@aunucore/baileys 1.0.83 → 1.0.85

package/lib/Utils/messages-media.js

@@ -97,6 +97,15 @@ export async function getMediaKeys(buffer, mediaType) {
     };
 }
 /** Extracts video thumb using FFMPEG */
+// AunuBaileys (1.0.85, HB-128): ffmpeg used to run with NO timeout
+// and NO kill, accumulating stderr without bound — a wedged ffmpeg
+// hung generateThumbnail, and with it the Promise.all inside
+// prepareWAMessageMedia, so the video send never settled; a chatty
+// ffmpeg could also grow stderr in memory without limit. Bound
+// both: SIGKILL after the timeout, and keep only the first 64 KiB
+// of stderr (plenty for the error message).
+const FFMPEG_THUMB_TIMEOUT_MS = 30000;
+const FFMPEG_STDERR_CAP_BYTES = 64 * 1024;
 const extractVideoThumb = async (path, destPath, time, size) => new Promise((resolve, reject) => {
     // AunuBaileys: spawn dengan array argumen, tanpa shell (dari @itsliaaa/baileys) —
     // path/waktu/ukuran tidak lagi diinterpolasi ke string perintah shell
@@ -110,12 +119,33 @@ const extractVideoThumb = async (path, destPath, time, size) => new Promise((res
         destPath
     ], { stdio: ['ignore', 'ignore', 'pipe'] });
     const stderrChunks = [];
-    ffmpeg.stderr.on('data', (chunk) => stderrChunks.push(chunk));
-    ffmpeg.on('error', reject);
+    let stderrBytes = 0;
+    ffmpeg.stderr.on('data', (chunk) => {
+        if (stderrBytes >= FFMPEG_STDERR_CAP_BYTES) {
+            return;
+        }
+        const keep = chunk.subarray(0, FFMPEG_STDERR_CAP_BYTES - stderrBytes);
+        stderrChunks.push(keep);
+        stderrBytes += keep.length;
+    });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        ffmpeg.kill('SIGKILL');
+    }, FFMPEG_THUMB_TIMEOUT_MS);
+    timer.unref?.();
+    ffmpeg.on('error', (err) => {
+        clearTimeout(timer);
+        reject(err);
+    });
     ffmpeg.on('close', (code) => {
+        clearTimeout(timer);
         if (code === 0) {
             resolve();
         }
+        else if (timedOut) {
+            reject(new Error(`ffmpeg timed out after ${FFMPEG_THUMB_TIMEOUT_MS}ms while extracting a video thumbnail`));
+        }
         else {
             reject(new Error(`ffmpeg exited with code ${code}: ${Buffer.concat(stderrChunks).toString('utf8').trim()}`));
         }
@@ -179,6 +209,10 @@ export const extractImageThumb = async (bufferOrFilePath, width = 32, maxBytes)
     }
 };
 export const encodeBase64EncodedStringForUpload = (b64) => encodeURIComponent(b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/\=+$/, ''));
+// AunuBaileys (1.0.85, HB-219): bounds for the remote fetch in
+// generateProfilePicture (16 MiB matches the product-image cap).
+const MAX_PROFILE_PICTURE_SOURCE_BYTES = 16 * 1024 * 1024;
+const PROFILE_PICTURE_FETCH_TIMEOUT_MS = 30000;
 export const generateProfilePicture = async (mediaUpload, dimensions) => {
     let buffer;
     const { width: w = 640, height: h = 640 } = dimensions || {};
@@ -187,9 +221,16 @@ export const generateProfilePicture = async (mediaUpload, dimensions) => {
     }
     else {
         // Use getStream to handle all WAMediaUpload types (Buffer, Stream, URL)
-        const { stream } = await getStream(mediaUpload);
-        // Convert the resulting stream to a buffer
-        buffer = await toBuffer(stream);
+        // AunuBaileys (1.0.85, HB-219): a remote URL used to be
+        // buffered with NO size cap and NO timeout — a huge or
+        // never-ending response was accumulated in full before the
+        // image decode finally rejected it (verified: 12 MB of junk
+        // buffered whole, RSS +53 MB), and a stalled server hung
+        // updateProfilePicture forever. Bound both, like the
+        // sticker-pack and product-image paths already do.
