@kubb/core 5.12.0 → 5.12.1

package/dist/index.cjs

@@ -32,6 +32,10 @@ node_path = __toESM(node_path, 1);
 let node_fs = require("node:fs");
 let node_util = require("node:util");
 let _kubb_ast = require("@kubb/ast");
+let node_dns = require("node:dns");
+node_dns = __toESM(node_dns, 1);
+let node_net = require("node:net");
+node_net = __toESM(node_net, 1);
 let node_os = require("node:os");
 let node_crypto = require("node:crypto");
 let node_readline = require("node:readline");
@@ -41,7 +45,7 @@ unstorage_drivers_fs = __toESM(unstorage_drivers_fs, 1);
 let node_url = require("node:url");
 let node_module = require("node:module");
 //#region package.json
-var version = "5.12.0";
+var version = "5.12.1";
 //#endregion
 //#region ../../internals/utils/src/casing.ts
 /**
@@ -1423,6 +1427,42 @@ function definePlugin(definition) {
 	});
 }
 //#endregion
+//#region src/publicAddress.ts
+function createBlockList() {
+	const list = new node_net.default.BlockList();
+	for (const [address, prefix] of [
+		["0.0.0.0", 8],
+		["10.0.0.0", 8],
+		["100.64.0.0", 10],
+		["127.0.0.0", 8],
+		["169.254.0.0", 16],
+		["172.16.0.0", 12],
+		["192.0.0.0", 24],
+		["192.168.0.0", 16],
+		["198.18.0.0", 15],
+		["224.0.0.0", 3]
+	]) list.addSubnet(address, prefix, "ipv4");
+	for (const [address, prefix] of [
+		["::", 128],
+		["::1", 128],
+		["64:ff9b::", 96],
+		["fc00::", 7],
+		["fe80::", 10],
+		["ff00::", 8]
+	]) list.addSubnet(address, prefix, "ipv6");
+	return list;
+}
+const privateAddresses = createBlockList();
+/**
+* Whether `address` is a routable public IP. Loopback, private, link-local, cloud metadata, and
+* multicast ranges are not, and an IPv4-mapped IPv6 address counts as the IPv4 address it wraps.
+* Pass `blocked` to replace the ranges.
+*/
+function isPublicAddress(address, blocked = privateAddresses) {
+	const family = node_net.default.isIP(address);
+	return family !== 0 && !blocked.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+//#endregion
 //#region src/gitInput.ts
 /** Matches a git `input`: the `git+` prefix npm uses for git dependencies. */
 const gitInputRegExp = /^git\+/i;
@@ -1463,12 +1503,54 @@ function parseGitInput(input) {
 	};
 }
 /**
+* The `git -c` settings that confine a fetch to https and to `addresses`: the connection goes to
+* the addresses already checked, whatever the host answers to a second lookup, and a redirect to
+* another host is an error. Needs git 2.37 for the pinning.
+*
+* @internal
+*/
+function publicFetchConfig({ host, port, addresses }) {
+	const pinned = addresses.map((address) => node_net.default.isIPv6(address) ? `[${address}]` : address).join(",");
+	const config = [
+		"http.followRedirects=false",
+		"protocol.allow=never",
+		"protocol.https.allow=always"
+	];
+	if (!node_net.default.isIP(host)) config.push(`http.curloptResolve=${host}:${port}:${pinned}`);
+	return config.flatMap((setting) => ["-c", setting]);
+}
+async function resolvePublicFetchConfig(repo, signal) {
+	if (!URL.canParse(repo) || new URL(repo).protocol !== "https:") throw gitError("A public git `input` must be an https repository URL, not an ssh, git, or file address.");
+	const url = new URL(repo);
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	const isLiteral = node_net.default.isIP(host) !== 0;
+	const addresses = isLiteral ? [host] : (await node_dns.default.promises.lookup(host, { all: true })).map(({ address }) => address);
+	if (!addresses.length || addresses.some((address) => !isPublicAddress(address))) throw gitError(`${host} is not a public address, so this git \`input\` is not fetched.`);
+	if (!isLiteral) {
+		const { stdout } = await (0, tinyexec.x)("git", ["--version"], {
+			nodeOptions: { signal },
+			throwOnError: true
+		});
+		const [, major = 0, minor = 0] = /(\d+)\.(\d+)/.exec(stdout)?.map(Number) ?? [];
+		if (major < 2 || major === 2 && minor < 37) throw gitError(`Fetching a public git \`input\` needs git 2.37 or newer, found ${stdout.trim()}.`);
+	}
+	return publicFetchConfig({
+		host,
+		port: url.port || "443",
+		addresses
+	});
+}
+/**
 * Fetches one commit of a git repository into a temporary directory with a shallow `git fetch`,
 * so any host and the user's own git credentials work, and relative `$ref` files resolve.
 * Resolves to the spec path on disk and a `dispose` that deletes the checkout.
+*
+* With `publicOnly`, the repository must be an https URL on public addresses, the fetch connects to
+* the addresses checked, and it does not follow a redirect.
 */
-async function checkoutGitInput(input, signal) {
+async function checkoutGitInput(input, signal, { publicOnly = false } = {}) {
 	const { repo, ref, path } = parseGitInput(input);
+	const fetchConfig = publicOnly ? await resolvePublicFetchConfig(repo, signal) : [];
 	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "kubb-git-"));
 	const dispose = () => (0, node_fs_promises.rm)(dir, {
 		recursive: true,
@@ -1493,6 +1575,7 @@ async function checkoutGitInput(input, signal) {
 			"false"
 		],
 		[
+			...fetchConfig,
 			"fetch",
 			"--quiet",
 			"--depth",
@@ -4409,6 +4492,7 @@ exports.htmlReporter = htmlReporter;
 exports.injectFile = injectFile;
 exports.isExtensionManifest = isExtensionManifest;
 exports.isPackageName = isPackageName;
+exports.isPublicAddress = isPublicAddress;
 exports.isRegistryEntry = isRegistryEntry;
 exports.jsonReporter = jsonReporter;
 exports.kubbContext = kubbContext;