@codewheel/jsonapi-frontend-client 1.0.0 → 1.0.2

package/README.md

@@ -12,7 +12,7 @@ npm i @codewheel/jsonapi-frontend-client
 
 ## Usage
 
-Set `DRUPAL_BASE_URL`, then:
+Set `DRUPAL_BASE_URL` (must be a full `http(s)://` URL), then:
 
 ```ts
 import { resolvePath, fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
@@ -23,3 +23,17 @@ if (resolved.resolved && resolved.kind === "entity") {
   console.log(doc.data)
 }
 ```
+
+## URL safety (recommended)
+
+By default, `fetchJsonApi()` and `fetchView()` refuse to fetch absolute URLs on a different origin than your `DRUPAL_BASE_URL` (to avoid accidental SSRF in server environments).
+
+If you intentionally need to fetch a cross-origin absolute URL, pass `allowExternalUrls: true`:
+
+```ts
+import { fetchJsonApi } from "@codewheel/jsonapi-frontend-client"
+
+await fetchJsonApi("https://cms.example.com/jsonapi/node/page/...", {
+  allowExternalUrls: true,
+})
+```

package/dist/fetch.d.ts

@@ -13,6 +13,8 @@ export declare function buildViewCacheTags(dataUrl: string): string[];
 export declare function fetchJsonApi<T = JsonApiDocument>(jsonapiPath: string, options?: {
     baseUrl?: string;
     envKey?: string;
+    /** Allow fetching absolute URLs on other origins (default: false). */
+    allowExternalUrls?: boolean;
     include?: string[];
     fields?: Record<string, string[]>;
     revalidate?: number;
@@ -25,6 +27,8 @@ export declare function fetchJsonApi<T = JsonApiDocument>(jsonapiPath: string, o
 export declare function fetchView<T = JsonApiDocument>(dataUrl: string, options?: {
     baseUrl?: string;
     envKey?: string;
+    /** Allow fetching absolute URLs on other origins (default: false). */
+    allowExternalUrls?: boolean;
     /**
      * JSON:API pagination parameters.
      *

package/dist/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,aAAa,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,eAAe,EACpD,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAsCZ;AAED,wBAAsB,SAAS,CAAC,CAAC,GAAG,eAAe,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAyCZ"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuD,MAAM,aAAa,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEzC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBlE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAa5D;AAoBD,wBAAsB,YAAY,CAAC,CAAC,GAAG,eAAe,EACpD,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAsCZ;AAED,wBAAsB,SAAS,CAAC,CAAC,GAAG,eAAe,EACjD,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,GACA,OAAO,CAAC,CAAC,CAAC,CAyCZ"}

package/dist/fetch.js

@@ -34,10 +34,22 @@ export function buildViewCacheTags(dataUrl) {
     tags.push(`view:${viewId}--${displayId}`);
     return tags;
 }
+function buildSafeUrl(input, base, options) {
+    const baseUrl = new URL(base);
+    const url = new URL(input, baseUrl);
+    if (!options?.allowExternalUrls && url.origin !== baseUrl.origin) {
+        throw new Error(`Refusing to fetch a URL from a different origin (${url.origin}) than base (${baseUrl.origin}). ` +
+            "Pass allowExternalUrls: true to override.");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`Unsupported URL protocol "${url.protocol}" (expected http/https)`);
+    }
+    return url;
+}
 export async function fetchJsonApi(jsonapiPath, options) {
     const base = getDrupalBaseUrlFromOptions({ baseUrl: options?.baseUrl, envKey: options?.envKey });
     const fetcher = getFetch(options?.fetch);
-    const url = new URL(jsonapiPath, base);
+    const url = buildSafeUrl(jsonapiPath, base, { allowExternalUrls: options?.allowExternalUrls });
     if (options?.include?.length) {
         url.searchParams.set("include", options.include.join(","));
     }
@@ -68,7 +80,7 @@ export async function fetchJsonApi(jsonapiPath, options) {
 export async function fetchView(dataUrl, options) {
     const base = getDrupalBaseUrlFromOptions({ baseUrl: options?.baseUrl, envKey: options?.envKey });
     const fetcher = getFetch(options?.fetch);
-    const url = new URL(dataUrl, base);
+    const url = buildSafeUrl(dataUrl, base, { allowExternalUrls: options?.allowExternalUrls });
     if (options?.page !== undefined) {
         if (typeof options.page === "number") {
             url.searchParams.set("page[offset]", String(options.page));

package/dist/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IACpC,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAOzF,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAMnG;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAMzD;AAED,wBAAgB,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAOpF"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG;IACpC,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAOzF,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkBnG;AAED,wBAAgB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAMzD;AAED,wBAAgB,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,OAAO,CAOpF"}

package/dist/transport.js

@@ -3,11 +3,21 @@ function getEnvString(key) {
     return typeof value === "string" && value.trim() !== "" ? value : undefined;
 }
 export function getDrupalBaseUrlFromOptions(options) {
-    const baseUrl = options?.baseUrl ?? getEnvString(options?.envKey ?? "DRUPAL_BASE_URL");
-    if (!baseUrl) {
+    const rawBaseUrl = options?.baseUrl ?? getEnvString(options?.envKey ?? "DRUPAL_BASE_URL");
+    if (!rawBaseUrl) {
         throw new Error(`Missing Drupal base URL (pass baseUrl or set ${options?.envKey ?? "DRUPAL_BASE_URL"})`);
     }
-    return baseUrl.replace(/\/$/, "");
+    let parsed;
+    try {
+        parsed = new URL(rawBaseUrl);
+    }
+    catch {
+        throw new Error(`Invalid Drupal base URL "${rawBaseUrl}" (expected http(s) URL)`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid Drupal base URL protocol "${parsed.protocol}" (expected http/https)`);
+    }
+    return parsed.toString().replace(/\/$/, "");
 }
 export function getFetch(fetchLike) {
     const f = fetchLike ?? globalThis.fetch;

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@codewheel/jsonapi-frontend-client",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "TypeScript client helpers for Drupal drupal/jsonapi_frontend",
-  "homepage": "https://github.com/CodeWheel-AI/jsonapi-frontend-client#readme",
+  "homepage": "https://github.com/code-wheel/jsonapi-frontend-client#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/CodeWheel-AI/jsonapi-frontend-client.git"
+    "url": "git+https://github.com/code-wheel/jsonapi-frontend-client.git"
   },
   "bugs": {
-    "url": "https://github.com/CodeWheel-AI/jsonapi-frontend-client/issues"
+    "url": "https://github.com/code-wheel/jsonapi-frontend-client/issues"
   },
   "keywords": [
     "drupal",