@goodandready/dsh-key-rotation 0.8.74 → 0.8.76

package/lib/safe-fetch.js

@@ -1,8 +1,10 @@
-// lib/safe-fetch.js — SSRF-protected HTTP fetch with DNS and IP validation (#354, #411).
+// lib/safe-fetch.js — SSRF-protected HTTP fetch with DNS and IP validation (#354, #411, #557).
 import net from 'node:net';
 import dns from 'node:dns/promises';
 import nodeDns from 'node:dns';
-import { Agent } from 'undici';
+import https from 'node:https';
+import http from 'node:http';
+import { URL } from 'node:url';
 
 export const MAX_IMPORT_BYTES = 1024 * 1024; // 1 MB limit
 export const MAX_REDIRECTS = 5;
@@ -31,7 +33,7 @@ export function parseIpv6Words(ip) {
   const halves = s.split('::');
   if (halves.length > 2) return null;
   const left = halves[0] ? halves[0].split(':').map(x => parseInt(x, 16)) : [];
-  const right = halves.length === 2 && halves[1] ? halves[1].split(':').map(x => parseInt(x, 16)) : [];
+  const right = halves[1] && halves[1] ? halves[1].split(':').map(x => parseInt(x, 16)) : [];
   if (left.some(isNaN) || right.some(isNaN)) return null;
   const missing = 8 - (left.length + right.length);
   if (halves.length === 1 && missing !== 0) return null;
@@ -99,45 +101,61 @@ export function isPrivateOrReservedIp(ip) {
 }
 
 /**
- * Creates an undici Agent with connect-time lookup validation against DNS rebinding / TOCTOU (#411).
+ * Creates a connect-time lookup function that rejects private/reserved IPs on socket establishment (#411, #557).
+ * Prevents DNS Rebinding (TOCTOU) by validating the IP address right when the socket connects.
  * @param {object} [opts]
  * @param {Function} [opts.lookupImpl]
- * @returns {Agent}
+ * @returns {Function}
+ */
+export function createSafeLookup({ lookupImpl = nodeDns.lookup } = {}) {
+  return function safeLookup(hostname, options, callback) {
+    const cb = typeof options === 'function' ? options : callback;
+    const opts = typeof options === 'function' ? {} : (typeof options === 'number' ? { family: options } : (options || {}));
+    lookupImpl(hostname, { ...opts, all: true }, (err, addresses) => {
+      if (err) return cb(err);
+      const list = Array.isArray(addresses) ? addresses : [addresses];
+      for (const item of list) {
+        const addr = typeof item === 'string' ? item : item.address;
+        if (isPrivateOrReservedIp(addr)) {
+          const ssrfErr = new Error(`dsh-key-rotation: connect blocked: host ${hostname} resolves to private or reserved IP ${addr}`);
+          ssrfErr.code = 'SSRF_BLOCKED';
+          return cb(ssrfErr);
+        }
+      }
+      if (!opts.all) {
+        const first = list[0];
+        const addr = typeof first === 'string' ? first : first?.address;
+        const fam = typeof first === 'object' && first?.family ? first.family : (net.isIP(addr) || 4);
+        return cb(null, addr, fam);
+      }
+      return cb(null, addresses);
+    });
+  };
+}
+
+/**
+ * Creates an agent/dispatcher with connect-time lookup validation against DNS rebinding / TOCTOU (#411, #557).
+ * @param {object} [opts]
+ * @param {Function} [opts.lookupImpl]
+ * @returns {object}
  */
 export function createSafeDispatcher({ lookupImpl = nodeDns.lookup } = {}) {
-  return new Agent({
-    connect: {
-      lookup: (hostname, options, callback) => {
-        const cb = typeof options === 'function' ? options : callback;
-        const opts = typeof options === 'function' ? {} : (typeof options === 'number' ? { family: options } : (options || {}));
-        lookupImpl(hostname, { ...opts, all: true }, (err, addresses) => {
-          if (err) return cb(err);
-          const list = Array.isArray(addresses) ? addresses : [addresses];
-          for (const item of list) {
-            const addr = typeof item === 'string' ? item : item.address;
-            if (isPrivateOrReservedIp(addr)) {
-              const ssrfErr = new Error(`dsh-key-rotation: connect blocked: host ${hostname} resolves to private or reserved IP ${addr}`);
-              ssrfErr.code = 'SSRF_BLOCKED';
-              return cb(ssrfErr);
-            }
-          }
-          if (!opts.all) {
-            const first = list[0];
-            const addr = typeof first === 'string' ? first : first?.address;
-            const fam = typeof first === 'object' && first?.family ? first.family : (net.isIP(addr) || 4);
-            return cb(null, addr, fam);
-          }
-          return cb(null, addresses);
-        });
-      },
+  const lookup = createSafeLookup({ lookupImpl });
+  return {
+    options: {
+      connect: { lookup },
     },
-  });
+    connect: { lookup },
+  };
 }
 
