@forcecalendar/core 2.1.63 → 2.1.64

package/core/ics/ICSHandler.js

@@ -4,7 +4,6 @@
  */
 
 import { ICSParser } from './ICSParser.js';
-import { Event } from '../events/Event.js';
 import { RecurrenceEngineV2 } from '../events/RecurrenceEngineV2.js';
 
 export class ICSHandler {
@@ -180,40 +179,127 @@ export class ICSHandler {
    * @returns {Promise<Object>} Import results
    */
   async importFromURL(url, options = {}) {
-    // Validate URL before fetching to prevent SSRF
-    ICSHandler.validateURL(url);
+    const {
+      requestTimeout = 30000,
+      maxRedirects = 5,
+      maxFileSize = this.parser.maxFileSize || ICSParser.MAX_INPUT_SIZE
+    } = options;
 
     try {
       const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), 30000); // 30s timeout
+      const timeout = setTimeout(() => controller.abort(), requestTimeout);
 
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeout);
+      try {
+        const response = await this.fetchSafeURL(url, {
+          signal: controller.signal,
+          maxRedirects
+        });
 
-      if (!response.ok) {
-        throw new Error(`Failed to fetch ICS: ${response.statusText}`);
-      }
+        if (!response.ok) {
+          throw new Error(`Failed to fetch ICS: ${response.statusText}`);
+        }
 
-      // Validate Content-Type header
-      const contentType = response.headers.get('content-type') || '';
-      const allowedTypes = ['text/calendar', 'text/plain', 'application/octet-stream'];
-      const typeMatch = allowedTypes.some(t => contentType.toLowerCase().includes(t));
-      if (contentType && !typeMatch) {
-        throw new Error(
-          `Unexpected Content-Type: ${contentType}. Expected text/calendar or text/plain`
-        );
-      }
+        // Validate Content-Type header
+        const contentType = response.headers.get('content-type') || '';
+        const allowedTypes = ['text/calendar', 'text/plain', 'application/octet-stream'];
+        const typeMatch = allowedTypes.some(t => contentType.toLowerCase().includes(t));
+        if (contentType && !typeMatch) {
+          throw new Error(
+            `Unexpected Content-Type: ${contentType}. Expected text/calendar or text/plain`
+          );
+        }
+
+        const contentLength = response.headers.get('content-length');
+        if (contentLength && Number(contentLength) > maxFileSize) {
+          throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+        }
 
-      const icsString = await response.text();
-      return this.import(icsString, options);
+        const icsString = await this.readResponseText(response, maxFileSize);
+        return this.import(icsString, options);
+      } finally {
+        clearTimeout(timeout);
+      }
     } catch (error) {
       if (error.name === 'AbortError') {
-        throw new Error('Failed to import from URL: request timed out after 30 seconds');
+        throw new Error(`Failed to import from URL: request timed out after ${requestTimeout}ms`);
       }
       throw new Error(`Failed to import from URL: ${error.message}`);
     }
   }
 
+  /**
+   * Fetch a URL after validating the initial URL and each redirect target.
+   * @private
+   */
+  async fetchSafeURL(url, { signal, maxRedirects }) {
+    if (typeof fetch !== 'function') {
+      throw new Error('fetch API is not available in this environment');
+    }
+
+    let currentURL = url;
+    const manualRedirects = ICSHandler.isNodeRuntime();
+
+    for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
+      await ICSHandler.validateURLForFetch(currentURL);
+
+      const response = await fetch(currentURL, {
+        signal,
+        redirect: manualRedirects ? 'manual' : 'follow'
+      });
+
+      if (
+        !manualRedirects ||
+        response.status < 300 ||
+        response.status >= 400 ||
+        !response.headers.get('location')
+      ) {
+        return response;
+      }
+
+      currentURL = new URL(response.headers.get('location'), currentURL).toString();
+    }
+
+    throw new Error(`Too many redirects while fetching ICS feed (limit ${maxRedirects})`);
+  }
+
+  /**
+   * Read a response body while enforcing a byte limit.
+   * @private
+   */
+  async readResponseText(response, maxFileSize) {
+    if (!response.body || typeof response.body.getReader !== 'function') {
+      const text = await response.text();
+      if (text.length > maxFileSize) {
+        throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+      }
+      return text;
+    }
+
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = '';
+    let done = false;
+
+    while (!done) {
+      const chunk = await reader.read();
+      done = chunk.done;
+      if (done) break;
+
+      const { value } = chunk;
+      received += value.byteLength;
+      if (received > maxFileSize) {
+        await reader.cancel();
+        throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+      }
+
+      text += decoder.decode(value, { stream: true });
+    }
+
+    text += decoder.decode();
+    return text;
+  }
+
   /**
    * Validate a URL for safety (prevent SSRF attacks)
    * @param {string} url - URL to validate
@@ -234,32 +320,123 @@ export class ICSHandler {
       );
     }
 
