@ever-works/activepieces-plugin 1.0.11 → 1.0.12

package/dist/index.cjs

@@ -2658,6 +2658,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -2687,23 +2688,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if ((0, import_net.isIP)(v4) === 4) return isPrivateIPv4(v4);
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if ((0, import_net.isIP)(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if ((0, import_net.isIP)(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
   }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
+function isPrivateIPv6(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 

package/dist/index.js

@@ -2631,6 +2631,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -2660,23 +2661,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
-function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if (isIP(v4) === 4) return isPrivateIPv4(v4);
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if (isIP(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (isIP(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
   }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
+function isPrivateIPv6(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ever-works/activepieces-plugin",
-	"version": "1.0.11",
+	"version": "1.0.12",
 	"description": "Activepieces Automation Pipeline Plugin - Delegates Work generation steps to Activepieces flows",
 	"author": {
 		"name": "Ever Co. LTD",
@@ -33,10 +33,10 @@
 		"test:coverage": "vitest run --coverage"
 	},
 	"peerDependencies": {
-		"@ever-works/plugin": "^1.2.8"
+		"@ever-works/plugin": "^1.2.9"
 	},
 	"devDependencies": {
-		"@ever-works/plugin": "^1.2.8",
+		"@ever-works/plugin": "^1.2.9",
 		"@types/node": "^26.6.4",
 		"tsup": "^8.0.0",
 		"typescript": "^5.9.3",
@@ -76,8 +76,8 @@
 		"url": "https://github.com/ever-works/ever-works/issues"
 	},
 	"everworksRelease": {
-		"contentHash": "sha256:9239f14d8e4b7ddd3dbf095113bfb205cf825b1013d3a52b0fa0499ff8f9b04c",
-		"commit": "efd11a2282ea3e514e93f754b9b008543a7cff60",
-		"source": "https://github.com/ever-works/ever-works/tree/efd11a2282ea3e514e93f754b9b008543a7cff60/packages/plugins/activepieces"
+		"contentHash": "sha256:ab45e1abb88fc67ca4be7bfc1067bb433885299fb505a706779a0c7347d43834",
+		"commit": "5b5a17e1cdc02e06383d508a6424a863521fc3e0",
+		"source": "https://github.com/ever-works/ever-works/tree/5b5a17e1cdc02e06383d508a6424a863521fc3e0/packages/plugins/activepieces"
 	}
 }