@atproto-labs/fetch-node 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @atproto-labs/fetch-node
 
+## 0.3.4
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto-labs/fetch@0.3.3
+  - @atproto-labs/pipe@0.2.3
+
+## 0.3.3
+
+### Patch Changes
+
+- [#5148](https://github.com/bluesky-social/atproto/pull/5148) [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Wrap all errors thrown through `unicastFetchWrap` in Whatwg fetch like `TypeError`.
+
+- [#5148](https://github.com/bluesky-social/atproto/pull/5148) [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Allow `unicastFetchWrap` to be called without options object
+
+- [#5148](https://github.com/bluesky-social/atproto/pull/5148) [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Rename `isUnicastIp` to `isUnicastIpHostname` (`isUnicastIp` is still exported as deprecated for backwards compatibility).
+
+- [#5148](https://github.com/bluesky-social/atproto/pull/5148) [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Add tests for unicast ip lookup and utilities
+
+- [#5151](https://github.com/bluesky-social/atproto/pull/5151) [`a51c45d`](https://github.com/bluesky-social/atproto/commit/a51c45d38f6bd7b8765f640e564cf921d52162e7) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update dependencies
+
+- [#5148](https://github.com/bluesky-social/atproto/pull/5148) [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88) Thanks [@matthieusieben](https://github.com/matthieusieben)! - `unicastFetchWrap` now cancels request bodies when throwing an error (to avoid resource leak)
+
+- Updated dependencies [[`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88), [`60e9b83`](https://github.com/bluesky-social/atproto/commit/60e9b8391f212c274b1f21991ee2a3a2d14f2f88), [`a51c45d`](https://github.com/bluesky-social/atproto/commit/a51c45d38f6bd7b8765f640e564cf921d52162e7)]:
+  - @atproto-labs/fetch@0.3.2
+  - @atproto-labs/pipe@0.2.2
+
 ## 0.3.2
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export * from '@atproto-labs/fetch';
 export * from './safe.js';
 export * from './unicast.js';
-export * from './util.js';
+export { isUnicastIpHostname, 
+/** @deprecated use {@link isUnicastIpHostname} instead */
+isUnicastIpHostname as isUnicastIp, } from './util.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AAEnC,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AAEnC,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAE5B,OAAO,EACL,mBAAmB;AACnB,0DAA0D;AAC1D,mBAAmB,IAAI,WAAW,GACnC,MAAM,WAAW,CAAA"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export * from '@atproto-labs/fetch';
 export * from './safe.js';
 export * from './unicast.js';
-export * from './util.js';
+export { isUnicastIpHostname, 
+/** @deprecated use {@link isUnicastIpHostname} instead */
+isUnicastIpHostname as isUnicastIp, } from './util.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AAEnC,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA","sourcesContent":["export * from '@atproto-labs/fetch'\n\nexport * from './safe.js'\nexport * from './unicast.js'\nexport * from './util.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AAEnC,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAE5B,OAAO,EACL,mBAAmB;AACnB,0DAA0D;AAC1D,mBAAmB,IAAI,WAAW,GACnC,MAAM,WAAW,CAAA","sourcesContent":["export * from '@atproto-labs/fetch'\n\nexport * from './safe.js'\nexport * from './unicast.js'\n\nexport {\n  isUnicastIpHostname,\n  /** @deprecated use {@link isUnicastIpHostname} instead */\n  isUnicastIpHostname as isUnicastIp,\n} from './util.js'\n"]}

package/dist/unicast.d.ts

@@ -1,5 +1,5 @@
-import dns from 'node:dns';
-import { LookupFunction } from 'node:net';
+import type { LookupOptions } from 'node:dns';
+import type { LookupFunction } from 'node:net';
 import { Fetch, FetchContext } from '@atproto-labs/fetch';
 export type UnicastFetchWrapOptions<C = FetchContext> = {
     fetch?: Fetch<C>;
@@ -7,6 +7,6 @@ export type UnicastFetchWrapOptions<C = FetchContext> = {
 /**
  * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}
  */
-export declare function unicastFetchWrap<C = FetchContext>({ fetch, }: UnicastFetchWrapOptions<C>): Fetch<C>;
-export declare function unicastLookup(hostname: string, options: dns.LookupOptions, callback: Parameters<LookupFunction>[2]): void;
+export declare function unicastFetchWrap<C = FetchContext>({ fetch, }?: UnicastFetchWrapOptions<C>): Fetch<C>;
+export declare function unicastLookup(hostname: string, options: LookupOptions, callback: Parameters<LookupFunction>[2]): void;
 //# sourceMappingURL=unicast.d.ts.map

