@lunora/browser 1.0.0-alpha.1 → 1.0.0-alpha.10

package/dist/packem_shared/{createBrowser-6RQ-H1k9.mjs → createBrowser-CZmfQ38r.mjs}

@@ -1,3 +1,5 @@
+import { LunoraError } from '@lunora/errors';
+
 const DEFAULT_TIMEOUT_MS = 3e4;
 const MAX_TIMEOUT_MS = 12e4;
 const MAX_VIEWPORT_WIDTH = 3840;
@@ -9,6 +11,7 @@ const IPV6_COMPATIBLE_DOTTED = /^::(\d{1,3}(?:\.\d{1,3}){3})$/;
 const IPV6_COMPATIBLE_HEX = /^::([\da-f]{1,4}):([\da-f]{1,4})$/;
 const IPV6_NAT64_HEX = /^64:ff9b::[\da-f]{1,4}:[\da-f]{1,4}$/;
 const IPV6_BRACKETS = /^\[|\]$/g;
+const TRAILING_DOT = /\.$/;
 const parseIpv4 = (host) => {
   const parts = host.split(".");
   if (parts.length !== 4) {
@@ -67,33 +70,88 @@ const isPrivateIpv6 = (host) => {
   ip.startsWith("fe8") || // fe80::/10 link-local
   ip.startsWith("fe9") || ip.startsWith("fea") || ip.startsWith("feb");
 };
+const DOH_ENDPOINT = "https://cloudflare-dns.com/dns-query";
+const DOH_TIMEOUT_MS = 5e3;
+const DNS_TYPE_A = 1;
+const DNS_TYPE_AAAA = 28;
+const normalizeHost = (host) => host.replaceAll(IPV6_BRACKETS, "").replace(TRAILING_DOT, "").toLowerCase();
+const isPrivateResolvedIp = (data, type) => {
+  if (type === DNS_TYPE_A) {
+    const v4 = parseIpv4(data);
+    return v4 === void 0 || isPrivateIpv4(v4);
+  }
+  return isPrivateIpv6(data.toLowerCase());
+};
+const dohLookup = async (hostname, type, timeoutMs = DOH_TIMEOUT_MS) => {
+  try {
+    const response = await fetch(`${DOH_ENDPOINT}?name=${encodeURIComponent(hostname)}&type=${String(type)}`, {
+      headers: { accept: "application/dns-json" },
+      // Bound the lookup so a stalled resolver can't hang the worker; an
+      // abort surfaces as a rejection caught below → `undefined` → the
+      // caller falls back to the (already-passed) string guard.
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!response.ok) {
+      return void 0;
+    }
+    const body = await response.json();
+    return body.Answer ?? [];
+  } catch {
+    return void 0;
+  }
+};
+const assertResolvedHostIsPublic = async (target, timeoutMs = DOH_TIMEOUT_MS) => {
+  const host = normalizeHost(new URL(target).hostname);
+  if (host.includes(":") || parseIpv4(host) !== void 0) {
+    return;
+  }
+  const [aRecords, aaaaRecords] = await Promise.all([dohLookup(host, DNS_TYPE_A, timeoutMs), dohLookup(host, DNS_TYPE_AAAA, timeoutMs)]);
+  if (aRecords === void 0 && aaaaRecords === void 0) {
+    return;
+  }
+  for (const answer of [...aRecords ?? [], ...aaaaRecords ?? []]) {
+    if ((answer.type === DNS_TYPE_A || answer.type === DNS_TYPE_AAAA) && isPrivateResolvedIp(answer.data, answer.type)) {
+      throw new LunoraError(
+        "FORBIDDEN",
+        `@lunora/browser: url host "${host}" resolves to a private/internal address (${answer.data}); refusing to navigate (DNS-rebinding guard)`
+      );
+    }
+  }
+};
 const isPrivateHostname = (host) => host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal") || host.endsWith(".home.arpa");
 const isPrivateTarget = (parsed) => {
-  const host = parsed.hostname.replaceAll(IPV6_BRACKETS, "");
+  const host = parsed.hostname.replaceAll(IPV6_BRACKETS, "").replace(TRAILING_DOT, "");
   if (host.includes(":")) {
     return isPrivateIpv6(host);
   }
   const v4 = parseIpv4(host);
   return v4 === void 0 ? isPrivateHostname(host.toLowerCase()) : isPrivateIpv4(v4);
 };
-const validateUrl = (url, allowPrivateTargets) => {
+const validateUrl = (url, allowPrivateTargets, allowedHosts) => {
   if (typeof url !== "string" || url.length === 0) {
-    throw new Error("@lunora/browser: url must be a non-empty string");
+    throw new LunoraError("BAD_REQUEST", "@lunora/browser: url must be a non-empty string");
   }
   let parsed;
   try {
     parsed = new URL(url);
   } catch {
-    throw new Error(`@lunora/browser: url must be an absolute http(s) URL (got "${url}")`);
+    throw new LunoraError("BAD_REQUEST", `@lunora/browser: url must be an absolute http(s) URL (got "${url}")`);
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`@lunora/browser: url protocol must be http(s) (got "${parsed.protocol}")`);
+    throw new LunoraError("BAD_REQUEST", `@lunora/browser: url protocol must be http(s) (got "${parsed.protocol}")`);
   }
   if (parsed.username !== "" || parsed.password !== "") {
-    throw new Error("@lunora/browser: url must not embed credentials (strip the `user:pass@` userinfo)");
+    throw new LunoraError("BAD_REQUEST", "@lunora/browser: url must not embed credentials (strip the `user:pass@` userinfo)");
+  }
+  if (allowedHosts && allowedHosts.length > 0) {
+    const host = normalizeHost(parsed.hostname);
+    if (!allowedHosts.some((entry) => normalizeHost(entry) === host)) {
+      throw new LunoraError("FORBIDDEN", `@lunora/browser: url host "${parsed.hostname}" is not in the configured allowedHosts allowlist`);
+    }
   }
   if (!allowPrivateTargets && isPrivateTarget(parsed)) {
-    throw new Error(
+    throw new LunoraError(
+      "FORBIDDEN",
