@aria-cli/tools 1.0.0

package/src/__tests__/web-fetch-download.test.ts

@@ -0,0 +1,433 @@
+/**
+ * @aria/tools - Web fetch tool tests
+ *
+ * Tests for executeWebFetch executor.
+ * Covers URL validation, SSRF protection, format parsing, and size limits.
+ * All external calls (fetch, dns) are mocked -- no real network traffic.
+ */
+
+import * as dns from "node:dns";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import type { ToolContext } from "../types.js";
+import { executeWebFetch } from "../executors/web.js";
+import { fetchCache } from "../cache/web-cache.js";
+
+vi.mock("node:dns", () => ({
+  promises: {
+    lookup: vi.fn(),
+  },
+}));
+
+const createContext = (overrides: Partial<ToolContext> = {}): ToolContext => ({
+  workingDir: "/tmp/test",
+  env: {},
+  confirm: async () => true,
+  ...overrides,
+});
+
+/** Helper to create a mock Response with a readable body stream. */
+function mockResponse(body: string | Uint8Array, init?: ResponseInit): Response {
+  return new Response(body, init);
+}
+
+/**
+ * Creates a chunked ReadableStream that yields data in small pieces,
+ * useful for testing streaming size limits without Content-Length.
+ */
+function chunkedResponse(chunks: Uint8Array[], init?: ResponseInit): Response {
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) {
+        controller.enqueue(chunk);
+      }
+      controller.close();
+    },
+  });
+  return new Response(stream, init);
+}
+
+// ============================================================================
+// executeWebFetch
+// ============================================================================
+
+describe("executeWebFetch", () => {
+  let originalFetch: typeof global.fetch;
+
+  beforeEach(() => {
+    originalFetch = global.fetch;
+    fetchCache.clear();
+    // Default: resolve to public IP
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "93.184.216.34",
+      family: 4,
+    });
+  });
+
+  afterEach(() => {
+    global.fetch = originalFetch;
+    vi.restoreAllMocks();
+  });
+
+  // ---------- URL validation ----------
+
+  it("rejects invalid URL format", async () => {
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "not-a-url" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("Invalid URL");
+  });
+
+  it("rejects non-HTTP protocols", async () => {
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "ftp://files.example.com/data" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("protocol");
+  });
+
+  it("rejects file:// protocol", async () => {
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "file:///etc/passwd" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("protocol");
+  });
+
+  // ---------- SSRF protection ----------
+
+  it("rejects hostname resolving to loopback (127.0.0.1)", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "127.0.0.1",
+      family: 4,
+    });
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://evil.example.com" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("private network");
+    expect(result.message).toContain("127.0.0.1");
+  });
+
+  it("rejects hostname resolving to AWS metadata (169.254.169.254)", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "169.254.169.254",
+      family: 4,
+    });
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://metadata.example.com" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("private network");
+    expect(result.message).toContain("169.254.169.254");
+  });
+
+  it("rejects hostname resolving to 10.x private range", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "10.0.0.1",
+      family: 4,
+    });
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://internal.corp" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("private network");
+  });
+
+  it("rejects hostname resolving to 192.168.x private range", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "192.168.1.1",
+      family: 4,
+    });
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://router.local" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("private network");
+  });
+
+  it("rejects hostname resolving to IPv6 loopback (::1)", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "::1",
+      family: 6,
+    });
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://ipv6-loop.example.com" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("private network");
+  });
+
+  it("allows hostname resolving to public IP (8.8.8.8)", async () => {
+    vi.mocked(dns.promises.lookup).mockResolvedValue({
+      address: "8.8.8.8",
+      family: 4,
+    });
+
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(mockResponse("public content", { status: 200 })),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://safe.example.com" }, ctx);
+
+    expect(result.success).toBe(true);
+  });
+
+  it("returns error when DNS lookup fails", async () => {
+    vi.mocked(dns.promises.lookup).mockRejectedValue(
+      new Error("getaddrinfo ENOTFOUND nope.invalid"),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://nope.invalid" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("DNS resolution failed");
+  });
+
+  // ---------- Format parsing ----------
+
+  it("returns text content wrapped with security boundaries by default", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse("Hello, world!", {
+          status: 200,
+          headers: { "Content-Type": "text/plain" },
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://example.com/text" }, ctx);
+
+    expect(result.success).toBe(true);
+    const data = result.data as { content: string; status: number };
+    // Text content is now wrapped with external content security boundaries
+    expect(data.content).toContain("Hello, world!");
+    expect(data.content).toContain("EXTERNAL_UNTRUSTED_CONTENT");
+    expect(data.content).toContain("[Source: web_fetch]");