-    const hostname = parsed.hostname.toLowerCase();
+    if (parsed.username || parsed.password) {
+      throw new Error('URLs with embedded credentials are not allowed');
+    }
 
-    // Block localhost
-    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') {
-      throw new Error('URLs pointing to localhost are not allowed');
+    const hostname = ICSHandler.normalizeHostname(parsed.hostname);
+    if (ICSHandler.isBlockedHostname(hostname) || ICSHandler.isPrivateIPAddress(hostname)) {
+      throw new Error('URLs pointing to private/internal networks are not allowed');
     }
 
-    // Block private/internal IP ranges
-    const privatePatterns = [
-      /^127\./, // 127.0.0.0/8
-      /^10\./, // 10.0.0.0/8
-      /^192\.168\./, // 192.168.0.0/16
-      /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
-      /^169\.254\./, // 169.254.0.0/16 (link-local)
-      /^0\./, // 0.0.0.0/8
-      /^\[?fe80:/i, // IPv6 link-local
-      /^\[?fc00:/i, // IPv6 unique local
-      /^\[?fd/i, // IPv6 unique local
-      /^\[?::1\]?$/ // IPv6 loopback
-    ];
-
-    for (const pattern of privatePatterns) {
-      if (pattern.test(hostname)) {
-        throw new Error('URLs pointing to private/internal networks are not allowed');
+    return parsed;
+  }
+
+  /**
+   * Validate a URL and, in Node runtimes, ensure DNS does not resolve privately.
+   * @param {string} url - URL to validate
+   * @returns {Promise<URL>} Parsed safe URL
+   */
+  static async validateURLForFetch(url) {
+    const parsed = ICSHandler.validateURL(url);
+
+    if (ICSHandler.isNodeRuntime() && !ICSHandler.isIPAddress(parsed.hostname)) {
+      const dns = await import('node:dns/promises');
+      const addresses = await dns.lookup(parsed.hostname, { all: true, verbatim: true });
+
+      for (const address of addresses) {
+        if (ICSHandler.isPrivateIPAddress(address.address)) {
+          throw new Error('URL hostname resolves to a private/internal network address');
+        }
       }
     }
+
+    return parsed;
+  }
+
+  /**
+   * @private
+   */
+  static isNodeRuntime() {
+    return typeof process !== 'undefined' && !!process.versions?.node;
+  }
+
+  /**
+   * @private
+   */
+  static normalizeHostname(hostname) {
+    return String(hostname)
+      .trim()
+      .toLowerCase()
+      .replace(/^\[/, '')
+      .replace(/\]$/, '')
+      .replace(/\.$/, '');
+  }
+
+  /**
+   * @private
+   */
+  static isBlockedHostname(hostname) {
+    return (
+      hostname === 'localhost' ||
+      hostname.endsWith('.localhost') ||
+      hostname === 'metadata.google.internal'
+    );
+  }
+
+  /**
+   * @private
+   */
+  static isIPAddress(hostname) {
+    const normalized = ICSHandler.normalizeHostname(hostname);
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(normalized) || normalized.includes(':');
+  }
+
+  /**
+   * @private
+   */
+  static isPrivateIPAddress(address) {
+    const normalized = ICSHandler.normalizeHostname(address);
+    const ipv4Match = normalized.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+
+    if (ipv4Match) {
+      const octets = ipv4Match.slice(1).map(Number);
+      if (octets.some(octet => octet < 0 || octet > 255)) return true;
+
+      const [first, second] = octets;
+      return (
+        first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        first >= 224 ||
+        (first === 100 && second >= 64 && second <= 127) ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168) ||
+        (first === 198 && (second === 18 || second === 19))
+      );
+    }
+
+    const mappedIPv4 = normalized.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+    if (mappedIPv4) {
+      return ICSHandler.isPrivateIPAddress(mappedIPv4[1]);
+    }
+
+    if (!normalized.includes(':')) {
+      return false;
+    }
+
+    if (normalized === '::' || normalized === '::1') {
+      return true;
+    }
+
+    const firstHextet = parseInt(normalized.split(':')[0] || '0', 16);
+    return (
+      (firstHextet & 0xfe00) === 0xfc00 ||
+      (firstHextet & 0xffc0) === 0xfe80 ||
+      (firstHextet & 0xffc0) === 0xfec0 ||
+      (firstHextet & 0xff00) === 0xff00
+    );
   }
 
