@mablhq/playwright-tools 2.49.1

package/execution/index.js.LICENSE.txt

@@ -0,0 +1,254 @@
+/*
+object-assign
+(c) Sindre Sorhus
+@license MIT
+*/
+
+/*!
+ * Copyright (c) 2015, Salesforce.com, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of Salesforce.com nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*!
+ * Copyright (c) 2018, Salesforce.com, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of Salesforce.com nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*!
+ * Determine if an object is a Buffer
+ *
+ * @author   Feross Aboukhadijeh <https://feross.org>
+ * @license  MIT
+ */
+
+/*!
+ * Tmp
+ *
+ * Copyright (c) 2011-2017 KARASZI Istvan <github@spam.raszi.hu>
+ *
+ * MIT Licensed
+ */
+
+/*!
+ * accepts
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * base64id v0.1.0
+ */
+
+/*!
+ * bytes
+ * Copyright(c) 2012-2014 TJ Holowaychuk
+ * Copyright(c) 2015 Jed Watson
+ * MIT Licensed
+ */
+
+/*!
+ * content-disposition
+ * Copyright(c) 2014 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * cookie
+ * Copyright(c) 2012-2014 Roman Shtylman
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * encodeurl
+ * Copyright(c) 2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * mime-db
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015-2022 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * mime-db
+ * Copyright(c) 2014 Jonathan Ong
+ * MIT Licensed
+ */
+
+/*!
+ * mime-types
+ * Copyright(c) 2014 Jonathan Ong
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * negotiator
+ * Copyright(c) 2012 Federico Romero
+ * Copyright(c) 2012-2014 Isaac Z. Schlueter
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * range-parser
+ * Copyright(c) 2012-2014 TJ Holowaychuk
+ * Copyright(c) 2015-2016 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*!
+ * vary
+ * Copyright(c) 2014-2017 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/*! *****************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+
+/*! axe v4.8.3
+ * Copyright (c) 2015 - 2023 Deque Systems, Inc.
+ *
+ * Your use of this Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * This entire copyright notice must appear in every copy of this file you
+ * distribute or in any file that contains substantial portions of this source
+ * code.
+ */
+
+/*! https://mths.be/utf8js v2.1.2 by @mathias */
+
+/*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */
+
+/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
+
+/**
+ * @license
+ * Lodash <https://lodash.com/>
+ * Copyright OpenJS Foundation and other contributors <https://openjsf.org/>
+ * Released under MIT license <https://lodash.com/license>
+ * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
+ * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
+ */
+
+/**
+ * @license Complex.js v2.1.1 12/05/2020
+ *
+ * Copyright (c) 2020, Robert Eisele (robert@xarg.org)
+ * Dual licensed under the MIT or GPL Version 2 licenses.
+ **/
+
+/**
+ * @license Copyright 2016 Google Inc. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+ */
+
+/**
+ * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+ */
+
+/**
+ * @license Copyright 2017 Google Inc. All Rights Reserved.
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+ */
+
+/**
+ * @license Fraction.js v4.2.0 05/03/2022
+ * https://www.xarg.org/2014/03/rational-numbers-in-javascript/
+ *
+ * Copyright (c) 2021, Robert Eisele (robert@xarg.org)
+ * Dual licensed under the MIT or GPL Version 2 licenses.
+ **/
+
+/**
+ * Wrapper for built-in http.js to emulate the browser XMLHttpRequest object.
+ *
+ * This can be used with JS designed for browsers to improve reuse of code and
+ * allow the use of existing libraries.
+ *
+ * Usage: include("XMLHttpRequest.js") and use XMLHttpRequest per W3C specs.
+ *
+ * @author Dan DeFelippi <dan@driverdan.com>
+ * @contributor David Ellis <d.f.ellis@ieee.org>
+ * @license MIT
+ */
+
+/** @license URI.js v4.4.1 (c) 2011 Gary Court. License: http://github.com/garycourt/uri-js */
+
+//! moment.js
+
+//! moment.js locale configuration