+        const { stream } = await getStream(mediaUpload, { timeout: PROFILE_PICTURE_FETCH_TIMEOUT_MS });
+        // Convert the resulting stream to a buffer, with a hard cap
+        buffer = await toBufferWithLimit(stream, MAX_PROFILE_PICTURE_SOURCE_BYTES);
     }
     const lib = await getImageProcessingLibrary();
     let img;
@@ -323,9 +364,20 @@ export const getStream = async (item, opts) => {
     if (Buffer.isBuffer(item)) {
         return { stream: toReadable(item), type: 'buffer' };
     }
+    // AunuBaileys (1.0.85, HB-208): unusable media used to explode
+    // here as raw TypeErrors — 'stream' in undefined/null for a
+    // missing media value, a toString deref for an object with no
+    // usable url, a createReadStream type error for a numeric url.
+    // Reject all of them with a clear Boom 400 instead.
+    if (!item || typeof item !== 'object') {
+        throw new Boom('Invalid media: expected a Buffer, a stream, or an object with a url', { statusCode: 400 });
+    }
     if ('stream' in item) {
         return { stream: item.stream, type: 'readable' };
     }
+    if (typeof item.url !== 'string' && !(item.url instanceof URL)) {
+        throw new Boom('Invalid media: expected a Buffer, a stream, or an object with a url', { statusCode: 400 });
+    }
     const urlStr = item.url.toString();
     if (urlStr.startsWith('data:')) {
         const comma = urlStr.indexOf(',');
@@ -533,7 +585,17 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
                 }
             }
             if (streamableVerdict === null) {
-                head = Buffer.concat([head, data]);
+                // AunuBaileys (1.0.85, HB-220): the scan only ever
+                // reads the leading ~1 KiB (it decides from box
+                // headers/sizes in that prefix and forces a verdict
+                // past AUNU_SIDECAR_SCAN_MAX_BYTES), but the WHOLE
+                // chunk used to be concatenated into `head` and held
+                // for the entire call — and for Buffer input the
+                // whole media arrives as ONE chunk, so `head` was a
+                // full second copy of the media (measured: ~+88 MB
+                // peak RSS on a 48 MB video). Retain only the prefix
+                // the scan can consume; its verdicts are unchanged.
+                head = Buffer.concat([head, data]).subarray(0, AUNU_SIDECAR_SCAN_MAX_BYTES + 32);
                 streamableVerdict = aunuScanStreamable(head);
                 if (streamableVerdict === null && head.length > AUNU_SIDECAR_SCAN_MAX_BYTES) {
                     streamableVerdict = true;
@@ -735,20 +797,37 @@ export const downloadEncryptedContent = async (downloadUrl, { cipherKey, iv, mac
             const decryptLength = toSmallestChunkSize(data.length);
             remainingBytes = data.slice(decryptLength);
             data = data.slice(0, decryptLength);
-            if (!aes) {
-                let ivValue = iv;
-                if (firstBlockIsIV) {
-                    ivValue = data.slice(0, AES_CHUNK_SIZE);
-                    data = data.slice(AES_CHUNK_SIZE);
-                }
-                aes = Crypto.createDecipheriv('aes-256-cbc', cipherKey, ivValue);
-                // if an end byte that is not EOF is specified
-                // stop auto padding (PKCS7) -- otherwise throws an error for decryption
-                if (endByte) {
-                    aes.setAutoPadding(false);
-                }
-            }
             try {
+                if (!aes) {
+                    // AunuBaileys (1.0.85, HB-114/HB-158): on the
+                    // ranged path the IV is carved out of the first
+                    // 16 bytes of the body — when the first chunk(s)
+                    // total less than that, there is nothing to build
+                    // a decipher from yet. createDecipheriv used to
+                    // sit OUTSIDE this try and threw a bare
+                    // "Invalid initialization vector" TypeError for
+                    // exactly that download. Wait for more bytes
+                    // instead (a <16-byte slice means decryptLength
+                    // was 0, so everything is still in
+                    // remainingBytes), and keep the construction
+                    // inside the try so any failure surfaces as a
+                    // proper stream error with context.
