@kubb/core 5.12.0 → 5.12.1

package/dist/{Hookable-Cqx0g2T-.js → Hookable-D3jKB944.js}

@@ -8,6 +8,8 @@ import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:pa
 import { existsSync as existsSync$1 } from "node:fs";
 import { stripVTControlCharacters, styleText } from "node:util";
 import { ast, collectImportedRefNames, collectUsedSchemaNames, extractStringsFromNodes } from "@kubb/ast";
+import dns from "node:dns";
+import net from "node:net";
 import { tmpdir } from "node:os";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -17,7 +19,7 @@ var __name = (target, value) => __defProp(target, "name", {
 });
 //#endregion
 //#region package.json
-var version = "5.12.0";
+var version = "5.12.1";
 //#endregion
 //#region ../../internals/utils/src/casing.ts
 /**
@@ -1243,6 +1245,42 @@ function definePlugin(definition) {
 	});
 }
 //#endregion
+//#region src/publicAddress.ts
+function createBlockList() {
+	const list = new net.BlockList();
+	for (const [address, prefix] of [
+		["0.0.0.0", 8],
+		["10.0.0.0", 8],
+		["100.64.0.0", 10],
+		["127.0.0.0", 8],
+		["169.254.0.0", 16],
+		["172.16.0.0", 12],
+		["192.0.0.0", 24],
+		["192.168.0.0", 16],
+		["198.18.0.0", 15],
+		["224.0.0.0", 3]
+	]) list.addSubnet(address, prefix, "ipv4");
+	for (const [address, prefix] of [
+		["::", 128],
+		["::1", 128],
+		["64:ff9b::", 96],
+		["fc00::", 7],
+		["fe80::", 10],
+		["ff00::", 8]
+	]) list.addSubnet(address, prefix, "ipv6");
+	return list;
+}
+const privateAddresses = createBlockList();
+/**
+* Whether `address` is a routable public IP. Loopback, private, link-local, cloud metadata, and
+* multicast ranges are not, and an IPv4-mapped IPv6 address counts as the IPv4 address it wraps.
+* Pass `blocked` to replace the ranges.
+*/
+function isPublicAddress(address, blocked = privateAddresses) {
+	const family = net.isIP(address);
+	return family !== 0 && !blocked.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+//#endregion
 //#region src/gitInput.ts
 /** Matches a git `input`: the `git+` prefix npm uses for git dependencies. */
 const gitInputRegExp = /^git\+/i;
@@ -1283,12 +1321,54 @@ function parseGitInput(input) {
 	};
 }
 /**
+* The `git -c` settings that confine a fetch to https and to `addresses`: the connection goes to
+* the addresses already checked, whatever the host answers to a second lookup, and a redirect to
+* another host is an error. Needs git 2.37 for the pinning.
+*
+* @internal
+*/
+function publicFetchConfig({ host, port, addresses }) {
+	const pinned = addresses.map((address) => net.isIPv6(address) ? `[${address}]` : address).join(",");
+	const config = [
+		"http.followRedirects=false",
+		"protocol.allow=never",
+		"protocol.https.allow=always"
+	];
+	if (!net.isIP(host)) config.push(`http.curloptResolve=${host}:${port}:${pinned}`);
+	return config.flatMap((setting) => ["-c", setting]);
+}
+async function resolvePublicFetchConfig(repo, signal) {
+	if (!URL.canParse(repo) || new URL(repo).protocol !== "https:") throw gitError("A public git `input` must be an https repository URL, not an ssh, git, or file address.");
+	const url = new URL(repo);
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	const isLiteral = net.isIP(host) !== 0;
+	const addresses = isLiteral ? [host] : (await dns.promises.lookup(host, { all: true })).map(({ address }) => address);
+	if (!addresses.length || addresses.some((address) => !isPublicAddress(address))) throw gitError(`${host} is not a public address, so this git \`input\` is not fetched.`);
+	if (!isLiteral) {
+		const { stdout } = await x("git", ["--version"], {
+			nodeOptions: { signal },
+			throwOnError: true
+		});
+		const [, major = 0, minor = 0] = /(\d+)\.(\d+)/.exec(stdout)?.map(Number) ?? [];
+		if (major < 2 || major === 2 && minor < 37) throw gitError(`Fetching a public git \`input\` needs git 2.37 or newer, found ${stdout.trim()}.`);
+	}
+	return publicFetchConfig({
+		host,
+		port: url.port || "443",
+		addresses
+	});
+}
+/**
 * Fetches one commit of a git repository into a temporary directory with a shallow `git fetch`,
 * so any host and the user's own git credentials work, and relative `$ref` files resolve.
 * Resolves to the spec path on disk and a `dispose` that deletes the checkout.
+*
+* With `publicOnly`, the repository must be an https URL on public addresses, the fetch connects to
+* the addresses checked, and it does not follow a redirect.
 */
-async function checkoutGitInput(input, signal) {
+async function checkoutGitInput(input, signal, { publicOnly = false } = {}) {
 	const { repo, ref, path } = parseGitInput(input);
+	const fetchConfig = publicOnly ? await resolvePublicFetchConfig(repo, signal) : [];
 	const dir = await mkdtemp(join(tmpdir(), "kubb-git-"));
 	const dispose = () => rm(dir, {
 		recursive: true,
@@ -1313,6 +1393,7 @@ async function checkoutGitInput(input, signal) {
 			"false"
 		],
 		[
+			...fetchConfig,
 			"fetch",
 			"--quiet",
 			"--depth",
@@ -2985,6 +3066,6 @@ var Hookable = class {
 	}
 };
 //#endregion
-export { getElapsedMs as A, camelCase as B, useKubb as C, resolveMeta as D, defineExtension as E, read as F, rm$1 as I, write as L, existsSync$1 as M, isPathInside as N, Diagnostics as O, listFiles as P, writeRaw as R, useConfig as S, checkCompatibility as T, __name as V, requirePlugin as _, FileManager as a, setResolver as b, Resolver as c, assertPluginOption as d, definePlugin as f, kubbContext as g, injectFile as h, createNodeCache as i, inParallel as j, formatMs as k, getInputKind as l, addMacro as m, KubbDriver as n, _usingCtx as o, addGenerator as p, pluginNotFoundError as r, createResolver as s, Hookable as t, checkoutGitInput as u, setMacros as v, useOptions as w, tryUseKubb as x, setOptions as y, toError as z };
+export { formatMs as A, toError as B, useConfig as C, defineExtension as D, checkCompatibility as E, listFiles as F, __name as H, read as I, rm$1 as L, inParallel as M, existsSync$1 as N, resolveMeta as O, isPathInside as P, write as R, tryUseKubb as S, useOptions as T, camelCase as V, kubbContext as _, FileManager as a, setOptions as b, Resolver as c, isPublicAddress as d, assertPluginOption as f, injectFile as g, addMacro as h, createNodeCache as i, getElapsedMs as j, Diagnostics as k, getInputKind as l, addGenerator as m, KubbDriver as n, _usingCtx as o, definePlugin as p, pluginNotFoundError as r, createResolver as s, Hookable as t, checkoutGitInput as u, requirePlugin as v, useKubb as w, setResolver as x, setMacros as y, writeRaw as z };
 
-//# sourceMappingURL=Hookable-Cqx0g2T-.js.map
+//# sourceMappingURL=Hookable-D3jKB944.js.map