   /**

package/core/ics/ICSParser.js

@@ -67,17 +67,15 @@ export class ICSParser {
 
       // Parse property and value
       const colonIndex = line.indexOf(':');
-      const semicolonIndex = line.indexOf(';');
-      const separatorIndex =
-        semicolonIndex > -1 && semicolonIndex < colonIndex ? semicolonIndex : colonIndex;
 
-      if (separatorIndex === -1) continue;
+      if (colonIndex === -1) continue;
 
-      const property = line.substring(0, separatorIndex);
+      const property = line.substring(0, colonIndex);
+      const propertyName = this.parsePropertyParts(property).name;
       const value = line.substring(colonIndex + 1);
 
       // Handle component boundaries
-      if (property === 'BEGIN') {
+      if (propertyName === 'BEGIN') {
         if (value === 'VEVENT') {
           // Enforce event count limit
           if (events.length >= ICSParser.MAX_EVENTS) {
@@ -88,7 +86,7 @@ export class ICSParser {
         } else if (value === 'VALARM') {
           inAlarm = true;
         }
-      } else if (property === 'END') {
+      } else if (propertyName === 'END') {
         if (value === 'VEVENT' && currentEvent) {
           events.push(this.normalizeEvent(currentEvent));
           currentEvent = null;
@@ -154,10 +152,17 @@ export class ICSParser {
         lines.push(`DTEND;VALUE=DATE:${this.formatDate(event.end, true)}`);
       }
     } else {
-      const tzid = event.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone;
-      lines.push(`DTSTART;TZID=${tzid}:${this.formatDate(event.start)}`);
+      const startTimeZone =
+        event.timeZone || event.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone;
+      const endTimeZone = event.endTimeZone || startTimeZone;
+
+      lines.push(
+        `DTSTART;TZID=${this.escapeParamValue(startTimeZone)}:${this.formatDate(event.start)}`
+      );
       if (event.end) {
-        lines.push(`DTEND;TZID=${tzid}:${this.formatDate(event.end)}`);
+        lines.push(
+          `DTEND;TZID=${this.escapeParamValue(endTimeZone)}:${this.formatDate(event.end)}`
+        );
       }
     }
 
@@ -247,8 +252,8 @@ export class ICSParser {
    * @private
    */
   parseProperty(property, value, event) {
-    // Extract actual property name (before parameters)
-    const propName = property.split(';')[0];
+    // Extract actual property name and parameters
+    const { name: propName, params } = this.parsePropertyParts(property);
 