+                    if (firstBlockIsIV && data.length < AES_CHUNK_SIZE) {
+                        callback();
+                        return;
+                    }
+                    let ivValue = iv;
+                    if (firstBlockIsIV) {
+                        ivValue = data.slice(0, AES_CHUNK_SIZE);
+                        data = data.slice(AES_CHUNK_SIZE);
+                    }
+                    aes = Crypto.createDecipheriv('aes-256-cbc', cipherKey, ivValue);
+                    // if an end byte that is not EOF is specified
+                    // stop auto padding (PKCS7) -- otherwise throws an error for decryption
+                    if (endByte) {
+                        aes.setAutoPadding(false);
+                    }
+                }
                 pushBytes(aes.update(data), b => this.push(b));
                 callback();
             }
@@ -807,8 +886,18 @@ export function extensionForMediaMessage(message) {
     }
     return extension;
 }
+// AunuBaileys (1.0.85, HB-127): default ceiling for one media-upload POST.
+const MEDIA_UPLOAD_DEFAULT_TIMEOUT_MS = 120000;
 export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, options }, refreshMediaConn) => {
     return async (filePath, { mediaType, fileEncSha256B64, timeoutMs, newsletter }) => {
+        // AunuBaileys (1.0.85, HB-127): timeoutMs used to be a pure
+        // pass-through of the host's mediaUploadTimeoutMs, with no
+        // default anywhere — an upload host that black-holes the
+        // connection (accepts TCP, never speaks) left the POST, and
+        // with it prepareWAMessageMedia -> sendMessage, pending
+        // FOREVER. Sanitise at the boundary: a finite positive
+        // value is honored, anything else gets the default.
+        const effectiveTimeoutMs = typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : MEDIA_UPLOAD_DEFAULT_TIMEOUT_MS;
         // send a query JSON to obtain the url & auth token to upload our media
         let uploadInfo = await refreshMediaConn(false);
         let urls;
@@ -837,7 +926,7 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
                         Origin: DEFAULT_ORIGIN
                     },
                     httpsAgent: fetchAgent,
-                    timeout: timeoutMs,
+                    timeout: effectiveTimeoutMs,
                     responseType: 'json',
                     maxBodyLength: Infinity,
                     maxContentLength: Infinity
@@ -858,6 +947,20 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
             catch (error) {
                 if (axios.isAxiosError(error)) {
                     result = error.response?.data;
+                    // AunuBaileys (1.0.85, HB-137): a 401/403 means
+                    // the media auth itself is stale. The no-URL
+                    // branch above already force-refreshes in that
+                    // situation, but this error branch kept retrying
+                    // the remaining hosts with the SAME dead auth —
+                    // and every later send reused the cached conn
+                    // until its TTL expired by the local clock, so
+                    // all media sends kept failing. Refresh
+                    // (best-effort: a failed refresh keeps the old
+                    // info) so the next host — and the next send —
+                    // uses fresh auth.
+                    if (error.response?.status === 401 || error.response?.status === 403) {
+                        uploadInfo = await refreshMediaConn(true).catch(() => uploadInfo);
+                    }
                 }
                 const isLast = hostname === hosts[uploadInfo.hosts.length - 1]?.hostname;
                 logger.warn({ trace: error.stack, uploadResult: result }, `Error in uploading to ${hostname} ${isLast ? '' : ', retrying...'}`);

package/lib/Utils/messages.js

@@ -94,6 +94,17 @@ export const prepareWAMessageMedia = async (message, options) => {
         media: message[mediaType]
     };
     delete uploadData[mediaType];
+    // AunuBaileys (1.0.85, HB-208 + addendum): reject an unusable
+    // media value HERE, before the cacheable-key computation below
+    // derefs it — a null media used to explode in that computation
+    // itself ('url' in null), and undefined / non-object media as a
+    // raw TypeError further down in getStream. Hosts get a clear
+    // Boom 400 at the boundary instead. ({} and { url: undefined }
+    // pass this check and are rejected by the matching getStream
+    // guard.)
