@actuate-media/cms-core 0.11.2 → 0.13.0

package/dist/security/safe-fetch.d.ts

@@ -2,21 +2,27 @@
  * Perform a `fetch()` with SSRF defenses applied:
  *
  *  - Reject non-http/https URLs (no `file:`, `gopher:`, `data:`).
- *  - Reject hostnames that resolve to private/loopback IP literals
- *    (`10.x`, `127.x`, `169.254.x`, `192.168.x`, `::1`, …).
- *  - Reject `localhost` and `0.0.0.0`.
+ *  - Reject hostnames that resolve to private/loopback IP literals via the
+ *    canonicalizer in `ip-canon.ts` (decimal, octal, hex, IPv4-mapped IPv6,
+ *    short-form, CGNAT, cloud metadata, etc.).
+ *  - Reject `localhost`, `0.0.0.0`, and `*.internal` hostnames.
+ *  - DNS-resolve the hostname before fetching and reject if any A/AAAA record
+ *    lands in a private range. This defeats DNS rebinding — without it, an
+ *    attacker controlling DNS for `evil.tld` returns `8.8.8.8` to our
+ *    validator and `127.0.0.1` to the actual `fetch`. The pre-resolution
+ *    forces the same lookup.
  *  - Disable HTTP redirects by default (`redirect: 'manual'`) — a 302 to an
  *    internal address would otherwise smuggle the request past the validator.
+ *    When `followRedirects: true`, each hop is re-validated AND re-resolved.
  *  - Apply a hard request timeout via `AbortSignal.timeout`.
  *
  * Use this for any internal `fetch()` call that targets a URL derived from
  * user/admin input (webhooks, link health, image URL fetches, etc).
  *
- * Note: this guards against the URL **as written**. For full DNS-rebinding
- * protection use `resolveAndCheck()` from `./webhook.js` to pre-resolve the
- * hostname; on Node 20+ this can be combined with a custom dispatcher to bind
- * the request to the resolved IP. The default policy here trades that
- * protection for portability across runtimes (Edge, Bun, Workers).
+ * **Runtime caveat:** DNS resolution uses `node:dns/promises`. On Edge / Bun
+ * / Workers without that module, `resolveDns` is skipped and only the
+ * URL-string check applies — set `requireDnsCheck: true` to fail closed on
+ * runtimes where the resolver isn't available.
  */
 export interface SafeFetchOptions extends RequestInit {
     /** Hard timeout applied via AbortSignal. Defaults to 5000ms. */
@@ -25,6 +31,22 @@ export interface SafeFetchOptions extends RequestInit {
     followRedirects?: boolean;
     /** Maximum number of redirect hops when followRedirects is true. Default: 3. */
     maxRedirects?: number;
+    /**
+     * When true, DNS resolution failures (including missing `node:dns/promises`)
+     * cause the request to fail closed with an `SsrfBlockedError` instead of
+     * proceeding with only the string-level check. Default: false (best effort
+     * — preserves portability across Edge/Workers runtimes).
+     */
+    requireDnsCheck?: boolean;
+    /**
+     * Test seam — allows tests to substitute a fake resolver instead of hitting
+     * real DNS. Production callers leave this undefined.
+     */
+    _resolver?: (hostname: string) => Promise<{
+        safe: boolean;
+        resolvedIp?: string;
+        error?: string;
+    }>;
 }
 export declare class SsrfBlockedError extends Error {
     readonly url: string;

package/dist/security/safe-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsC9F"}
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sFAAsF;IACtF,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAClG;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBACX,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAuCD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0C9F"}

