@ai-sdk/google 4.0.0-canary.79 → 4.0.0-canary.81

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @ai-sdk/google
 
+## 4.0.0-canary.81
+
+### Patch Changes
+
+- 5878b40: fix(google): prevent prototype pollution when streaming tool args
+- aeda373: fix: only send provider credentials to same-origin response-supplied URLs
+
+  Several provider clients followed a URL taken from the provider's API response (a polling/status URL or a final media URL such as `polling_url`, `urls.get`, `result_url`, `result.sample`, or `video.uri`) and reused the authenticated headers — or appended `?key=<API_KEY>` — on that request. Because the host of the response-supplied URL was never validated, the long-lived API key was sent to whatever host the response named (a CDN in the benign case, or an attacker-chosen host if the provider response was tampered with), allowing credential exfiltration.
+
+  A new `isSameOrigin` helper is added to `@ai-sdk/provider-utils`, and the affected fetches in `@ai-sdk/black-forest-labs`, `@ai-sdk/fireworks`, `@ai-sdk/replicate`, `@ai-sdk/gladia`, `@ai-sdk/fal`, and `@ai-sdk/google` now attach credentials only when the followed URL is same-origin with the provider's configured API origin. Requests to a foreign origin are made without the credential.
+
+- Updated dependencies [aeda373]
+- Updated dependencies [375fdd7]
+- Updated dependencies [b4507d5]
+  - @ai-sdk/provider-utils@5.0.0-canary.48
+
+## 4.0.0-canary.80
+
+### Patch Changes
+
+- Updated dependencies [bae5e2b]
+  - @ai-sdk/provider-utils@5.0.0-canary.47
+
 ## 4.0.0-canary.79
 
 ### Patch Changes

package/dist/index.js

@@ -7,7 +7,7 @@ import {
 } from "@ai-sdk/provider-utils";
 
 // src/version.ts
-var VERSION = true ? "4.0.0-canary.79" : "0.0.0-test";
+var VERSION = true ? "4.0.0-canary.81" : "0.0.0-test";
 
 // src/google-embedding-model.ts
 import {
@@ -1484,11 +1484,25 @@ function parsePath(rawPath) {
   }
   return segments;
 }
+var hasOwn = Object.prototype.hasOwnProperty;
+function hasOwnProperty(obj, key) {
+  return hasOwn.call(obj, key);
+}
+function defineOwnProperty(obj, key, value) {
+  Object.defineProperty(obj, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
 function getNestedValue(obj, segments) {
   let current = obj;
   for (const pathSegment of segments) {
     if (current == null || typeof current !== "object") return void 0;
-    current = current[pathSegment];
+    const currentRecord = current;
+    if (!hasOwnProperty(currentRecord, pathSegment)) return void 0;
+    current = currentRecord[pathSegment];
   }
   return current;
 }
@@ -1497,12 +1511,16 @@ function setNestedValue(obj, segments, value) {
   for (let i = 0; i < segments.length - 1; i++) {
     const pathSegment = segments[i];
     const nextSeg = segments[i + 1];
-    if (current[pathSegment] == null) {
-      current[pathSegment] = typeof nextSeg === "number" ? [] : {};
+    if (!hasOwnProperty(current, pathSegment) || current[pathSegment] == null) {
+      defineOwnProperty(
+        current,
+        pathSegment,
+        typeof nextSeg === "number" ? [] : {}
+      );
     }
     current = current[pathSegment];
   }
-  current[segments[segments.length - 1]] = value;
+  defineOwnProperty(current, segments[segments.length - 1], value);
 }
 function resolvePartialArgValue(arg) {
   var _a, _b;
@@ -3314,6 +3332,7 @@ import {
   createJsonResponseHandler as createJsonResponseHandler5,
   delay as delay2,
   getFromApi as getFromApi2,
+  isSameOrigin,
   parseProviderOptions as parseProviderOptions5,
   postJsonToApi as postJsonToApi4,
   resolve as resolve4
@@ -3519,7 +3538,7 @@ var GoogleVideoModel = class {
     const apiKey = resolvedHeaders == null ? void 0 : resolvedHeaders["x-goog-api-key"];
     for (const generatedSample of response.generateVideoResponse.generatedSamples) {
       if ((_h = generatedSample.video) == null ? void 0 : _h.uri) {
-        const urlWithAuth = apiKey ? `${generatedSample.video.uri}${generatedSample.video.uri.includes("?") ? "&" : "?"}key=${apiKey}` : generatedSample.video.uri;
+        const urlWithAuth = apiKey && isSameOrigin(generatedSample.video.uri, this.config.baseURL) ? `${generatedSample.video.uri}${generatedSample.video.uri.includes("?") ? "&" : "?"}key=${apiKey}` : generatedSample.video.uri;
         videos.push({
           type: "url",
           url: urlWithAuth,