package/dist/unicast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unicast.d.ts","sourceRoot":"","sources":["../src/unicast.ts"],"names":[],"mappings":"AAAA,OAAO,GAAsB,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAGzC,OAAO,EACL,KAAK,EACL,YAAY,EAIb,MAAM,qBAAqB,CAAA;AAK5B,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,YAAY,IAAI;IACtD,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;CACjB,CAAA;AAKD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,YAAY,EAAE,EACjD,KAAwB,GACzB,EAAE,uBAAuB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAkCvC;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,aAAa,EAC1B,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QA0BxC"}
+{"version":3,"file":"unicast.d.ts","sourceRoot":"","sources":["../src/unicast.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,UAAU,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAK9C,OAAO,EACL,KAAK,EACL,YAAY,EAIb,MAAM,qBAAqB,CAAA;AAK5B,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,YAAY,IAAI;IACtD,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,YAAY,EAAE,EACjD,KAAwB,GACzB,GAAE,uBAAuB,CAAC,CAAC,CAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAwE5C;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QA0BxC"}

package/dist/unicast.js

@@ -1,31 +1,65 @@
-import dns from 'node:dns';
+import { lookup } from 'node:dns';
 import ipaddr from 'ipaddr.js';
-import { Agent } from 'undici';
+import { Agent as Undici6Agent } from 'undici_v6'; // NodeJS 22
+import { Agent as Undici7Agent } from 'undici_v7'; // NodeJS 24
+import { Agent as Undici8Agent } from 'undici_v8'; // NodeJS 26
 import { FetchRequestError, asRequest, extractUrl, } from '@atproto-labs/fetch';
-import { isUnicastIp } from './util.js';
+import { compareVersions, isUnicastIpHostname, parseVersion } from './util.js';
 const { IPv4, IPv6 } = ipaddr;
-const SUPPORTS_REQUEST_INIT_DISPATCHER = Number(process.versions.node.split('.')[0]) >= 20;
 /**
  * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}
  */
-export function unicastFetchWrap({ fetch = globalThis.fetch, }) {
-    if (!SUPPORTS_REQUEST_INIT_DISPATCHER) {
-        throw new Error('Unicast SSRF protection unavailable on your platform. Update to Node.js 22+.');
+export function unicastFetchWrap({ fetch = globalThis.fetch, } = {}) {
+    // @NOTE we parse here instead of top-level to allow version mocking in tests.
+    const nodeUndiciVersion = parseVersion(process.versions.undici);
+    if (!nodeUndiciVersion ||
+        // https://github.com/nodejs/undici/pull/2928
+        compareVersions(nodeUndiciVersion, [6, 11, 1]) < 0) {
+        throw new Error('Unicast SSRF protection requires Node.js 20.6+');
+    }
+    // @NOTE Since major versions of undici are not guaranteed to be backwards
+    // compatible, we need to check the major version and use the appropriate
+    // Agent class for that version, to ensure that the dispatcher interface is
+    // compatible with the version of undici being used.
+    const dispatcher = nodeUndiciVersion[0] === 6
+        ? new Undici6Agent({ connect: { lookup: unicastLookup } })
+        : nodeUndiciVersion[0] === 7
+            ? new Undici7Agent({ connect: { lookup: unicastLookup } })
+            : nodeUndiciVersion[0] === 8
+                ? new Undici8Agent({ connect: { lookup: unicastLookup } })
+                : null;
+    // @NOTE Because this is a security feature, we don't want to fallback to
+    // using Agent8 to "future proof" this package. Although future version of
+    // undici may have a backwards compatible dispatcher interface, we don't want
+    // to assume that and risk a security issue.
+    if (!dispatcher) {
+        throw new Error('This version of @atproto-labs/fetch-node does not support your version of undici. Please upgrade @atproto-labs/fetch-node, and use a version of NodeJS that uses undici 6, 7, or 8 internally.');
     }
-    const dispatcher = new Agent({
-        connect: { lookup: unicastLookup },
-    });
     return async function (input, init) {
-        if (init?.dispatcher) {
-            throw new FetchRequestError(asRequest(input, init), 500, 'SSRF protection cannot be used with a custom request dispatcher');
+        if (init != null && 'dispatcher' in init && init.dispatcher != null) {
+            const request = asRequest(input, init);
+            await request.body?.cancel();
+            const cause = new FetchRequestError(request, 500, 'SSRF protection cannot be used with a custom request dispatcher');
+            // @NOTE Use Whatwg style errors so that the error is similar whether
+            // caused by this line of an error caused by the lookup function
+            throw new TypeError('fetch failed', { cause });
         }
         const url = extractUrl(input);
-        if (url.hostname && isUnicastIp(url.hostname) === false) {
-            throw new FetchRequestError(asRequest(input, init), 400, 'Hostname is a non-unicast address');
+        if (url.hostname && isUnicastIpHostname(url.hostname) === false) {
+            const request = asRequest(input, init);
+            await request.body?.cancel();
+            const cause = new FetchRequestError(request, 400, 'Hostname is a non-unicast address');
+            // @NOTE Use Whatwg style errors so that the error is similar whether
+            // caused by this line of an error caused by the lookup function
+            throw new TypeError('fetch failed', { cause });
         }
-        // @ts-expect-error non-standard option
-        const request = new Request(input, { ...init, dispatcher });
-        return fetch.call(this, request);
+        return fetch.call(this, input, {
+            ...init,
+            // @ts-ignore There is a type mismatch because of undici version
+            // differences, but we know this is safe because we are using the correct
+            // Agent class for the undici version.
+            dispatcher,
+        });
     };
 }
 export function unicastLookup(hostname, options, callback) {
@@ -33,7 +67,7 @@ export function unicastLookup(hostname, options, callback) {
         callback(new Error('Hostname is not a public domain'), []);
         return;
     }
-    dns.lookup(hostname, options, (err, address, family) => {
+    lookup(hostname, options, (err, address, family) => {
         if (err) {
             callback(err, address, family);
         }