package/dist/security/safe-fetch.js

@@ -1,4 +1,4 @@
-import { validateWebhookUrl } from './webhook.js';
+import { resolveAndCheck, validateWebhookUrl } from './webhook.js';
 export class SsrfBlockedError extends Error {
     url;
     reason;
@@ -9,15 +9,41 @@ export class SsrfBlockedError extends Error {
         this.reason = reason;
     }
 }
+async function preflightUrl(url, options) {
+    const check = validateWebhookUrl(url);
+    if (!check.valid) {
+        throw new SsrfBlockedError(url, check.error ?? 'URL rejected by SSRF policy');
+    }
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new SsrfBlockedError(url, 'invalid URL');
+    }
+    // resolveAndCheck short-circuits when the hostname is already an IP literal
+    // (which validateWebhookUrl just covered), so this only does real DNS work
+    // for actual hostnames.
+    let resolved;
+    try {
+        resolved = await options.resolver(parsed.hostname);
+    }
+    catch (err) {
+        if (options.requireDnsCheck) {
+            throw new SsrfBlockedError(url, `DNS resolution failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return; // best-effort mode: proceed with string check only
+    }
+    if (!resolved.safe) {
+        throw new SsrfBlockedError(url, resolved.error ?? 'hostname resolves to a private IP');
+    }
+}
 export async function safeFetch(url, options = {}) {
-    const { timeoutMs = 5000, followRedirects = false, maxRedirects = 3, ...init } = options;
+    const { timeoutMs = 5000, followRedirects = false, maxRedirects = 3, requireDnsCheck = false, _resolver = resolveAndCheck, ...init } = options;
     let currentUrl = url;
     let hops = 0;
     while (true) {
-        const check = validateWebhookUrl(currentUrl);
-        if (!check.valid) {
-            throw new SsrfBlockedError(currentUrl, check.error ?? 'URL rejected by SSRF policy');
-        }
+        await preflightUrl(currentUrl, { requireDnsCheck, resolver: _resolver });
         const response = await fetch(currentUrl, {
             ...init,
             redirect: 'manual',

package/dist/security/safe-fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AA+BjD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,GAAG,CAAQ;IACX,MAAM,CAAQ;IACvB,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CAAC,iBAAiB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,UAA4B,EAAE;IACzE,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,eAAe,GAAG,KAAK,EAAE,YAAY,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAExF,IAAI,UAAU,GAAG,GAAG,CAAA;IACpB,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACtD,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;QAClE,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,YAAY,YAAY,YAAY,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE9B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,CAAA;IACX,CAAC;AACH,CAAC"}
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../src/security/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAiDlE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,GAAG,CAAQ;IACX,MAAM,CAAQ;IACvB,YAAY,GAAW,EAAE,MAAc;QACrC,KAAK,CAAC,iBAAiB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,OAA2F;IAE3F,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,IAAI,6BAA6B,CAAC,CAAA;IAC/E,CAAC;IAED,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAChD,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,wBAAwB;IACxB,IAAI,QAAQ,CAAA;IACZ,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAA;QACH,CAAC;QACD,OAAM,CAAC,mDAAmD;IAC5D,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;IACxF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,UAA4B,EAAE;IACzE,MAAM,EACJ,SAAS,GAAG,IAAI,EAChB,eAAe,GAAG,KAAK,EACvB,YAAY,GAAG,CAAC,EAChB,eAAe,GAAG,KAAK,EACvB,SAAS,GAAG,eAAe,EAC3B,GAAG,IAAI,EACR,GAAG,OAAO,CAAA;IAEX,IAAI,UAAU,GAAG,GAAG,CAAA;IACpB,IAAI,IAAI,GAAG,CAAC,CAAA;IAEZ,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAA;QAExE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACtD,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;QAClE,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,UAAU,EAAE,YAAY,YAAY,YAAY,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAA;QAE9B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/security/webhook.d.ts

@@ -1,9 +1,27 @@
-/** Validate that a webhook URL does not target private/internal networks (SSRF prevention). */
+/**
+ * Validate that a webhook URL does not target private/internal networks
+ * (string-level SSRF prevention).
+ *
+ * Catches every IP-literal encoding `getaddrinfo` accepts: decimal
+ * (`http://2130706433`), octal (`http://0177.0.0.1`), hex
+ * (`http://0x7f.0.0.1`), short-form (`http://127.1`), IPv4-mapped IPv6
+ * (`http://[::ffff:127.0.0.1]`), bracketed IPv6, and the reserved
+ * `100.64.0.0/10` carrier-grade NAT range that previously slipped through.
+ *
+ * **Important caveat:** this only validates the URL **as written**. A hostname
+ * like `attacker-controlled.tld` that resolves to a public IP at validation
+ * time and to `127.0.0.1` at fetch time (DNS rebinding) still bypasses this
+ * check — `safeFetch` calls `resolveAndCheck()` on top to defend against that.
+ */
 export declare function validateWebhookUrl(url: string): {
     valid: boolean;
     error?: string;
 };
-/** Resolve a hostname and verify the resulting IP isn't in a private range. */
+/**
+ * Resolve a hostname's A/AAAA records and verify none of them land in a
+ * private range. Pair with `validateWebhookUrl` to defend against DNS
+ * rebinding — see `safeFetch`.
+ */
 export declare function resolveAndCheck(hostname: string): Promise<{
     safe: boolean;
     resolvedIp?: string;