       `@lunora/browser: url host "${parsed.hostname}" is a private/internal address; pass createBrowser({ …, allowPrivateTargets: true }) to allow it`
     );
   }
@@ -116,13 +174,35 @@ const resolveTimeout = (callTimeout, factoryTimeout) => {
   const safe = Number.isFinite(requested) ? requested : DEFAULT_TIMEOUT_MS;
   return Math.min(Math.max(1, Math.floor(safe)), MAX_TIMEOUT_MS);
 };
+const withDeadline = async (operation, timeoutMs) => {
+  let timer;
+  try {
+    return await Promise.race([
+      operation(),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          reject(
+            new LunoraError("BROWSER_TIMEOUT", `@lunora/browser: navigation + operation exceeded the ${String(timeoutMs)}ms timeout budget`, {
+              status: 504
+            })
+          );
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) {
+      clearTimeout(timer);
+    }
+  }
+};
 const createBrowser = (options) => {
   if (!options.binding) {
-    throw new Error("@lunora/browser: `binding` is required (env.BROWSER)");
+    throw new TypeError("@lunora/browser: `binding` is required (env.BROWSER)");
   }
   const getLaunch = () => {
     if (!options.launch) {
-      throw new Error(
+      throw new LunoraError(
+        "INTERNAL",
         '@lunora/browser: `launch` is not available — install the `@cloudflare/playwright` peer dependency. The generated worker wires it for you; outside codegen pass it via createBrowser({ binding, launch }) (import { launch } from "@cloudflare/playwright").'
       );
     }
@@ -140,16 +220,69 @@ const createBrowser = (options) => {
     }
   };
   const withPage = async (url, navigate, use, viewport) => {
-    const target = validateUrl(url, options.allowPrivateTargets ?? false);
+    const allowPrivateTargets = options.allowPrivateTargets ?? false;
+    const target = validateUrl(url, allowPrivateTargets, options.allowedHosts);
     const timeout = resolveTimeout(navigate.timeoutMs, options.timeoutMs);
+    const resolveDns = options.resolveDns ?? false;
+    const dohTimeout = Math.min(timeout, DOH_TIMEOUT_MS);
+    if (!allowPrivateTargets && resolveDns) {
+      await assertResolvedHostIsPublic(target, dohTimeout);
+    }
+    const assertNavigationAllowed = async (requestUrl) => {
+      validateUrl(requestUrl, allowPrivateTargets, options.allowedHosts);
+      if (!allowPrivateTargets && resolveDns) {
+        await assertResolvedHostIsPublic(requestUrl, dohTimeout);
+      }
+    };
+    const isBlockedSubresource = (rawUrl) => {
+      let parsed;
+      try {
+        parsed = new URL(rawUrl);
+      } catch {
+        return false;
+      }
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return false;
+      }
+      if (options.allowedHosts && options.allowedHosts.length > 0) {
+        const host = normalizeHost(parsed.hostname);
+        if (!options.allowedHosts.some((entry) => normalizeHost(entry) === host)) {
+          return true;
+        }
+      }
+      return isPrivateTarget(parsed);
+    };
     return withBrowser(async (browser) => {
       const context = await browser.newContext();
       const page = await context.newPage();
+      if (page.route && (!allowPrivateTargets || (options.allowedHosts?.length ?? 0) > 0)) {
+        await page.route("**/*", async (route) => {
+          const request = route.request();
+          const isNavigation = request.isNavigationRequest?.() ?? true;
+          if (!isNavigation) {
+            if (isBlockedSubresource(request.url())) {
+              await route.abort("blockedbyclient");
+              return;
+            }
+            await route.continue();
+            return;
+          }
+          try {
+            await assertNavigationAllowed(request.url());
+          } catch {
+            await route.abort("blockedbyclient");
+            return;
+          }
+          await route.continue();
+        });
+      }
       if (viewport && page.setViewportSize) {
         await page.setViewportSize(clampViewport(viewport));
       }
-      await page.goto(target, { timeout, waitUntil: navigate.waitUntil ?? "load" });
-      return use(page);
+      return withDeadline(async () => {
+        await page.goto(target, { timeout, waitUntil: navigate.waitUntil ?? "load" });
+        return use(page);
+      }, timeout);
     });
   };
   const screenshot = async (url, screenshotOptions = {}) => withPage(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/browser",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.10",
   "description": "Cloudflare Browser Rendering for Lunora: ctx.browser screenshots, PDF, and scraping in actions",
   "keywords": [
     "browser-rendering",
@@ -25,7 +25,7 @@
     "directory": "packages/browser"
   },
   "files": [
-    "dist",
+    "./dist",
     "__assets__",
     "README.md",
     "LICENSE.md"
@@ -45,6 +45,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "dependencies": {
+    "@lunora/errors": "1.0.0-alpha.7"
+  },
   "peerDependencies": {
     "@cloudflare/playwright": ">=1.0.0"
   },