package/dist/unicast.js.map

@@ -1 +1 @@
-{"version":3,"file":"unicast.js","sourceRoot":"","sources":["../src/unicast.ts"],"names":[],"mappings":"AAAA,OAAO,GAAsB,MAAM,UAAU,CAAA;AAE7C,OAAO,MAAM,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAGL,iBAAiB,EACjB,SAAS,EACT,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;AAM7B,MAAM,gCAAgC,GACpC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAEnD;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAmB,EACjD,KAAK,GAAG,UAAU,CAAC,KAAK,GACG;IAC3B,IAAI,CAAC,gCAAgC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;KACnC,CAAC,CAAA;IAEF,OAAO,KAAK,WAAW,KAAK,EAAE,IAAI;QAChC,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CACzB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EACtB,GAAG,EACH,iEAAiE,CAClE,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CACzB,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EACtB,GAAG,EACH,mCAAmC,CACpC,CAAA;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,OAA0B,EAC1B,QAAuC;IAEvC,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBACjC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAE7C,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CACN,IAAI,KAAK,CAAC,0CAA0C,CAAC,EACrD,OAAO,EACP,MAAM,CACP,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,GAAG,KAAK,MAAM;QACd,GAAG,KAAK,OAAO;QACf,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,SAAS;QACjB,GAAG,KAAK,SAAS,CAClB,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAA6B;IACjD,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,SAAS,CAAA;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,EAC1B,OAAO,EACP,MAAM,GACQ;IACd,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEnE,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC,aAAa,EAAE,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC","sourcesContent":["import dns, { LookupAddress } from 'node:dns'\nimport { LookupFunction } from 'node:net'\nimport ipaddr from 'ipaddr.js'\nimport { Agent } from 'undici'\nimport {\n  Fetch,\n  FetchContext,\n  FetchRequestError,\n  asRequest,\n  extractUrl,\n} from '@atproto-labs/fetch'\nimport { isUnicastIp } from './util.js'\n\nconst { IPv4, IPv6 } = ipaddr\n\nexport type UnicastFetchWrapOptions<C = FetchContext> = {\n  fetch?: Fetch<C>\n}\n\nconst SUPPORTS_REQUEST_INIT_DISPATCHER =\n  Number(process.versions.node.split('.')[0]) >= 20\n\n/**\n * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}\n */\nexport function unicastFetchWrap<C = FetchContext>({\n  fetch = globalThis.fetch,\n}: UnicastFetchWrapOptions<C>): Fetch<C> {\n  if (!SUPPORTS_REQUEST_INIT_DISPATCHER) {\n    throw new Error(\n      'Unicast SSRF protection unavailable on your platform. Update to Node.js 22+.',\n    )\n  }\n\n  const dispatcher = new Agent({\n    connect: { lookup: unicastLookup },\n  })\n\n  return async function (input, init): Promise<Response> {\n    if (init?.dispatcher) {\n      throw new FetchRequestError(\n        asRequest(input, init),\n        500,\n        'SSRF protection cannot be used with a custom request dispatcher',\n      )\n    }\n\n    const url = extractUrl(input)\n\n    if (url.hostname && isUnicastIp(url.hostname) === false) {\n      throw new FetchRequestError(\n        asRequest(input, init),\n        400,\n        'Hostname is a non-unicast address',\n      )\n    }\n\n    // @ts-expect-error non-standard option\n    const request = new Request(input, { ...init, dispatcher })\n    return fetch.call(this, request)\n  }\n}\n\nexport function unicastLookup(\n  hostname: string,\n  options: dns.LookupOptions,\n  callback: Parameters<LookupFunction>[2],\n) {\n  if (isLocalHostname(hostname)) {\n    callback(new Error('Hostname is not a public domain'), [])\n    return\n  }\n\n  dns.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      const ips = Array.isArray(address)\n        ? address.map(parseLookupAddress)\n        : [parseLookupAddress({ address, family })]\n\n      if (ips.some(isNotUnicast)) {\n        callback(\n          new Error('Hostname resolved to non-unicast address'),\n          address,\n          family,\n        )\n      } else {\n        callback(null, address, family)\n      }\n    }\n  })\n}\n\n/**\n * @param hostname - a syntactically valid hostname\n * @returns whether the hostname is a name typically used for on locale area networks.\n * @note **DO NOT** use for security reasons. Only as heuristic.\n */\nfunction isLocalHostname(hostname: string): boolean {\n  const parts = hostname.split('.')\n  if (parts.length < 2) return true\n\n  const tld = parts.at(-1)!.toLowerCase()\n  return (\n    tld === 'test' ||\n    tld === 'local' ||\n    tld === 'localhost' ||\n    tld === 'invalid' ||\n    tld === 'example'\n  )\n}\n\nfunction isNotUnicast(ip: ipaddr.IPv4 | ipaddr.IPv6): boolean {\n  return ip.range() !== 'unicast'\n}\n\nfunction parseLookupAddress({\n  address,\n  family,\n}: LookupAddress): ipaddr.IPv4 | ipaddr.IPv6 {\n  const ip = family === 4 ? IPv4.parse(address) : IPv6.parse(address)\n\n  if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {\n    return ip.toIPv4Address()\n  } else {\n    return ip\n  }\n}\n"]}