package/execution/runAppiumServer.js

@@ -0,0 +1,145 @@
+const appium = require('appium');
+
+
+
+
+
+
+
+const APPIUM_SERVER_READY = 'APPIUM_SERVER_READY';
+const APPIUM_SERVER_SHUTDOWN = 'APPIUM_SERVER_SHUTDOWN';
+const APPIUM_SERVER_LOG = 'APPIUM_SERVER_LOG';
+const APPIUM_SERVER_PARENT_ALIVE = 'APPIUM_SERVER_PARENT_ALIVE';
+const APPIUM_SERVER_CHECK_IN = 'APPIUM_SERVER_CHECK_IN';
+
+
+const CHECK_IN_FAIL_LIMIT_MILLIS = 15_000;
+
+const CHECK_IN_INTERVAL_MILLIS = 5_000;
+
+
+const appiumConfig = JSON.parse(process.argv[2]);
+
+if (appiumConfig.androidHome) {
+  process.env.ANDROID_HOME = appiumConfig.androidHome;
+  delete appiumConfig.androidHome;
+}
+
+
+
+appiumConfig.allowInsecure = ['chromedriver_autodownload'];
+
+let server;
+let shutdownCalled = false;
+let lastKnownCheckInTime = Date.now();
+let intervalCheckIn;
+
+appium
+  .main({...appiumConfig, logHandler: logHandlerFunc})
+  .then((serverInstance) => {
+    server = serverInstance;
+    sendMessageToParentProcess({type: APPIUM_SERVER_READY});
+    lastKnownCheckInTime = Date.now();
+    intervalCheckIn = global.setInterval(
+      checkInOnParent,
+      CHECK_IN_INTERVAL_MILLIS,
+    );
+  })
+  .catch((error) => {
+    
+    throw error;
+  });
+process.on('message', (message) => {
+  switch (message) {
+        case APPIUM_SERVER_PARENT_ALIVE:
+      lastKnownCheckInTime = Date.now();
+      break;
+    case APPIUM_SERVER_SHUTDOWN:
+      shutdownCalled = true;
+      server.close().catch((error) => {
+        
+        throw error;
+      });
+      break;
+    default:
+      console.log('unsupported message', message);
+  }
+});
+
+
+function logHandlerFunc(logLevel, log) {
+  sendMessageToParentProcess({
+    type: APPIUM_SERVER_LOG,
+    payload: {
+      logLevel,
+      log,
+    },
+  });
+}
+
+
+const originalExit = process.exit;
+
+
+
+process.exit = (code) => {
+  if (shutdownCalled) {
+    global.clearInterval(intervalCheckIn);
+    
+    
+    originalExit();
+    process.kill();
+  }
+  if (code && code > 0) {
+    const stack = new Error().stack;
+    sendMessageToParentProcess({
+      type: APPIUM_SERVER_LOG,
+      payload: {
+        logLevel: 'error',
+        log: `process.exit() call prevented - ${stack}`,
+      },
+    });
+    return;
+  }
+};
+
+process.on('disconnect', () => {
+  console.log(
+    '[runAppiumServer.js] lost connection to parent process, terminating',
+  );
+  originalExit();
+  process.kill();
+});
+
+
+function checkInOnParent() {
+  try {
+    sendMessageToParentProcess({type: APPIUM_SERVER_CHECK_IN});
+    const currentTime = Date.now();
+    const timeSinceLastCheckIn = currentTime - lastKnownCheckInTime;
+    if (timeSinceLastCheckIn > CHECK_IN_FAIL_LIMIT_MILLIS) {
+      console.log(
+        '[runAppiumServer.js] parent process has gone dark, terminating',
+      );
+      global.clearInterval(intervalCheckIn);
+      originalExit();
+      process.kill();
+    }
+    lastKnownCheckInTime = currentTime;
+  } catch (error) {
+    console.error('Could not run checkin function', error);
+  }
+  return;
+}
+
+
+function sendMessageToParentProcess(message) {
+  if (appiumConfig.runningAsUtilityProcess) {
+    
+    
+    process.parentPort.postMessage(message);
+  } else {
+    process.send(message);
+  }
+  return;
+}

