NodeJS AntiSSRFPolicy and Handler

.gitattributes

@@ -0,0 +1,7 @@
+# Normalize text files and keep repository line endings as LF
+* text=auto eol=lf
+
+# Keep Windows-specific scripts as CRLF
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf

.github/workflows/dotnet-tests.yml → .github/workflows/test-csharp.yml

@@ -5,8 +5,11 @@ name: Run .NET Tests
 
 on:
   pull_request:
-  push:
-    branches: [main]
+    branches:
+      - main
+    paths:
+      - "csharp/**"
+      - ".github/workflows/test-csharp.yml"
   workflow_dispatch:
 
 jobs:

.github/workflows/test-nodejs.yml

@@ -0,0 +1,45 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+name: Run NodeJS Tests
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "nodejs/**"
+      - ".github/workflows/test-nodejs.yml"
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+    strategy:
+      matrix:
+        node-version: [20.x, 22.x, 24.x]
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "npm"
+          cache-dependency-path: "nodejs/package-lock.json"
+
+      - name: Install dependencies
+        working-directory: nodejs
+        run: npm ci
+
+      - name: Run unit tests
+        working-directory: nodejs
+        run: npm run test:unit
+
+      - name: Run functional tests
+        working-directory: nodejs
+        run: npm run test:functional

.github/workflows/update-ip-ranges.yml

@@ -7,13 +7,13 @@ on:
   pull_request:
     paths:
       - 'config/IPAddressRanges.json'
-      - 'nodejs/config/IPAddressRanges.ts'
+      - 'nodejs/src/IPAddressRanges.ts'
       - 'csharp/src/IPAddressRanges.cs'
   push:
     branches: [main]
     paths:
       - 'config/IPAddressRanges.json'
-      - 'nodejs/config/IPAddressRanges.ts'  
+      - 'nodejs/src/IPAddressRanges.ts'
       - 'csharp/src/IPAddressRanges.cs'
   workflow_dispatch: # Allow manual triggering
 
@@ -41,10 +41,10 @@ jobs:
 
     - name: Verify generated files are up-to-date
       run: |
-        if ! git diff --exit-code nodejs/config/IPAddressRanges.ts csharp/src/IPAddressRanges.cs; then
+        if ! git diff --exit-code nodejs/src/IPAddressRanges.ts csharp/src/IPAddressRanges.cs; then
           echo "❌ Generated IP address range files are out of sync!"
           echo "The following files need to be regenerated:"
-          git diff --name-only nodejs/config/IPAddressRanges.ts csharp/src/IPAddressRanges.cs
+          git diff --name-only nodejs/src/IPAddressRanges.ts csharp/src/IPAddressRanges.cs
           echo ""
           echo "Please run the following commands locally and commit the results:"
           echo "  ./scripts/build-ip-ranges-nodejs.sh"

csharp/src/AntiSSRFPolicy.cs

@@ -146,7 +146,7 @@ public AntiSSRFPolicy(PolicyConfigOptions config)
                     AddXFFHeader = false;
                     break;
                 default:
-                    throw new ArgumentOutOfRangeException(nameof(config), config, "Invalid policy option");
+                    throw new ArgumentOutOfRangeException(nameof(config), config, "Argument must be a valid PolicyConfigOptions value");
             }
         }
 
@@ -224,10 +224,10 @@ public void AddDeniedHeaders(string[]? deniedHeaders)
             foreach (string headerName in deniedHeaders)
             {
                 if (headerName is null)
-                    throw new ArgumentNullException(nameof(deniedHeaders), "Header name cannot be null");
+                    throw new ArgumentNullException(nameof(deniedHeaders), "Headers cannot be null");
 
                 if (string.IsNullOrWhiteSpace(headerName))
-                    throw new ArgumentException($"Header name cannot be empty or whitespace", nameof(deniedHeaders));
+                    throw new ArgumentException($"Headers cannot be empty or whitespace", nameof(deniedHeaders));
             }
 
             _deniedHeaders.AddRange(deniedHeaders);
@@ -252,10 +252,10 @@ public void AddRequiredHeaders(string[]? requiredHeaders)
             foreach (string headerName in requiredHeaders)
             {
                 if (headerName is null)
-                    throw new ArgumentNullException(nameof(requiredHeaders), "Header name cannot be null");
+                    throw new ArgumentNullException(nameof(requiredHeaders), "Headers cannot be null");
 
                 if (string.IsNullOrWhiteSpace(headerName))
-                    throw new ArgumentException($"Header name cannot be empty or whitespace", nameof(requiredHeaders));
+                    throw new ArgumentException($"Headers cannot be empty or whitespace", nameof(requiredHeaders));
             }
 
             _requiredHeaders.AddRange(requiredHeaders);

nodejs/.prettierignore

@@ -0,0 +1,11 @@
+node_modules/**
+out/**
+*.md
+.gitignore
+.npmrc
+.config
+*.json
+**/*.json
+**/*.tgz
+temp-lib
+src/IPAddressRanges.ts

nodejs/.prettierrc

@@ -0,0 +1,9 @@
+{
+    "arrowParens": "always",
+    "bracketSpacing": true,
+    "endOfLine": "lf",
+    "printWidth": 120,
+    "singleQuote": false,
+    "tabWidth": 4,
+    "trailingComma": "none"
+}

nodejs/README.md

@@ -0,0 +1 @@
+TODO

nodejs/eslint.config.mjs

@@ -0,0 +1,38 @@
+import eslint from "@eslint/js";
+import tseslint from "typescript-eslint";
+import security from "eslint-plugin-security";
+
+export default tseslint.config({
+    files: ["**/*.ts"],
+    extends: [eslint.configs.recommended, tseslint.configs.recommendedTypeChecked, security.configs.recommended],
+    languageOptions: {
+        parserOptions: {
+            projectService: true,
+            tsconfigRootDir: import.meta.dirname
+        }
+    },
+    plugins: {
+        eslint: eslint
+    },
+    rules: {
+        "func-style": ["error", "declaration"],
+        "@typescript-eslint/naming-convention": [
+            "error",
+            {
+                selector: ["class"],
+                format: ["PascalCase"]
+            },
+            {
+                selector: ["variable"],
+                modifiers: ["const", "exported"],
+                format: ["UPPER_CASE"]
+            },
+            {
+                selector: "memberLike",
+                modifiers: ["private"],
+                format: ["camelCase"],
+                leadingUnderscore: "require"
+            }
+        ]
+    }
+});