+{"version":3,"file":"unicast.js","sourceRoot":"","sources":["../src/unicast.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEjC,OAAO,MAAM,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,WAAW,CAAA,CAAC,YAAY;AAC9D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,WAAW,CAAA,CAAC,YAAY;AAC9D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,WAAW,CAAA,CAAC,YAAY;AAC9D,OAAO,EAGL,iBAAiB,EACjB,SAAS,EACT,UAAU,GACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE9E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;AAM7B;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAmB,EACjD,KAAK,GAAG,UAAU,CAAC,KAAK,GACzB,GAA+B,EAAE;IAChC,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAE/D,IACE,CAAC,iBAAiB;QAClB,6CAA6C;QAC7C,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,UAAU,GACd,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;QACxB,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC;YAC1D,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC1B,CAAC,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAA;IAEd,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,4CAA4C;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,gMAAgM,CACjM,CAAA;IACH,CAAC;IAED,OAAO,KAAK,WAAoB,KAAK,EAAE,IAAI;QACzC,IAAI,IAAI,IAAI,IAAI,IAAI,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;YAC5B,MAAM,KAAK,GAAG,IAAI,iBAAiB,CACjC,OAAO,EACP,GAAG,EACH,iEAAiE,CAClE,CAAA;YACD,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChD,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,CAAC,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YACtC,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;YAC5B,MAAM,KAAK,GAAG,IAAI,iBAAiB,CACjC,OAAO,EACP,GAAG,EACH,mCAAmC,CACpC,CAAA;YACD,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAChD,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAC7B,GAAG,IAAI;YACP,gEAAgE;YAChE,yEAAyE;YACzE,sCAAsC;YACtC,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,OAAsB,EACtB,QAAuC;IAEvC,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAChC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBACjC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAE7C,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CACN,IAAI,KAAK,CAAC,0CAA0C,CAAC,EACrD,OAAO,EACP,MAAM,CACP,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,GAAG,KAAK,MAAM;QACd,GAAG,KAAK,OAAO;QACf,GAAG,KAAK,WAAW;QACnB,GAAG,KAAK,SAAS;QACjB,GAAG,KAAK,SAAS,CAClB,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAA6B;IACjD,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,SAAS,CAAA;AACjC,CAAC;AAED,SAAS,kBAAkB,CAAC,EAC1B,OAAO,EACP,MAAM,GACQ;IACd,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEnE,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACnD,OAAO,EAAE,CAAC,aAAa,EAAE,CAAA;IAC3B,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC","sourcesContent":["import type { LookupAddress, LookupOptions } from 'node:dns'\nimport { lookup } from 'node:dns'\nimport type { LookupFunction } from 'node:net'\nimport ipaddr from 'ipaddr.js'\nimport { Agent as Undici6Agent } from 'undici_v6' // NodeJS 22\nimport { Agent as Undici7Agent } from 'undici_v7' // NodeJS 24\nimport { Agent as Undici8Agent } from 'undici_v8' // NodeJS 26\nimport {\n  Fetch,\n  FetchContext,\n  FetchRequestError,\n  asRequest,\n  extractUrl,\n} from '@atproto-labs/fetch'\nimport { compareVersions, isUnicastIpHostname, parseVersion } from './util.js'\n\nconst { IPv4, IPv6 } = ipaddr\n\nexport type UnicastFetchWrapOptions<C = FetchContext> = {\n  fetch?: Fetch<C>\n}\n\n/**\n * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}\n */\nexport function unicastFetchWrap<C = FetchContext>({\n  fetch = globalThis.fetch,\n}: UnicastFetchWrapOptions<C> = {}): Fetch<C> {\n  // @NOTE we parse here instead of top-level to allow version mocking in tests.