+    if (typeof uploadData.media !== 'object' || uploadData.media === null) {
+        throw new Boom(`Invalid media for "${mediaType}": expected a Buffer, a stream, or an object with a url`, { statusCode: 400 });
+    }
     // check if cacheable + generate cache key
     const cacheableKey = typeof uploadData.media === 'object' &&
         'url' in uploadData.media &&
@@ -421,15 +432,25 @@ async function prepareStickerPackMessage(stickerPack, options) {
                 // AunuBaileys (1.0.71): only load the image library when
                 // a non-WebP sticker actually needs converting — pure
                 // WebP packs used to pay the import cost for nothing.
-                const { sharp } = await loadLib();
-                if (sharp) {
+                const imgLib = await loadLib();
+                if ('sharp' in imgLib && imgLib.sharp) {
                     // Convert to WebP, preserving metadata
-                    webpBuffer = await sharp.default(buffer).webp().toBuffer();
+                    webpBuffer = await imgLib.sharp.default(buffer).webp().toBuffer();
                     // Non-WebP inputs converted to WebP are not animated
                     isAnimated = false;
                 }
+                else if ('image' in imgLib && imgLib.image?.Transformer) {
+                    // AunuBaileys (1.0.85, HB-164): the @napi-rs/image
+                    // backend converts to WebP fine (extractImageThumb
+                    // already uses it) — the pack path used to ignore
+                    // it, so a host with @napi-rs/image but no sharp
+                    // failed EVERY non-WebP sticker (and an all-PNG
+                    // pack failed outright via HB-97).
+                    webpBuffer = await new imgLib.image.Transformer(buffer).webp();
+                    isAnimated = false;
+                }
                 else {
-                    throw new Boom('No image processing library (sharp) available for converting sticker to WebP. Either install sharp or provide stickers in WebP format.');
+                    throw new Boom('No image processing library (sharp or @napi-rs/image) available for converting sticker to WebP. Either install sharp or @napi-rs/image, or provide stickers in WebP format.');
                 }
             }
             if (webpBuffer.length > 1024 * 1024) {
@@ -474,12 +495,17 @@ async function prepareStickerPackMessage(stickerPack, options) {
         coverWebpBuffer = coverBuffer;
     }
     else {
-        const { sharp } = await loadLib();
-        if (sharp) {
-            coverWebpBuffer = await sharp.default(coverBuffer).webp().toBuffer();
+        const coverLib = await loadLib();
+        if ('sharp' in coverLib && coverLib.sharp) {
+            coverWebpBuffer = await coverLib.sharp.default(coverBuffer).webp().toBuffer();
+        }
+        else if ('image' in coverLib && coverLib.image?.Transformer) {
+            // AunuBaileys (1.0.85, HB-164): @napi-rs/image backend,
+            // same gap as the sticker conversion above.
+            coverWebpBuffer = await new coverLib.image.Transformer(coverBuffer).webp();
         }
         else {
-            throw new Boom('No image processing library (sharp) available for converting cover to WebP. Either install sharp or provide cover in WebP format.');
+            throw new Boom('No image processing library (sharp or @napi-rs/image) available for converting cover to WebP. Either install sharp or @napi-rs/image, or provide cover in WebP format.');
         }
     }
     // Add cover to ZIP data
@@ -539,6 +565,13 @@ async function prepareStickerPackMessage(stickerPack, options) {
         if ('sharp' in lib && lib.sharp) {
             thumbnailBuffer = await lib.sharp.default(coverBuffer).resize(252, 252).jpeg().toBuffer();
         }
+        else if ('image' in lib && lib.image?.Transformer) {
+            // AunuBaileys (1.0.85, HB-164): @napi-rs/image backend —
+            // the thumbnail used to fall through to a throw (and a
+            // silently dropped pack thumbnail) on hosts whose only
+            // image library is @napi-rs/image.
