
  * Configure a ExpressJS middleware to expose useful health/metrics/checks endpoints.
  */
-const ip = require('ip');
+const net = require('net');
 
 // Default empty configuration
 let metrics;
@@ -10,6 +10,11 @@ let healthChecks = [];
 
 const prometheusContentType = 'text/plain; version=0.0.4';
 
+// Expect only requests in this range to get access to
+// the health/metrics/checks endpoints
+const blocklist = new net.BlockList();
+blocklist.addSubnet('10.0.0.0', 8);
+
 const doCheck = ({ name, check }) => new Promise((resolve) => {
   // Pass in the [ok, warning, critical, unknown] callbacks. i.e. just resolve the promise.
   check(
@@ -33,7 +38,9 @@ const addMetrics = (m) => { metrics = m; };
 const getMiddleware = () => (req, res, next) => {
   const requestingIP = req.ip || req.connection.remoteAddress
                        || req.socket.remoteAddress || req.connection.socket.remoteAddress;
-  if (!ip.isPrivate(requestingIP)) {
+
+  // Only expect private IPs from this range
+  if (!blocklist.check(requestingIP)) {
     return next();
   }
 

test/index.js

@@ -11,7 +11,7 @@ describe('bw-monitoring', () => {
   beforeEach(() => {
     req = {
       connection: {
-        remoteAddress: '127.0.0.1'
+        remoteAddress: '10.0.0.1'
       }
     };
     res = {