\n  const nodeUndiciVersion = parseVersion(process.versions.undici)\n\n  if (\n    !nodeUndiciVersion ||\n    // https://github.com/nodejs/undici/pull/2928\n    compareVersions(nodeUndiciVersion, [6, 11, 1]) < 0\n  ) {\n    throw new Error('Unicast SSRF protection requires Node.js 20.6+')\n  }\n\n  // @NOTE Since major versions of undici are not guaranteed to be backwards\n  // compatible, we need to check the major version and use the appropriate\n  // Agent class for that version, to ensure that the dispatcher interface is\n  // compatible with the version of undici being used.\n  const dispatcher =\n    nodeUndiciVersion[0] === 6\n      ? new Undici6Agent({ connect: { lookup: unicastLookup } })\n      : nodeUndiciVersion[0] === 7\n        ? new Undici7Agent({ connect: { lookup: unicastLookup } })\n        : nodeUndiciVersion[0] === 8\n          ? new Undici8Agent({ connect: { lookup: unicastLookup } })\n          : null\n\n  // @NOTE Because this is a security feature, we don't want to fallback to\n  // using Agent8 to \"future proof\" this package. Although future version of\n  // undici may have a backwards compatible dispatcher interface, we don't want\n  // to assume that and risk a security issue.\n  if (!dispatcher) {\n    throw new Error(\n      'This version of @atproto-labs/fetch-node does not support your version of undici. Please upgrade @atproto-labs/fetch-node, and use a version of NodeJS that uses undici 6, 7, or 8 internally.',\n    )\n  }\n\n  return async function (this: C, input, init): Promise<Response> {\n    if (init != null && 'dispatcher' in init && init.dispatcher != null) {\n      const request = asRequest(input, init)\n      await request.body?.cancel()\n      const cause = new FetchRequestError(\n        request,\n        500,\n        'SSRF protection cannot be used with a custom request dispatcher',\n      )\n      // @NOTE Use Whatwg style errors so that the error is similar whether\n      // caused by this line of an error caused by the lookup function\n      throw new TypeError('fetch failed', { cause })\n    }\n\n    const url = extractUrl(input)\n\n    if (url.hostname && isUnicastIpHostname(url.hostname) === false) {\n      const request = asRequest(input, init)\n      await request.body?.cancel()\n      const cause = new FetchRequestError(\n        request,\n        400,\n        'Hostname is a non-unicast address',\n      )\n      // @NOTE Use Whatwg style errors so that the error is similar whether\n      // caused by this line of an error caused by the lookup function\n      throw new TypeError('fetch failed', { cause })\n    }\n\n    return fetch.call(this, input, {\n      ...init,\n      // @ts-ignore There is a type mismatch because of undici version\n      // differences, but we know this is safe because we are using the correct\n      // Agent class for the undici version.\n      dispatcher,\n    })\n  }\n}\n\nexport function unicastLookup(\n  hostname: string,\n  options: LookupOptions,\n  callback: Parameters<LookupFunction>[2],\n) {\n  if (isLocalHostname(hostname)) {\n    callback(new Error('Hostname is not a public domain'), [])\n    return\n  }\n\n  lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      const ips = Array.isArray(address)\n        ? address.map(parseLookupAddress)\n        : [parseLookupAddress({ address, family })]\n\n      if (ips.some(isNotUnicast)) {\n        callback(\n          new Error('Hostname resolved to non-unicast address'),\n          address,\n          family,\n        )\n      } else {\n        callback(null, address, family)\n      }\n    }\n  })\n}\n\n/**\n * @param hostname - a syntactically valid hostname\n * @returns whether the hostname is a name typically used for on locale area networks.\n * @note **DO NOT** use for security reasons. Only as heuristic.\n */\nfunction isLocalHostname(hostname: string): boolean {\n  const parts = hostname.split('.')\n  if (parts.length < 2) return true\n\n  const tld = parts.at(-1)!.toLowerCase()\n  return (\n    tld === 'test' ||\n    tld === 'local' ||\n    tld === 'localhost' ||\n    tld === 'invalid' ||\n    tld === 'example'\n  )\n}\n\nfunction isNotUnicast(ip: ipaddr.IPv4 | ipaddr.IPv6): boolean {\n  return ip.range() !== 'unicast'\n}\n\nfunction parseLookupAddress({\n  address,\n  family,\n}: LookupAddress): ipaddr.IPv4 | ipaddr.IPv6 {\n  const ip = family === 4 ? IPv4.parse(address) : IPv6.parse(address)\n\n  if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {\n    return ip.toIPv4Address()\n  } else {\n    return ip\n  }\n}\n"]}