package/dist/security/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/security/webhook.ts"],"names":[],"mappings":"AAYA,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAsBlF;AAED,+EAA+E;AAC/E,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BjE"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/security/webhook.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmDlF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgEjE"}

package/dist/security/webhook.js

@@ -1,37 +1,90 @@
-const PRIVATE_RANGES = [
-    /^10\./,
-    /^172\.(1[6-9]|2\d|3[01])\./,
-    /^192\.168\./,
-    /^127\./,
-    /^0\./,
-    /^169\.254\./,
-    /^::1$/,
-    /^fc00:/i,
-    /^fe80:/i,
-];
-/** Validate that a webhook URL does not target private/internal networks (SSRF prevention). */
+import { canonicalizeHostname, isPrivateAddress } from './ip-canon.js';
+/**
+ * Validate that a webhook URL does not target private/internal networks
+ * (string-level SSRF prevention).
+ *
+ * Catches every IP-literal encoding `getaddrinfo` accepts: decimal
+ * (`http://2130706433`), octal (`http://0177.0.0.1`), hex
+ * (`http://0x7f.0.0.1`), short-form (`http://127.1`), IPv4-mapped IPv6
+ * (`http://[::ffff:127.0.0.1]`), bracketed IPv6, and the reserved
+ * `100.64.0.0/10` carrier-grade NAT range that previously slipped through.
+ *
+ * **Important caveat:** this only validates the URL **as written**. A hostname
+ * like `attacker-controlled.tld` that resolves to a public IP at validation
+ * time and to `127.0.0.1` at fetch time (DNS rebinding) still bypasses this
+ * check — `safeFetch` calls `resolveAndCheck()` on top to defend against that.
+ */
 export function validateWebhookUrl(url) {
+    let parsed;
     try {
-        const parsed = new URL(url);
-        if (!['https:', 'http:'].includes(parsed.protocol)) {
-            return { valid: false, error: 'Only HTTP(S) protocols are allowed' };
-        }
-        if (parsed.hostname === 'localhost' || parsed.hostname === '0.0.0.0') {
-            return { valid: false, error: 'Localhost URLs are not allowed' };
-        }
-        for (const range of PRIVATE_RANGES) {
-            if (range.test(parsed.hostname)) {
-                return { valid: false, error: 'Private/internal IP addresses are not allowed' };
-            }
-        }
-        return { valid: true };
+        parsed = new URL(url);
     }
     catch {
         return { valid: false, error: 'Invalid URL' };
     }
+    if (!['https:', 'http:'].includes(parsed.protocol)) {
+        return { valid: false, error: 'Only HTTP(S) protocols are allowed' };
+    }
+    // Special-case the well-known names — they're DNS hostnames so the
+    // canonicalizer can't catch them via numeric ranges.
+    const lowerHost = parsed.hostname.toLowerCase();
+    if (lowerHost === 'localhost' || lowerHost === 'ip6-localhost' || lowerHost === 'ip6-loopback') {
+        return { valid: false, error: 'Localhost hostnames are not allowed' };
+    }
+    // metadata.google.internal and AWS' internal DNS shadow real metadata IPs
+    // we already block — but the hostname can be redirected via /etc/hosts in
+    // self-hosted contexts, so block it explicitly.
+    if (lowerHost === 'metadata.google.internal' || lowerHost.endsWith('.internal')) {
+        return { valid: false, error: 'Cloud metadata hostnames are not allowed' };
+    }
+    const canonical = canonicalizeHostname(parsed.hostname);
+    if (!canonical.isHostname) {
+        // Three sub-cases for `!isHostname`:
+        //   1. Valid IP literal that's private  → reject with the range reason.
+        //   2. Valid IP literal that's public   → allow (fall through).
+        //   3. Malformed IP literal (e.g. `::1::1`, IPv6 with garbage) →
+        //      `isValidIp` is false. Fail closed: the URL was clearly not a
+        //      DNS hostname, so a `getaddrinfo` will reject it too — but
+        //      worse, on some platforms it may resolve to *something*. Reject
+        //      here rather than risk that ambiguity.
+        if (!canonical.isValidIp) {
+            return {
+                valid: false,
+                error: `Malformed IP literal in URL hostname: ${parsed.hostname}`,
+            };
+        }
+        const denied = isPrivateAddress(canonical);
+        if (denied) {
+            return {
+                valid: false,
+                error: `Private/internal IP address rejected: ${denied.reason}`,
+            };
+        }
+    }
+    return { valid: true };
 }
-/** Resolve a hostname and verify the resulting IP isn't in a private range. */
+/**
+ * Resolve a hostname's A/AAAA records and verify none of them land in a
+ * private range. Pair with `validateWebhookUrl` to defend against DNS
+ * rebinding — see `safeFetch`.
+ */
 export async function resolveAndCheck(hostname) {
+    // If the hostname is already an IP literal, skip DNS and check directly.
+    const directCanonical = canonicalizeHostname(hostname);
+    if (!directCanonical.isHostname) {
+        // Malformed IP literal — treat as unsafe. Without this, a bad IPv6
+        // string (e.g. `::1::garbage`) would slip through the SSRF gate
+        // because `isPrivateAddress` legitimately returns null when there's
+        // no parsed IP to check.
+        if (!directCanonical.isValidIp) {
+            return { safe: false, resolvedIp: hostname, error: 'malformed IP literal' };
+        }
+        const denied = isPrivateAddress(directCanonical);
+        if (denied) {
+            return { safe: false, resolvedIp: hostname, error: denied.reason };
+        }
+        return { safe: true, resolvedIp: hostname };
+    }
     const { resolve4, resolve6 } = await import('node:dns/promises');
     const ips = [];
     try {
@@ -51,11 +104,28 @@ export async function resolveAndCheck(hostname) {
     if (ips.length === 0) {
         return { safe: false, error: `DNS resolution failed for ${hostname}` };
     }
+    // Check EVERY resolved IP, not just the first — a multi-A-record response
+    // could mix public + private IPs and we must reject if any single one is
+    // private to defeat round-robin DNS rebinding.
     for (const ip of ips) {
-        for (const range of PRIVATE_RANGES) {
-            if (range.test(ip)) {
-                return { safe: false, resolvedIp: ip, error: `Resolved IP ${ip} is in a private range` };
-            }
+        const c = canonicalizeHostname(ip);
+        // DNS resolvers return canonical IP literals, so `isValidIp` should be
+        // true. If a resolver ever returns something we can't parse, treat it
+        // as unsafe rather than trusting it.
+        if (!c.isValidIp) {
+            return {
+                safe: false,
+                resolvedIp: ip,
+                error: `Unparseable IP returned from DNS for ${hostname}: ${ip}`,
+            };
+        }
+        const denied = isPrivateAddress(c);
+        if (denied) {
+            return {
+                safe: false,
+                resolvedIp: ip,
+                error: `Resolved IP ${ip} is in a private range: ${denied.reason}`,
+            };
         }
     }
     return { safe: true, resolvedIp: ips[0] };

