@ai-sdk/provider-utils 5.0.14 → 5.0.15

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @ai-sdk/provider-utils
 
+## 5.0.15
+
+### Patch Changes
+
+- 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
+- 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.
+
 ## 5.0.14
 
 ### Patch Changes

package/dist/index.d.ts

@@ -856,18 +856,16 @@ type FetchFunction = typeof globalThis.fetch;
  * The returned response is the final (non-redirect) response. The caller is
  * responsible for checking `response.ok` and reading the body.
  *
- * Not solved here: this does string/literal checks only and does not resolve
- * DNS, so a hostname that *resolves* to a private address, and DNS rebinding
- * (the resolved IP flipping between validation and connect), are not blocked.
- * Server deployments fetching untrusted URLs should constrain egress at the
- * network layer or inject a Node `fetch` that pins the resolved IP at connect
- * time — those need DNS/socket APIs not available on all target runtimes
- * (edge, browser, Bun), so they are intentionally not built in.
+ * On Node.js, the default fetch resolves every hostname through a validating
+ * lookup hook and passes those exact addresses to the connector, preventing
+ * hostname-to-private-IP and DNS-rebinding bypasses. An injected fetch is
+ * responsible for equivalent connect-time validation. Other runtimes should
+ * constrain egress at the network layer when handling untrusted URLs.
  *
  * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
  * a redirect cannot be validated on a non-browser runtime.
  */
-declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, fetch, trustedOrigin, }: {
+declare function fetchWithValidatedRedirects({ url, headers, abortSignal, maxRedirects, fetch: customFetch, trustedOrigin, }: {
     url: string;
     headers?: HeadersInit;
     abortSignal?: AbortSignal;
@@ -2423,9 +2421,8 @@ declare function validateBaseURL(baseURL: string | undefined): string | undefine
  * Validates that a URL is safe to download from, blocking private/internal addresses
  * to prevent SSRF attacks.
  *
- * Note: this performs string/literal-IP checks only. It does not resolve DNS, so a
- * hostname that resolves to a private address is not blocked here (see callers, which
- * should additionally constrain egress at the network layer when handling untrusted URLs).
+ * Note: this function performs string/literal-IP checks only. The Node.js
+ * download fetch additionally validates and pins DNS results at connect time.
  *
  * @param url - The URL string to validate.
  * @throws DownloadError if the URL is unsafe.

package/dist/index.js

@@ -686,42 +686,6 @@ function isSameOrigin(url, baseUrl) {
   }
 }
 
-// src/sanitize-request-headers.ts
-var BLOCKED_REQUEST_HEADERS = [
-  // Hop-by-hop / transport (RFC 7230 §6.1)
-  "connection",
-  "keep-alive",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade",
-  // Host / virtual-host routing
-  "host",
-  // Proxy / origin spoofing
-  "forwarded",
-  "proxy-authorization",
-  "via",
-  "x-forwarded-for",
-  "x-forwarded-host",
-  "x-forwarded-proto",
-  "x-real-ip",
-  // Cloud metadata (GCP, AWS IMDSv1/v2, Azure, Alibaba, DigitalOcean)
-  "metadata",
-  "metadata-flavor",
-  "x-aws-ec2-metadata-token",
-  "x-metadata-token",
-  // Session / cookie
-  "cookie",
-  "set-cookie"
-];
-function sanitizeRequestHeaders(input) {
-  const headers = new Headers(input);
-  for (const name3 of BLOCKED_REQUEST_HEADERS) {
-    headers.delete(name3);
-  }
-  return headers;
-}
-
 // src/validate-download-url.ts
 function validateDownloadUrl(url) {
   let parsed;
@@ -775,6 +739,19 @@ function validateDownloadUrl(url) {
     return;
   }
 }
+function validateDownloadAddress({
+  address,
+  family,
+  hostname
+}) {
+  const isUnsafe = family === 4 ? !isIPv4(address) || isPrivateIPv4(address) : family === 6 ? isPrivateIPv6(address) : true;
+  if (isUnsafe) {
+    throw new DownloadError({
+      url: hostname,
+      message: `Hostname ${hostname} resolved to disallowed IP address ${address}`
+    });
+  }
+}
 function isIPv4(hostname) {
   const parts = hostname.split(".");
   if (parts.length !== 4) return false;
@@ -866,6 +843,138 @@ function isPrivateIPv6(ip) {
   return false;
 }
 