package/dist/util.d.ts

@@ -1,2 +1,5 @@
-export declare function isUnicastIp(hostname: string): boolean | undefined;
+export declare function isUnicastIpHostname(hostname: string): boolean | undefined;
+export type Version = [major: number, minor: number, patch: number];
+export declare function parseVersion(version?: string): Version | undefined;
+export declare function compareVersions(a: Version, b: Version): number;
 //# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAkBA,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAGjE"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAkBA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAGzE;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AACnE,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAIlE;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAM9D"}

package/dist/util.js

@@ -9,8 +9,23 @@ function parseIpHostname(hostname) {
     }
     return undefined;
 }
-export function isUnicastIp(hostname) {
+export function isUnicastIpHostname(hostname) {
     const ip = parseIpHostname(hostname);
     return ip ? ip.range() === 'unicast' : undefined;
 }
+export function parseVersion(version) {
+    const match = version?.match(/^(\d+)\.(\d+)\.(\d+)$/);
+    if (!match)
+        return undefined;
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+export function compareVersions(a, b) {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] < b[i])
+            return -1;
+        if (a[i] > b[i])
+            return 1;
+    }
+    return 0;
+}
 //# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAA;AAE9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;AAE7B,SAAS,eAAe,CACtB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACpC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC","sourcesContent":["import ipaddr from 'ipaddr.js'\n\nconst { IPv4, IPv6 } = ipaddr\n\nfunction parseIpHostname(\n  hostname: string,\n): ipaddr.IPv4 | ipaddr.IPv6 | undefined {\n  if (IPv4.isIPv4(hostname)) {\n    return IPv4.parse(hostname)\n  }\n\n  if (hostname.startsWith('[') && hostname.endsWith(']')) {\n    return IPv6.parse(hostname.slice(1, -1))\n  }\n\n  return undefined\n}\n\nexport function isUnicastIp(hostname: string): boolean | undefined {\n  const ip = parseIpHostname(hostname)\n  return ip ? ip.range() === 'unicast' : undefined\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAA;AAE9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;AAE7B,SAAS,eAAe,CACtB,QAAgB;IAEhB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAA;IACpC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC","sourcesContent":["import ipaddr from 'ipaddr.js'\n\nconst { IPv4, IPv6 } = ipaddr\n\nfunction parseIpHostname(\n  hostname: string,\n): ipaddr.IPv4 | ipaddr.IPv6 | undefined {\n  if (IPv4.isIPv4(hostname)) {\n    return IPv4.parse(hostname)\n  }\n\n  if (hostname.startsWith('[') && hostname.endsWith(']')) {\n    return IPv6.parse(hostname.slice(1, -1))\n  }\n\n  return undefined\n}\n\nexport function isUnicastIpHostname(hostname: string): boolean | undefined {\n  const ip = parseIpHostname(hostname)\n  return ip ? ip.range() === 'unicast' : undefined\n}\n\nexport type Version = [major: number, minor: number, patch: number]\nexport function parseVersion(version?: string): Version | undefined {\n  const match = version?.match(/^(\\d+)\\.(\\d+)\\.(\\d+)$/)\n  if (!match) return undefined\n  return [Number(match[1]), Number(match[2]), Number(match[3])]\n}\n\nexport function compareVersions(a: Version, b: Version): number {\n  for (let i = 0; i < 3; i++) {\n    if (a[i] < b[i]) return -1\n    if (a[i] > b[i]) return 1\n  }\n  return 0\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto-labs/fetch-node",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "license": "MIT",
   "description": "SSRF protection for fetch() in Node.js",
   "keywords": [
@@ -14,6 +14,10 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/internal/fetch-node"
   },
+  "files": [
+    "./dist",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -26,12 +30,17 @@
   },
   "dependencies": {
     "ipaddr.js": "^2.1.0",
-    "undici": "^8.5.0",
-    "@atproto-labs/fetch": "^0.3.1",
-    "@atproto-labs/pipe": "^0.2.1"
+    "undici_v6": "npm:undici@^6.x",
+    "undici_v7": "npm:undici@^7.x",
+    "undici_v8": "npm:undici@^8.x",
+    "@atproto-labs/fetch": "^0.3.3",
+    "@atproto-labs/pipe": "^0.2.3"
+  },
+  "devDependencies": {
+    "vitest": "^4.0.16"
   },
-  "devDependencies": {},
   "scripts": {
-    "build": "tsgo --build tsconfig.json"
+    "build": "tsgo --build tsconfig.json",
+    "test": "vitest run"
   }
 }

