@bacnh85/pi-web 0.10.2 → 0.10.4

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.10.4 (2026-09-13)
+
+### Fixed
+
+- **Truthful image extensions**: saved files are typed by magic bytes, not
+  URL/file extension — Z.ai GLM-Image serves JPEG behind a `.png` URL, which
+  previously produced mislabeled files and inline blocks.
+
+## 0.10.3 (2026-09-13)
+
+### Fixed
+
+- **Redirect-aware SSRF guard**: image downloads now use `redirect: "manual"`
+  and re-validate every hop with the private/loopback check — a gateway URL
+  that 302s to an internal host (e.g. cloud metadata) can no longer bypass
+  the guard via fetch's default redirect following. Public redirects still
+  work (relative locations resolved per hop, max 3 hops).
+
 ## 0.10.2 (2026-09-13)
 
 ### Fixed

package/extensions/lib/imageapi.ts

@@ -159,8 +159,15 @@ export function imageRateSnapshot(): Record<string, { count: number; day: string
 export interface FetchLike {
   (
     url: string,
-    init?: { method?: string; headers?: Record<string, string>; body?: string; signal?: AbortSignal },
-  ): Promise<{ ok: boolean; status: number; statusText?: string; json(): Promise<unknown>; arrayBuffer(): Promise<ArrayBuffer> }>;
+    init?: { method?: string; headers?: Record<string, string>; body?: string; signal?: AbortSignal; redirect?: string },
+  ): Promise<{
+    ok: boolean;
+    status: number;
+    statusText?: string;
+    headers?: { get(name: string): string | null };
+    json(): Promise<unknown>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+  }>;
 }
 
 export interface ApiImageResult {
@@ -231,7 +238,7 @@ export async function apiGenerateImage(opts: {
   for (let i = 0; i < items.length; i++) {
     const item = items[i];
     if (typeof item?.b64_json === "string" && item.b64_json) {
-      paths.push(writeB64(opts.outDir, item.b64_json, i));
+      paths.push(writeB64(opts.outDir, Buffer.from(item.b64_json, "base64"), i));
     } else if (typeof item?.url === "string" && item.url) {
       // A failed download must not waste the generation: surface the URL.
       try {
@@ -249,9 +256,19 @@ export async function apiGenerateImage(opts: {
   return { paths, urls, model: typeof payload?.model === "string" ? payload.model : opts.model };
 }
 
-function writeB64(outDir: string, b64: string, i: number): string {
-  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}.png`);
-  fs.writeFileSync(file, Buffer.from(b64, "base64"));
+// Some gateways serve JPEG/WebP bytes behind a .png URL (Z.ai GLM-Image does) —
+// trust the magic bytes, not the URL/file extension.
+function extFromBytes(buf: Buffer, fallback: string): string {
+  if (buf.length >= 4 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) return ".png";
+  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return ".jpg";
+  if (buf.length >= 6 && buf.toString("ascii", 0, 3) === "GIF") return ".gif";
+  if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return ".webp";
+  return fallback;
+}
+
+function writeB64(outDir: string, buf: Buffer, i: number): string {
+  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFromBytes(buf, ".png")}`);
+  fs.writeFileSync(file, buf);
   return file;
 }
 
@@ -263,17 +280,30 @@ async function downloadImage(
   signal?: AbortSignal,
   timeoutMs?: number,
 ): Promise<string> {
-  const res = await raceGuard(fetchImpl(url, { method: "GET", signal }), {
-    signal,
-    timeoutMs: timeoutMs ?? 120_000,
-    label: "web_image download",
-  });
-  if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
+  // fetch follows redirects by default — follow manually and re-validate each
+  // hop, or a gateway URL that 302s to an internal host bypasses the guard.
+  let current = url;
+  for (let hop = 0; ; hop++) {
+    if (hop > 3) throw new Error("too many image redirects");
+    if (isLocalUrl(current)) throw new Error(`image host is private/loopback (SSRF-guarded): ${current}`);
+    const res = await raceGuard(fetchImpl(current, { method: "GET", redirect: "manual", signal }), {
+      signal,
+      timeoutMs: timeoutMs ?? 120_000,
+      label: "web_image download",
+    });
+    if ([301, 302, 303, 307, 308].includes(res.status)) {
+      const loc = res.headers?.get?.("location") ?? null;
+      if (!loc) throw new ImageApiError(res.status, `image redirect ${res.status} without a location header`);
+      current = new URL(loc, current).toString();
+      continue;
+    }
+    if (!res.ok) throw new ImageApiError(res.status, `image download failed (HTTP ${res.status})`);
   const buf = Buffer.from(await res.arrayBuffer());
   if (buf.length > MAX_DOWNLOAD_BYTES) throw new Error(`image exceeds the ${MAX_DOWNLOAD_BYTES}-byte download cap`);
-  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFor(url)}`);
+  const file = path.join(outDir, `pi-web-image-${randomUUID().slice(0, 8)}-${i}${extFromBytes(buf, extFor(url))}`);
   fs.writeFileSync(file, buf);
   return file;
+  }
 }
 
 function extFor(url: string): string {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bacnh85/pi-web",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Pi extension for web search, page extraction, Firecrawl scraping/crawling, Crawl4AI headless browser crawling, Gemini web-tier research, free upstream image generation, and one-off gateway chat.",
   "type": "module",
   "license": "MIT",