+// src/safe-node-fetch.ts
+function createSafeLookup(lookup) {
+  return ((hostname, options, callback) => {
+    lookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) {
+        callback(error);
+        return;
+      }
+      try {
+        const [firstAddress] = addresses;
+        if (firstAddress == null) {
+          throw new Error(`Hostname ${hostname} did not resolve to an address`);
+        }
+        for (const { address, family } of addresses) {
+          validateDownloadAddress({ address, family, hostname });
+        }
+        if (options.all === true) {
+          callback(null, addresses);
+        } else {
+          callback(
+            null,
+            firstAddress.address,
+            firstAddress.family
+          );
+        }
+      } catch (error2) {
+        callback(
+          error2 instanceof Error ? error2 : new Error(String(error2))
+        );
+      }
+    });
+  });
+}
+var safeNodeFetchPromise;
+var initialGlobalFetch = globalThis.fetch;
+var initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
+function isNodeRuntime() {
+  var _a3, _b3;
+  const runtimeProcess = globalThis.process;
+  return ((_a3 = runtimeProcess == null ? void 0 : runtimeProcess.release) == null ? void 0 : _a3.name) === "node" && ((_b3 = runtimeProcess.versions) == null ? void 0 : _b3.bun) == null;
+}
+async function getDefaultDownloadFetch() {
+  if (!isNodeRuntime() || !initialGlobalFetchIsNodeDefault || globalThis.fetch !== initialGlobalFetch) {
+    return globalThis.fetch;
+  }
+  return safeNodeFetchPromise != null ? safeNodeFetchPromise : safeNodeFetchPromise = Promise.resolve().then(createSafeNodeFetch);
+}
+function isNodeDefaultFetch(fetch) {
+  const source = Function.prototype.toString.call(fetch);
+  return source.includes("internal/deps/undici") || source.includes("lazy loading of undici");
+}
+function createSafeNodeFetch() {
+  const { createRequire } = loadBuiltinModule("node:module");
+  const { lookup } = loadBuiltinModule("node:dns");
+  const { Agent, fetch } = createRequire(getCurrentModulePath())(
+    "undici"
+  );
+  const dispatcher = new Agent({
+    connect: {
+      lookup: createSafeLookup(lookup)
+    }
+  });
+  return ((input, init) => fetch(
+    input,
+    {
+      ...init,
+      dispatcher
+    }
+  ));
+}
+function loadBuiltinModule(id) {
+  var _a3;
+  const processWithBuiltins = globalThis.process;
+  const builtinModule = (_a3 = processWithBuiltins == null ? void 0 : processWithBuiltins.getBuiltinModule) == null ? void 0 : _a3.call(processWithBuiltins, id);
+  if (builtinModule == null) {
+    throw new Error(`Node.js built-in module ${id} is unavailable`);
+  }
+  return builtinModule;
+}
+function getCurrentModulePath() {
+  const originalPrepareStackTrace = Error.prepareStackTrace;
+  try {
+    Error.prepareStackTrace = (_error, callSites) => callSites;
+    const error = new Error("Capture current module path");
+    Error.captureStackTrace(error, getCurrentModulePath);
+    const [caller] = error.stack;
+    const fileName = caller == null ? void 0 : caller.getFileName();
+    if (fileName == null) {
+      throw new Error("Unable to determine the current module path");
+    }
+    return fileName;
+  } finally {
+    Error.prepareStackTrace = originalPrepareStackTrace;
+  }
+}
+
+// src/sanitize-request-headers.ts
+var BLOCKED_REQUEST_HEADERS = [
+  // Hop-by-hop / transport (RFC 7230 §6.1)
+  "connection",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  // Host / virtual-host routing
+  "host",
+  // Proxy / origin spoofing
+  "forwarded",
+  "proxy-authorization",
+  "via",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  // Cloud metadata (GCP, AWS IMDSv1/v2, Azure, Alibaba, DigitalOcean)
+  "metadata",
+  "metadata-flavor",
+  "x-aws-ec2-metadata-token",
+  "x-metadata-token",
+  // Session / cookie
+  "cookie",
+  "set-cookie"
+];
+function sanitizeRequestHeaders(input) {
+  const headers = new Headers(input);
+  for (const name3 of BLOCKED_REQUEST_HEADERS) {
+    headers.delete(name3);
+  }
+  return headers;
+}
+
 // src/fetch-with-validated-redirects.ts
 var MAX_DOWNLOAD_REDIRECTS = 10;
 var REDIRECT_STATUS_CODES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
@@ -874,7 +983,7 @@ async function fetchWithValidatedRedirects({
   headers,
   abortSignal,
   maxRedirects = MAX_DOWNLOAD_REDIRECTS,
-  fetch = globalThis.fetch,
+  fetch: customFetch,
   trustedOrigin
 }) {
   let currentHeaders = headers === void 0 ? void 0 : sanitizeRequestHeaders(headers);
@@ -887,9 +996,11 @@ async function fetchWithValidatedRedirects({
   };
   let currentUrl = url;
   for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
-    if (trustedOrigin === void 0 || !isSameOrigin(currentUrl, trustedOrigin)) {
+    const isTrustedHop = trustedOrigin !== void 0 && isSameOrigin(currentUrl, trustedOrigin);
+    if (!isTrustedHop) {
       validateDownloadUrl(currentUrl);
     }
+    const fetch = customFetch != null ? customFetch : isTrustedHop ? globalThis.fetch : await getDefaultDownloadFetch();
     const response = await fetch(currentUrl, perHopInit("manual"));
     if (response.type === "opaqueredirect") {
       if (!isBrowserRuntime()) {
@@ -1183,7 +1294,7 @@ function withUserAgentSuffix(headers, ...userAgentSuffixParts) {
 }
 
 // src/version.ts
-var VERSION = true ? "5.0.14" : "0.0.0-test";
+var VERSION = true ? "5.0.15" : "0.0.0-test";
 
 // src/get-from-api.ts
 var getOriginalFetch = () => globalThis.fetch;
@@ -1193,12 +1304,13 @@ var getFromApi = async ({
   successfulResponseHandler,
   failedResponseHandler,
   abortSignal,
-  fetch = getOriginalFetch(),
+  fetch,
   validateUrl,
   credentialedOrigin,
   trustedOrigin
 }) => {
   try {
+    const requestFetch = fetch != null ? fetch : getOriginalFetch();
     const outgoingHeaders = credentialedOrigin !== void 0 && !isSameOrigin(url, credentialedOrigin) ? {} : headers;
     const requestHeaders = withUserAgentSuffix(
       outgoingHeaders,
@@ -1211,7 +1323,7 @@ var getFromApi = async ({
       abortSignal,
       fetch,
       trustedOrigin
-    }) : await fetch(url, {
+    }) : await requestFetch(url, {
       method: "GET",
       headers: requestHeaders,
       signal: abortSignal