package/src/index.ts

@@ -1,5 +0,0 @@
-export * from '@atproto-labs/fetch'
-
-export * from './safe.js'
-export * from './unicast.js'
-export * from './util.js'

package/src/safe.ts

@@ -1,117 +0,0 @@
-import {
-  DEFAULT_FORBIDDEN_DOMAIN_NAMES,
-  Fetch,
-  asRequest,
-  explicitRedirectCheckRequestTransform,
-  fetchMaxSizeProcessor,
-  forbiddenDomainNameRequestTransform,
-  protocolCheckRequestTransform,
-  requireHostHeaderTransform,
-  timedFetch,
-} from '@atproto-labs/fetch'
-import { pipe } from '@atproto-labs/pipe'
-import { UnicastFetchWrapOptions, unicastFetchWrap } from './unicast.js'
-
-export type SafeFetchWrapOptions<C> = UnicastFetchWrapOptions<C> & {
-  responseMaxSize?: number
-  ssrfProtection?: boolean
-  allowCustomPort?: boolean
-  allowData?: boolean
-  allowHttp?: boolean
-  allowIpHost?: boolean
-  allowPrivateIps?: boolean
-  timeout?: number
-  forbiddenDomainNames?: Iterable<string>
-  /**
-   * When `false`, a {@link RequestInit['redirect']} value must be explicitly
-   * provided as second argument to the returned function or requests will fail.
-   *
-   * @default false
-   */
-  allowImplicitRedirect?: boolean
-}
-
-/**
- * Wrap a fetch function with safety checks so that it can be safely used
- * with user provided input (URL).
- *
- * @see {@link https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html}
- *
- * @note When {@link SafeFetchWrapOptions.allowImplicitRedirect} is `false`
- * (default), then the returned function **must** be called setting the second
- * argument's `redirect` property to one of the allowed values. Otherwise, if
- * the returned fetch function is called with a `Request` object (and no
- * explicit `redirect` init object), then the verification code will not be able
- * to determine if the `redirect` property was explicitly set or based on the
- * default value (`follow`), causing it to preventively block the request (throw
- * an error). For this reason, unless you set
- * {@link SafeFetchWrapOptions.allowImplicitRedirect} to `true`, you should
- * **not** wrap the returned function into another function that creates a
- * {@link Request} object before passing it to the function (as a e.g. a logging
- * function would).
- */
-export function safeFetchWrap<C>({
-  fetch = globalThis.fetch as Fetch<C>,
-  responseMaxSize = 512 * 1024, // 512kB
-  ssrfProtection = true,
-  allowCustomPort = !ssrfProtection,
-  allowData = false,
-  allowHttp = !ssrfProtection,
-  allowIpHost = true,
-  allowPrivateIps = !ssrfProtection,
-  timeout = 10e3,
-  forbiddenDomainNames = DEFAULT_FORBIDDEN_DOMAIN_NAMES as Iterable<string>,
-  allowImplicitRedirect = false,
-}: SafeFetchWrapOptions<C> = {}) {
-  return pipe(
-    /**
-     * Require explicit {@link RequestInit['redirect']} mode
-     */
-    allowImplicitRedirect ? asRequest : explicitRedirectCheckRequestTransform(),
-
-    /**
-     * Only requests that will be issued with a "Host" header are allowed.
-     */
-    allowIpHost ? asRequest : requireHostHeaderTransform(),
-
-    /**
-     * Prevent using http:, file: or data: protocols.
-     */
-    protocolCheckRequestTransform({
-      'about:': false,
-      'data:': allowData,
-      'file:': false,
-      'http:': allowHttp && { allowCustomPort },
-      'https:': { allowCustomPort },
-    }),
-
-    /**
-     * Disallow fetching from domains we know are not atproto/OIDC client
-     * implementation. Note that other domains can be blocked by providing a
-     * custom fetch function combined with another
-     * forbiddenDomainNameRequestTransform.
-     */
-    forbiddenDomainNameRequestTransform(forbiddenDomainNames),
-
-    /**
-     * Since we will be fetching from the network based on user provided
-     * input, let's mitigate resource exhaustion attacks by setting a timeout.
-     */
-    timedFetch(
-      timeout,
-
-      /**
-       * Since we will be fetching from the network based on user provided
-       * input, we need to make sure that the request is not vulnerable to SSRF
-       * attacks.
-       */
-      allowPrivateIps ? fetch : unicastFetchWrap({ fetch }),
-    ),
-
-    /**
-     * Since we will be fetching user owned data, we need to make sure that an
-     * attacker cannot force us to download a large amounts of data.
-     */
-    fetchMaxSizeProcessor(responseMaxSize),
-  ) satisfies Fetch<unknown>
-}