+    expect(data.status).toBe(200);
+  });
+
+  it("returns HTML content wrapped with security boundaries for format=html", async () => {
+    const html = "<html><body><p>Content</p></body></html>";
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse(html, {
+          status: 200,
+          headers: { "Content-Type": "text/html" },
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://example.com/page", format: "html" }, ctx);
+
+    expect(result.success).toBe(true);
+    const data = result.data as { content: string; contentType: string };
+    // HTML content is now wrapped with security boundaries
+    expect(data.content).toContain(html);
+    expect(data.content).toContain("EXTERNAL_UNTRUSTED_CONTENT");
+    expect(data.contentType).toBe("text/html");
+  });
+
+  it("parses JSON content with format=json", async () => {
+    const obj = { name: "aria", version: 1 };
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse(JSON.stringify(obj), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch(
+      { url: "https://api.example.com/data", format: "json" },
+      ctx,
+    );
+
+    expect(result.success).toBe(true);
+    const data = result.data as { content: { name: string; version: number } };
+    expect(data.content).toEqual({ name: "aria", version: 1 });
+  });
+
+  it("returns error for invalid JSON with format=json", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(mockResponse("not json {{{", { status: 200 })),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch(
+      { url: "https://example.com/bad-json", format: "json" },
+      ctx,
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("parse JSON");
+  });
+
+  // ---------- Size limits ----------
+
+  it("rejects responses exceeding Content-Length limit", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse("x", {
+          status: 200,
+          headers: { "Content-Length": "999999999" },
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch(
+      { url: "https://example.com/huge", maxSizeBytes: 1024 },
+      ctx,
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("too large");
+  });
+
+  it("rejects chunked responses exceeding streaming size limit", async () => {
+    // Create chunks that exceed a small limit, without Content-Length header
+    const chunk1 = new Uint8Array(600).fill(65); // 'A' * 600
+    const chunk2 = new Uint8Array(600).fill(66); // 'B' * 600
+
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(chunkedResponse([chunk1, chunk2], { status: 200 })),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch(
+      { url: "https://example.com/stream", maxSizeBytes: 1000 },
+      ctx,
+    );
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("exceeds maximum size");
+  });
+
+  it("accepts responses within size limit", async () => {
+    const content = "A".repeat(500);
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(mockResponse(content, { status: 200 })));
+
+    const ctx = createContext();
+    const result = await executeWebFetch(
+      { url: "https://example.com/small", maxSizeBytes: 1024 },
+      ctx,
+    );
+
+    expect(result.success).toBe(true);
+    const data = result.data as { content: string };
+    // Content is now wrapped with security boundaries
+    expect(data.content).toContain(content);
+  });
+
+  // ---------- Custom headers ----------
+
+  it("passes custom headers to the request", async () => {
+    const mockFetch = vi.fn().mockResolvedValue(mockResponse("ok", { status: 200 }));
+    vi.stubGlobal("fetch", mockFetch);
+
+    const ctx = createContext();
+    await executeWebFetch(
+      {
+        url: "https://example.com/api",
+        headers: { Authorization: "Bearer token123", "X-Custom": "value" },
+      },
+      ctx,
+    );
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      "https://example.com/api",
+      expect.objectContaining({
+        headers: { Authorization: "Bearer token123", "X-Custom": "value" },
+      }),
+    );
+  });
+
+  // ---------- Abort signal ----------
+
+  it("handles context abort signal", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockImplementation((_url: string, options?: RequestInit) => {
+        return new Promise((_resolve, reject) => {
+          const signal = options?.signal;
+          if (signal) {
+            signal.addEventListener("abort", () => {
+              const err = new Error("The operation was aborted");
+              err.name = "AbortError";
+              reject(err);
+            });
+          }
+        });
+      }),
+    );
+
+    const abortController = new AbortController();
+    const ctx = createContext({ abortSignal: abortController.signal });
+
+    setTimeout(() => abortController.abort(), 10);
+    const result = await executeWebFetch({ url: "https://example.com/slow" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("cancelled");
+  });
+
+  // ---------- HTTP errors ----------
+
+  it("returns error for non-OK HTTP status", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse("Forbidden", {
+          status: 403,
+          statusText: "Forbidden",
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://example.com/secret" }, ctx);
+
+    expect(result.success).toBe(false);
+    expect(result.message).toContain("403");
+  });
+
+  it("includes contentType in successful response", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        mockResponse("data", {
+          status: 200,
+          headers: { "Content-Type": "text/csv; charset=utf-8" },
+        }),
+      ),
+    );
+
+    const ctx = createContext();
+    const result = await executeWebFetch({ url: "https://example.com/data.csv" }, ctx);
+
+    expect(result.success).toBe(true);
+    const data = result.data as { contentType: string };
+    expect(data.contentType).toBe("text/csv; charset=utf-8");
+  });
+});
+
+// download tool removed in aria-c3x