 /**
- * Validates a target URL and its hostname/IP against SSRF.
+ * Validates that a URL is safe to fetch before making any network connections.
+ * Requires HTTPS protocol and verifies hostname does not resolve to private/reserved IPs.
  * @param {string} urlString
- * @param {object} options
+ * @param {object} [options]
+ * @param {Function} [options.lookupImpl]
+ * @returns {Promise<URL>}
  */
 export async function assertSafeUrl(urlString, { lookupImpl = dns.lookup } = {}) {
   let urlObj;
@@ -258,37 +276,161 @@ export async function readBoundedJson(resp, maxBytes = MAX_IMPORT_BYTES) {
 }
 
 /**
- * Fetches JSON from a URL with SSRF protection, connect-time rebinding guard, redirect verification, and size bounding.
+ * Performs native HTTPS/HTTP request with connect-time DNS validation against rebinding (#557).
+ */
+function fetchNativeJson(urlObj, { lookup, maxBytes, signal, ca, rejectUnauthorized }) {
+  return new Promise((resolve, reject) => {
+    const isHttps = urlObj.protocol === 'https:';
+    const transport = isHttps ? https : http;
+
+    const reqOpts = {
+      method: 'GET',
+      headers: {
+        accept: 'application/json, text/plain, */*',
+        'user-agent': 'dsh-key-rotation/0.8',
+      },
+      lookup,
+      signal,
+    };
+    if (ca !== undefined) reqOpts.ca = ca;
+    if (rejectUnauthorized !== undefined) reqOpts.rejectUnauthorized = rejectUnauthorized;
+
+    const req = transport.request(urlObj, reqOpts, (res) => {
+      const status = res.statusCode || 0;
+      if ([301, 302, 303, 307, 308].includes(status)) {
+        res.resume(); // discard body
+        return resolve({
+          status,
+          headers: {
+            get: (name) => res.headers[name.toLowerCase()] || null,
+          },
+        });
+      }
+
+      if (status < 200 || status >= 300) {
+        res.resume();
+        const err = new Error(`dsh-key-rotation: fetch returned ${status}`);
+        err.code = 'FETCH_FAILED';
+        err.status = status;
+        return reject(err);
+      }
+
+      const cl = Number(res.headers['content-length']);
+      if (!isNaN(cl) && cl > maxBytes) {
+        res.resume();
+        const err = new Error(`dsh-key-rotation: response exceeds maximum size of ${maxBytes} bytes`);
+        err.code = 'PAYLOAD_TOO_LARGE';
+        return reject(err);
+      }
+
+      const chunks = [];
+      let total = 0;
+      res.on('data', (chunk) => {
+        total += chunk.length;
+        if (total > maxBytes) {
+          res.destroy();
+          const err = new Error(`dsh-key-rotation: response exceeds maximum size of ${maxBytes} bytes`);
+          err.code = 'PAYLOAD_TOO_LARGE';
+          return reject(err);
+        }
+        chunks.push(chunk);
+      });
+
+      res.on('end', () => {
+        try {
+          const bodyStr = Buffer.concat(chunks).toString('utf8');
+          const data = JSON.parse(bodyStr);
+          resolve({ status: 200, ok: true, data });
+        } catch (e) {
+          reject(new Error(`dsh-key-rotation: invalid JSON response: ${e.message}`));
+        }
+      });
+
+      res.on('error', reject);
+    });
+
+    req.on('error', (err) => {
+      reject(err);
+    });
+
+    req.end();
+  });
+}
+
+function isNativeFetch(fn) {
+  if (typeof fn !== 'function') return false;
+  if (fn.mock && typeof fn.mock === 'object') return false;
+  if (fn.constructor?.name === 'AsyncFunction') return false;
+  try {
+    const s = fn.toString();
+    return s.includes('undici') || s.includes('[native code]');
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Fetches JSON from a URL with SSRF protection, connect-time rebinding guard, redirect verification, and size bounding (#411, #557).
  * @param {string} url
  * @param {object} options
  */
 export async function safeFetchJson(url, {
   signal,
-  fetchImpl = globalThis.fetch,
+  fetchImpl,
   lookupImpl = dns.lookup,
   maxBytes = MAX_IMPORT_BYTES,
   redirectsLeft = MAX_REDIRECTS,
   dispatcher,
+  ca,
+  rejectUnauthorized,
 } = {}) {
-  const safeDispatcher = dispatcher ?? (fetchImpl === globalThis.fetch ? createSafeDispatcher() : undefined);
   let currentUrl = url;
+  const mockFetch = fetchImpl || (globalThis.fetch && !isNativeFetch(globalThis.fetch) ? globalThis.fetch : null);
+
+  const safeLookup = dispatcher?.connect?.lookup || dispatcher?.options?.connect?.lookup || createSafeLookup({});
+
   while (true) {
-    await assertSafeUrl(currentUrl, { lookupImpl });
-    const fetchOpts = {
-      signal,
-      redirect: 'manual',
-    };
-    if (safeDispatcher) fetchOpts.dispatcher = safeDispatcher;
-    const resp = await fetchImpl(currentUrl, fetchOpts);
+    const urlObj = await assertSafeUrl(currentUrl, { lookupImpl });
 