package/src/unicast.ts

@@ -1,129 +0,0 @@
-import dns, { LookupAddress } from 'node:dns'
-import { LookupFunction } from 'node:net'
-import ipaddr from 'ipaddr.js'
-import { Agent } from 'undici'
-import {
-  Fetch,
-  FetchContext,
-  FetchRequestError,
-  asRequest,
-  extractUrl,
-} from '@atproto-labs/fetch'
-import { isUnicastIp } from './util.js'
-
-const { IPv4, IPv6 } = ipaddr
-
-export type UnicastFetchWrapOptions<C = FetchContext> = {
-  fetch?: Fetch<C>
-}
-
-const SUPPORTS_REQUEST_INIT_DISPATCHER =
-  Number(process.versions.node.split('.')[0]) >= 20
-
-/**
- * @see {@link https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/}
- */
-export function unicastFetchWrap<C = FetchContext>({
-  fetch = globalThis.fetch,
-}: UnicastFetchWrapOptions<C>): Fetch<C> {
-  if (!SUPPORTS_REQUEST_INIT_DISPATCHER) {
-    throw new Error(
-      'Unicast SSRF protection unavailable on your platform. Update to Node.js 22+.',
-    )
-  }
-
-  const dispatcher = new Agent({
-    connect: { lookup: unicastLookup },
-  })
-
-  return async function (input, init): Promise<Response> {
-    if (init?.dispatcher) {
-      throw new FetchRequestError(
-        asRequest(input, init),
-        500,
-        'SSRF protection cannot be used with a custom request dispatcher',
-      )
-    }
-
-    const url = extractUrl(input)
-
-    if (url.hostname && isUnicastIp(url.hostname) === false) {
-      throw new FetchRequestError(
-        asRequest(input, init),
-        400,
-        'Hostname is a non-unicast address',
-      )
-    }
-
-    // @ts-expect-error non-standard option
-    const request = new Request(input, { ...init, dispatcher })
-    return fetch.call(this, request)
-  }
-}
-
-export function unicastLookup(
-  hostname: string,
-  options: dns.LookupOptions,
-  callback: Parameters<LookupFunction>[2],
-) {
-  if (isLocalHostname(hostname)) {
-    callback(new Error('Hostname is not a public domain'), [])
-    return
-  }
-
-  dns.lookup(hostname, options, (err, address, family) => {
-    if (err) {
-      callback(err, address, family)
-    } else {
-      const ips = Array.isArray(address)
-        ? address.map(parseLookupAddress)
-        : [parseLookupAddress({ address, family })]
-
-      if (ips.some(isNotUnicast)) {
-        callback(
-          new Error('Hostname resolved to non-unicast address'),
-          address,
-          family,
-        )
-      } else {
-        callback(null, address, family)
-      }
-    }
-  })
-}
-
-/**
- * @param hostname - a syntactically valid hostname
- * @returns whether the hostname is a name typically used for on locale area networks.
- * @note **DO NOT** use for security reasons. Only as heuristic.
- */
-function isLocalHostname(hostname: string): boolean {
-  const parts = hostname.split('.')
-  if (parts.length < 2) return true
-
-  const tld = parts.at(-1)!.toLowerCase()
-  return (
-    tld === 'test' ||
-    tld === 'local' ||
-    tld === 'localhost' ||
-    tld === 'invalid' ||
-    tld === 'example'
-  )
-}
-
-function isNotUnicast(ip: ipaddr.IPv4 | ipaddr.IPv6): boolean {
-  return ip.range() !== 'unicast'
-}
-
-function parseLookupAddress({
-  address,
-  family,
-}: LookupAddress): ipaddr.IPv4 | ipaddr.IPv6 {
-  const ip = family === 4 ? IPv4.parse(address) : IPv6.parse(address)
-
-  if (ip instanceof IPv6 && ip.isIPv4MappedAddress()) {
-    return ip.toIPv4Address()
-  } else {
-    return ip
-  }
-}

package/src/util.ts

@@ -1,22 +0,0 @@
-import ipaddr from 'ipaddr.js'
-
-const { IPv4, IPv6 } = ipaddr
-
-function parseIpHostname(
-  hostname: string,
-): ipaddr.IPv4 | ipaddr.IPv6 | undefined {
-  if (IPv4.isIPv4(hostname)) {
-    return IPv4.parse(hostname)
-  }
-
-  if (hostname.startsWith('[') && hostname.endsWith(']')) {
-    return IPv6.parse(hostname.slice(1, -1))
-  }
-
-  return undefined
-}
-
-export function isUnicastIp(hostname: string): boolean | undefined {
-  const ip = parseIpHostname(hostname)
-  return ip ? ip.range() === 'unicast' : undefined
-}

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": ["../../../tsconfig/node.json"],
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-  },
-  "include": ["src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/index.ts","./src/safe.ts","./src/unicast.ts","./src/util.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}