+            thumbnailBuffer = await new lib.image.Transformer(coverBuffer).resize(252, 252).jpeg(50);
+        }
         else if ('jimp' in lib && lib.jimp) {
             const jimpImage = await lib.jimp.Jimp.read(coverBuffer);
             thumbnailBuffer = await jimpImage.resize({ w: 252, h: 252 }).getBuffer('image/jpeg');
@@ -1603,6 +1636,15 @@ export const downloadMediaMessage = async (message, type, options, ctx) => {
         }
         const contentType = getContentType(mContent);
         let mediaType = contentType?.replace('Message', '');
+        // AunuBaileys (1.0.85, HB-252): the content type derives
+        // 'stickerPack' from stickerPackMessage, but the HKDF info
+        // mapping only knows the upload-side name 'sticker-pack' —
+        // downloads derived their keys from 'WhatsApp undefined
+        // Keys' and ALWAYS failed with a misleading bad-decrypt
+        // error. Normalise to the name the pack was encrypted with.
+        if (mediaType === 'stickerPack') {
+            mediaType = 'sticker-pack';
+        }
         const media = mContent[contentType];
         if (!media || typeof media !== 'object' || (!('url' in media) && !('thumbnailDirectPath' in media))) {
             throw new Boom(`"${contentType}" message is not a media message`);

package/lib/Utils/safe-fetch.d.ts

@@ -0,0 +1,57 @@
+import type { LookupFunction } from 'net';
+export declare class SafeFetchError extends Error {
+    code: string;
+    host?: string;
+    address?: string;
+    statusCode?: number;
+    limit?: number;
+    constructor(code: string, message: string, extra?: Record<string, unknown>);
+}
+export declare const SAFE_FETCH_DEFAULTS: Readonly<{
+    timeout: 3000;
+    maxRedirects: 5;
+    maxBytes: number;
+}>;
+/** true when `address` must never be contacted. Unparseable input is blocked (fail closed). */
+export declare const isBlockedAddress: (address: string) => boolean;
+export declare const createGuardedLookup: (opts?: {
+    lookup?: LookupFunction;
+    isBlocked?: (address: string) => boolean;
+}) => LookupFunction;
+export type SafeHttpGetOptions = {
+    /** idle/connect timeout per hop in ms (default 3000) */
+    timeout?: number;
+    /** hard deadline for the whole call incl. redirects (default 3 x timeout) */
+    totalTimeout?: number;
+    /** response cap in bytes, applied after decompression (default 1 MiB) */
+    maxBytes?: number;
+    /** 'throw' (default) or 'truncate' when the cap is hit */
+    onLimit?: 'throw' | 'truncate';
+    /** default 5 */
+    maxRedirects?: number;
+    /** 'any' (default) | 'same-host' | 'none'. Every hop is address-checked either way. */
+    redirects?: 'any' | 'same-host' | 'none';
+    headers?: Record<string, string>;
+    /** return false to skip downloading the body */
+    shouldReadBody?: (status: number, headers: Record<string, string>) => boolean;
+    /** explicit opt-out of the address policy (default false) */
+    allowPrivateNetworks?: boolean;
+    /** injection points (host hooks, tests) */
+    lookup?: LookupFunction;
+    isBlocked?: (address: string) => boolean;
+};
+export type SafeHttpGetResult = {
+    url: string;
+    status: number;
+    headers: Record<string, string>;
+    body: Buffer;
+    truncated: boolean;
+    redirects: number;
+};
+export declare function safeHttpGet(input: string | URL, options?: SafeHttpGetOptions): Promise<SafeHttpGetResult>;
+/** Reads width/height from PNG, GIF, JPEG and WebP headers without decoding. null if unknown. */
+export declare const readImageDimensions: (buf: Buffer) => {
+    width: number;
+    height: number;
+} | null;
+//# sourceMappingURL=safe-fetch.d.ts.map