-    if ([301, 302, 303, 307, 308].includes(resp.status)) {
+    // If custom test mock fetch is provided or globalThis.fetch was mocked in test
+    if (mockFetch) {
+      const resp = await mockFetch(currentUrl, { signal, redirect: 'manual', dispatcher });
+      if ([301, 302, 303, 307, 308].includes(resp.status)) {
+        if (redirectsLeft <= 0) {
+          const err = new Error('dsh-key-rotation: too many redirects');
+          err.code = 'TOO_MANY_REDIRECTS';
+          throw err;
+        }
+        redirectsLeft--;
+        const loc = resp.headers?.get?.('location');
+        if (!loc) {
+          const err = new Error('dsh-key-rotation: redirect missing Location header');
+          err.code = 'BAD_REDIRECT';
+          throw err;
+        }
+        currentUrl = new URL(loc, currentUrl).href;
+        continue;
+      }
+      if (!resp.ok) {
+        const err = new Error(`dsh-key-rotation: fetch returned ${resp.status}`);
+        err.code = 'FETCH_FAILED';
+        err.status = resp.status;
+        throw err;
+      }
+      return await readBoundedJson(resp, maxBytes);
+    }
+
+    // Native safe request with socket-connect lookup pinning against DNS rebinding (#557)
+    const result = await fetchNativeJson(urlObj, { lookup: safeLookup, maxBytes, signal, ca, rejectUnauthorized });
+
+    if ([301, 302, 303, 307, 308].includes(result.status)) {
       if (redirectsLeft <= 0) {
         const err = new Error('dsh-key-rotation: too many redirects');
         err.code = 'TOO_MANY_REDIRECTS';
         throw err;
       }
       redirectsLeft--;
-      const loc = resp.headers?.get?.('location');
+      const loc = result.headers?.get?.('location');
       if (!loc) {
         const err = new Error('dsh-key-rotation: redirect missing Location header');
         err.code = 'BAD_REDIRECT';
@@ -298,13 +440,6 @@ export async function safeFetchJson(url, {
       continue;
     }
 
-    if (!resp.ok) {
-      const err = new Error(`dsh-key-rotation: fetch returned ${resp.status}`);
-      err.code = 'FETCH_FAILED';
-      err.status = resp.status;
-      throw err;
-    }
-
-    return await readBoundedJson(resp, maxBytes);
+    return result.data;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.74",
+  "version": "0.8.76",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [
@@ -75,7 +75,5 @@
     "@deepseek-ai/schemastery": "^3.18.4",
     "semver": "^7.6.3"
   },
-  "dependencies": {
-    "undici": "^6.29.0"
-  }
+  "dependencies": {}
 }