@ever-works/vllm-plugin 1.0.3 → 1.0.4

package/dist/index.cjs

@@ -5019,6 +5019,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -5048,23 +5049,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if (net.isIP(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (net.isIP(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
+  }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
 function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if (net.isIP(v4) === 4) return isPrivateIPv4(v4);
-  }
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 var defaultDnsResolver = (hostname) => dns__namespace.promises.lookup(hostname, { all: true });

package/dist/index.js

@@ -4995,6 +4995,7 @@ function isSafeWebhookUrl(rawUrl) {
   if (host.startsWith("[") && host.endsWith("]")) {
     host = host.slice(1, -1);
   }
+  host = host.replace(/\.+$/, "");
   if (CLOUD_METADATA_HOSTNAMES.has(host)) {
     return false;
   }
@@ -5024,23 +5025,69 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true;
   if (a === 192 && b === 168) return true;
   if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a === 192 && b === 0 && parts[2] === 2) return true;
+  if (a === 198 && b === 51 && parts[2] === 100) return true;
+  if (a === 203 && b === 0 && parts[2] === 113) return true;
   if (a === 100 && b >= 64 && b <= 127) return true;
   if (a >= 224) return true;
   return false;
 }
+function parseIPv6Groups(ip) {
+  let text = ip.trim().toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  if (isIP(text) !== 6) return null;
+  const lastColon = text.lastIndexOf(":");
+  const tail = text.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    if (isIP(tail) !== 4) return null;
+    const [a, b, c, d] = tail.split(".").map((part) => Number(part));
+    text = `${text.slice(0, lastColon + 1)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const rest = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
+  const fill = halves.length === 2 ? 8 - head.length - rest.length : 0;
+  if (fill < 0) return null;
+  const groups = [...head, ...new Array(fill).fill("0"), ...rest].map((group) => parseInt(group, 16));
+  if (groups.length !== 8 || groups.some((group) => Number.isNaN(group) || group < 0 || group > 65535)) {
+    return null;
+  }
+  return groups;
+}
+function ipv4FromGroups(high, low) {
+  return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
+}
+function embeddedIPv4(ip) {
+  const g = parseIPv6Groups(ip);
+  if (!g) return null;
+  const zeros = (from, to) => g.slice(from, to).every((group) => group === 0);
+  if (zeros(0, 5) && g[5] === 65535) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 4) && g[4] === 65535 && g[5] === 0) return ipv4FromGroups(g[6], g[7]);
+  if (zeros(0, 6) && (g[6] !== 0 || g[7] > 1)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zeros(2, 6)) return ipv4FromGroups(g[6], g[7]);
+  if (g[0] === 8194) return ipv4FromGroups(g[1], g[2]);
+  if (g[0] === 8193 && g[1] === 0) return ipv4FromGroups(g[6] ^ 65535, g[7] ^ 65535);
+  return null;
+}
 function isPrivateIPv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  const firstHextet = lower.split(":", 1)[0];
-  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
-    const group0 = parseInt(firstHextet, 16);
-    if ((group0 & 65472) === 65152) return true;
-  }
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.slice("::ffff:".length);
-    if (isIP(v4) === 4) return isPrivateIPv4(v4);
-  }
+  const g = parseIPv6Groups(ip);
+  if (!g) {
+    const lower = ip.toLowerCase();
+    return lower === "::1" || lower === "::" || lower.startsWith("fc") || lower.startsWith("fd");
+  }
+  if (g.every((group) => group === 0)) return true;
+  if (g.slice(0, 7).every((group) => group === 0) && g[7] === 1) return true;
+  if ((g[0] & 65024) === 64512) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  if ((g[0] & 65472) === 65216) return true;
+  if ((g[0] & 65280) === 65280) return true;
+  if (g[0] === 8193 && g[1] === 3512) return true;
+  if (g[0] === 100 && g[1] === 65435 && g[2] === 1) return true;
+  const v4 = embeddedIPv4(ip);
+  if (v4 && isPrivateIPv4(v4)) return true;
   return false;
 }
 var defaultDnsResolver = (hostname) => dns.promises.lookup(hostname, { all: true });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ever-works/vllm-plugin",
-	"version": "1.0.3",
+	"version": "1.0.4",
 	"description": "vLLM AI provider plugin for Ever Works platform",
 	"author": {
 		"name": "Ever Co. LTD",
@@ -32,7 +32,7 @@
 		"test:watch": "vitest"
 	},
 	"dependencies": {
-		"@ever-works/plugin": "^1.2.5",
+		"@ever-works/plugin": "^1.2.9",
 		"@langchain/openai": "^0.6.17",
 		"@langchain/core": "^0.3.80"
 	},
@@ -71,8 +71,8 @@
 		"url": "https://github.com/ever-works/ever-works/issues"
 	},
 	"everworksRelease": {
-		"contentHash": "sha256:0106fc32b53787ae513e0f674c00abc27c7ee067aeec8823544ed7747710ae0c",
-		"commit": "19905c70cf05be3bc523db030597046067cd322a",
-		"source": "https://github.com/ever-works/ever-works/tree/19905c70cf05be3bc523db030597046067cd322a/packages/plugins/vllm"
+		"contentHash": "sha256:89fdb6e141b73de825cd21f8ae3abbc3f87c276788f9b715890bcd6de35546ef",
+		"commit": "5b5a17e1cdc02e06383d508a6424a863521fc3e0",
+		"source": "https://github.com/ever-works/ever-works/tree/5b5a17e1cdc02e06383d508a6424a863521fc3e0/packages/plugins/vllm"
 	}
 }