@bacnh85/pi-web 0.10.1 → 0.10.3

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.10.3 (2026-09-13)
+
+### Fixed
+
+- **Redirect-aware SSRF guard**: image downloads now use `redirect: "manual"`
+  and re-validate every hop with the private/loopback check — a gateway URL
+  that 302s to an internal host (e.g. cloud metadata) can no longer bypass
+  the guard via fetch's default redirect following. Public redirects still
+  work (relative locations resolved per hop, max 3 hops).
+
+## 0.10.2 (2026-09-13)
+
+### Fixed
+
+- `.gif` downloads inline as `image/gif` (was mislabeled `image/png`).
+- **SSRF guard on gateway-supplied image URLs**: downloads to
+  loopback/private/link-local hosts (e.g. cloud metadata 169.254.169.254)
+  are refused before any request is made — the URL is surfaced instead.
+- **25 MB download cap**: oversized image downloads are not written to disk;
+  the URL is surfaced instead.
+- pi-hub catalog/README description updated to match 0.10.x features.
+
 ## 0.10.1 (2026-09-13)
 
 ### Added

package/extensions/index.ts

@@ -87,13 +87,15 @@ const engineSchema = {
 
 // Saved image file → inline image block (the 0.6.2 vision-loop lesson: the
 // generating model should see its own output).
-async function toImageBlock(file: string): Promise<{ type: "image"; data: string; mimeType: string }> {
+export async function toImageBlock(file: string): Promise<{ type: "image"; data: string; mimeType: string }> {
   const data = (await fs.promises.readFile(file)).toString("base64");
   const lower = file.toLowerCase();
   const mimeType = lower.endsWith(".jpg") || lower.endsWith(".jpeg")
     ? "image/jpeg"
     : lower.endsWith(".webp")
       ? "image/webp"
+      : lower.endsWith(".gif")
+        ? "image/gif"
       : "image/png";
   return { type: "image" as const, data, mimeType };
 }

package/extensions/lib/imageapi.ts

@@ -6,6 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { findEnvValue } from "./config";
+import { isLocalUrl } from "./chrome";
 import {
   describeGeminiError,
   geminiGenerateImage,
@@ -158,8 +159,15 @@ export function imageRateSnapshot(): Record<string, { count: number; day: string
 export interface FetchLike {
   (
     url: string,
-    init?: { method?: string; headers?: Record<string, string>; body?: string; signal?: AbortSignal },
-  ): Promise<{ ok: boolean; status: number; statusText?: string; json(): Promise<unknown>; arrayBuffer(): Promise<ArrayBuffer> }>;
+    init?: { method?: string; headers?: Record<string, string>; body?: string; signal?: AbortSignal; redirect?: string },
+  ): Promise<{
+    ok: boolean;
+    status: number;
+    statusText?: string;
+    headers?: { get(name: string): string | null };
+    json(): Promise<unknown>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+  }>;
 }
 
 export interface ApiImageResult {
@@ -169,6 +177,9 @@ export interface ApiImageResult {
   model?: string;
 }
 
+/** Hard cap on downloaded image size — gateways can point at arbitrary URLs. */
+export const MAX_DOWNLOAD_BYTES = 25 * 1024 * 1024;
+
 export class ImageApiError extends Error {
   constructor(
     public status: number,
@@ -231,6 +242,7 @@ export async function apiGenerateImage(opts: {
     } else if (typeof item?.url === "string" && item.url) {
       // A failed download must not waste the generation: surface the URL.
       try {
+        if (isLocalUrl(item.url)) throw new Error("image host is private/loopback (SSRF-guarded)");
         paths.push(await downloadImage(fetchImpl, item.url, opts.outDir, i, opts.signal, opts.timeoutMs));
       } catch (err) {
         urls.push(item.url);
@@ -258,16 +270,30 @@ async function downloadImage(
   signal?: AbortSignal,
   timeoutMs?: number,
 ): Promise<string> {
-  const res = await raceGuard(fetchImpl(url, { method: "GET", signal }), {
-    signal,
-    timeoutMs: timeoutMs ?? 120_000,
-    label: "web_image download",
-  });
-  if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
+  // fetch follows redirects by default — follow manually and re-validate each
+  // hop, or a gateway URL that 302s to an internal host bypasses the guard.
+  let current = url;
+  for (let hop = 0; ; hop++) {
+    if (hop > 3) throw new Error("too many image redirects");
+    if (isLocalUrl(current)) throw new Error(`image host is private/loopback (SSRF-guarded): ${current}`);
+    const res = await raceGuard(fetchImpl(current, { method: "GET", redirect: "manual", signal }), {
+      signal,
+      timeoutMs: timeoutMs ?? 120_000,
+      label: "web_image download",
+    });
+    if ([301, 302, 303, 307, 308].includes(res.status)) {
+      const loc = res.headers?.get?.("location") ?? null;
+      if (!loc) throw new ImageApiError(res.status, `image redirect ${res.status} without a location header`);
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
   const buf = Buffer.from(await res.arrayBuffer());
+  if (buf.length > MAX_DOWNLOAD_BYTES) throw new Error(`image exceeds the ${MAX_DOWNLOAD_BYTES}-byte download cap`);
   const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFor(url)}`);
   fs.writeFileSync(file, buf);
   return file;
+  }
 }
 
 function extFor(url: string): string {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",