     // Map to event property
     const eventProp = this.propertyMap[propName];
@@ -256,12 +261,29 @@ export class ICSParser {
 
     switch (propName) {
       case 'DTSTART':
-      case 'DTEND':
-        event[eventProp] = this.parseDate(value, property);
-        if (property.includes('VALUE=DATE')) {
+      case 'DTEND': {
+        const parsed = this.parseDate(value, property);
+        event[eventProp] = parsed.date;
+
+        if (parsed.timeZone) {
+          if (propName === 'DTSTART') {
+            event.timeZone = parsed.timeZone;
+          } else {
+            event.endTimeZone = parsed.timeZone;
+          }
+        } else if (params.TZID) {
+          if (propName === 'DTSTART') {
+            event.timeZone = params.TZID;
+          } else {
+            event.endTimeZone = params.TZID;
+          }
+        }
+
+        if (params.VALUE === 'DATE') {
           event.allDay = true;
         }
         break;
+      }
 
       case 'SUMMARY':
       case 'DESCRIPTION':
@@ -313,7 +335,7 @@ export class ICSParser {
 
       case 'EXDATE': {
         if (!event.excludeDates) event.excludeDates = [];
-        const dates = value.split(',').map(d => this.parseDate(d.trim(), property));
+        const dates = value.split(',').map(d => this.parseDate(d.trim(), property).date);
         event.excludeDates.push(...dates.filter(d => d !== null));
         break;
       }
@@ -325,16 +347,18 @@ export class ICSParser {
    * @private
    */
   parseDate(dateString, property = '') {
-    // Remove timezone if present
-    dateString = dateString.replace(/^TZID=[^:]+:/, '');
+    const { params } = this.parsePropertyParts(property);
 
     // Check if it's a date-only value
-    if (property.includes('VALUE=DATE') || dateString.length === 8) {
+    if (params.VALUE === 'DATE' || dateString.length === 8) {
       // YYYYMMDD format
       const year = dateString.substring(0, 4);
       const month = dateString.substring(4, 6);
       const day = dateString.substring(6, 8);
-      return new Date(year, month - 1, day);
+      return {
+        date: new Date(year, month - 1, day),
+        timeZone: null
+      };
     }
 
     // Full datetime: YYYYMMDDTHHMMSS[Z]
@@ -347,10 +371,47 @@ export class ICSParser {
 
     if (dateString.endsWith('Z')) {
       // UTC time
-      return new Date(Date.UTC(year, month, day, hour, minute, second));
+      return {
+        date: new Date(Date.UTC(year, month, day, hour, minute, second)),
+        timeZone: 'UTC'
+      };
     }
-    // Local time
-    return new Date(year, month, day, hour, minute, second);
+
+    // Floating or TZID-bound wall time. The timezone itself is preserved on the
+    // event so Event can convert the wall-clock value to UTC consistently.
+    return {
+      date: new Date(year, month, day, hour, minute, second),
+      timeZone: params.TZID || null
+    };
+  }
+
+  /**
+   * Parse property name and parameters from a line prefix.
+   * @private
+   */
+  parsePropertyParts(property = '') {
+    const parts = property.split(';');
+    const name = (parts.shift() || '').toUpperCase();
+    const params = {};
+
+    for (const part of parts) {
+      const equalsIndex = part.indexOf('=');
+      if (equalsIndex === -1) continue;
+
+      const key = part.substring(0, equalsIndex).toUpperCase();
+      const rawValue = part.substring(equalsIndex + 1);
+      params[key] = rawValue.replace(/^"|"$/g, '');
+    }
+
+    return { name, params };
+  }
+
+  /**
+   * Escape an ICS parameter value.
+   * @private
+   */
+  escapeParamValue(value) {
+    return String(value).replace(/"/g, '');
   }
 
   /**

package/core/index.js

@@ -28,7 +28,7 @@ export { RRuleParser } from './events/RRuleParser.js';
 export { EnhancedCalendar } from './integration/EnhancedCalendar.js';
 
 // Version — keep in sync with package.json
-export const VERSION = '2.1.63';
+export const VERSION = '2.1.64';
 
 // Default export
 export { Calendar as default } from './calendar/Calendar.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forcecalendar/core",
-  "version": "2.1.63",
+  "version": "2.1.64",
   "type": "module",
   "private": false,
   "description": "A modern, lightweight, framework-agnostic calendar engine optimized for Salesforce",