package/dist/security/webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/security/webhook.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,OAAO;IACP,4BAA4B;IAC5B,aAAa;IACb,QAAQ;IACR,MAAM;IACN,aAAa;IACb,OAAO;IACP,SAAS;IACT,SAAS;CACV,CAAA;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAE3B,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;QACtE,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;QAClE,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAA;YACjF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAEhE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,QAAQ,EAAE,EAAE,CAAA;IACxE,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3C,CAAC"}
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/security/webhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAA;IAC/C,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IACtE,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC/C,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,eAAe,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QAC/F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;IACvE,CAAC;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,IAAI,SAAS,KAAK,0BAA0B,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;IAC5E,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC1B,qCAAqC;QACrC,wEAAwE;QACxE,gEAAgE;QAChE,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,yCAAyC,MAAM,CAAC,QAAQ,EAAE;aAClE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,yCAAyC,MAAM,CAAC,MAAM,EAAE;aAChE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB;IAEhB,yEAAyE;IACzE,MAAM,eAAe,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACtD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;QAChC,mEAAmE;QACnE,gEAAgE;QAChE,oEAAoE;QACpE,yBAAyB;QACzB,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAA;QAChD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAEhE,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACnC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,QAAQ,EAAE,EAAE,CAAA;IACxE,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,+CAA+C;IAC/C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;QAClC,uEAAuE;QACvE,sEAAsE;QACtE,qCAAqC;QACrC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,wCAAwC,QAAQ,KAAK,EAAE,EAAE;aACjE,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,eAAe,EAAE,2BAA2B,MAAM,CAAC,MAAM,EAAE;aACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-core",
-  "version": "0.11.2",
+  "version": "0.13.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",