package/functions/apiTest/utils.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateApiTestMessage = exports.createFileUploadDirectory = void 0;
+const fs_1 = __importDefault(require("fs"));
+const Globals_1 = require("../../Globals");
+const mablApi_1 = require("../../mablApi");
+const utils_1 = require("../utils");
+function createFileUploadDirectory(testContext) {
+    const dir = Globals_1.Globals.getUploadDirectory();
+    const prefix = Globals_1.Globals.getUploadDirectoryPrefix();
+    const uploadDirectoryName = `${dir}/${prefix}${Date.now()}-`;
+    testContext.addFileUploadDir(uploadDirectoryName);
+    return fs_1.default.mkdtempSync(uploadDirectoryName);
+}
+exports.createFileUploadDirectory = createFileUploadDirectory;
+function validateApiTestMessage(request, response) {
+    var _a, _b, _c;
+    const authorizationHeader = request.get('authorization');
+    if (authorizationHeader === undefined) {
+        (0, utils_1.handleExecutionFailure)(response, 'Illegal authorization');
+        return false;
+    }
+    const contentType = request.get('content-type');
+    if ((contentType === null || contentType === void 0 ? void 0 : contentType.toLowerCase()) !== 'application/json') {
+        (0, utils_1.handleExecutionFailure)(response, 'Illegal content type. Must be application/json');
+        return false;
+    }
+    const pubsubMessage = request.body;
+    if (typeof ((_a = pubsubMessage === null || pubsubMessage === void 0 ? void 0 : pubsubMessage.message) === null || _a === void 0 ? void 0 : _a.data) !== 'string') {
+        (0, utils_1.handleExecutionFailure)(response, 'Illegal message data format');
+        return false;
+    }
+    if (typeof (pubsubMessage === null || pubsubMessage === void 0 ? void 0 : pubsubMessage.subscription) !== 'string') {
+        (0, utils_1.handleExecutionFailure)(response, 'Illegal message subscription format');
+        return false;
+    }
+    if (((_c = (_b = pubsubMessage === null || pubsubMessage === void 0 ? void 0 : pubsubMessage.message) === null || _b === void 0 ? void 0 : _b.attributes) === null || _c === void 0 ? void 0 : _c.test_type) !==
+        mablApi_1.TestTypeEnum.Api.toString()) {
+        (0, utils_1.handleExecutionFailure)(response, 'Illegal test type');
+        return false;
+    }
+    return true;
+}
+exports.validateApiTestMessage = validateApiTestMessage;

package/functions/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/functions/utils.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleExecutionFailure = exports.base64Decode = void 0;
+function base64Decode(encoded) {
+    return Buffer.from(encoded, 'base64').toString();
+}
+exports.base64Decode = base64Decode;
+function handleExecutionFailure(response, message) {
+    console.error(new Error(message));
+    response.status(200).send(message);
+}
+exports.handleExecutionFailure = handleExecutionFailure;

package/http/MablHttpAgent.js

@@ -0,0 +1,73 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MablHttpAgent = void 0;
+const http_1 = __importDefault(require("http"));
+const agent_base_1 = require("agent-base");
+const axiosProxyConfig_1 = require("./axiosProxyConfig");
+const https = __importStar(require("https"));
+const httpUtil_1 = require("./httpUtil");
+class MablHttpAgent extends agent_base_1.Agent {
+    constructor(httpAgent, httpsAgent) {
+        super();
+        this.httpAgent = httpAgent;
+        this.httpsAgent = httpsAgent;
+    }
+    static async createNewInstance(config) {
+        const constructorParameters = await MablHttpAgent.getConstructorParameters(config.httpAgent, config.httpsAgent);
+        if (config.proxyConfig) {
+            const axiosConfig = (0, axiosProxyConfig_1.axiosProxyConfig)(config.proxyConfig);
+            constructorParameters.httpAgent = axiosConfig.httpAgent;
+            constructorParameters.httpsAgent = axiosConfig.httpsAgent;
+        }
+        return new MablHttpAgent(constructorParameters.httpAgent, constructorParameters.httpsAgent);
+    }
+    static async getConstructorParameters(httpAgent, httpsAgent) {
+        var _a, _b;
+        const proxyConfig = await (0, axiosProxyConfig_1.currentProxyConfig)('test');
+        return {
+            httpAgent: (_a = httpAgent !== null && httpAgent !== void 0 ? httpAgent : proxyConfig.httpAgent) !== null && _a !== void 0 ? _a : http_1.default.globalAgent,
+            httpsAgent: (_b = httpsAgent !== null && httpsAgent !== void 0 ? httpsAgent : proxyConfig.httpsAgent) !== null && _b !== void 0 ? _b : https.globalAgent,
+        };
+    }
+    callback(req, opts) {
+        var _a;
+        if ((_a = this.maybeGetFirstStringHeader(req, httpUtil_1.USER_AGENT_HEADER)) === null || _a === void 0 ? void 0 : _a.startsWith('PostmanRuntime/')) {
+            req.setHeader(httpUtil_1.USER_AGENT_HEADER, httpUtil_1.USER_AGENT);
+        }
+        return Promise.resolve(opts.secureEndpoint ? this.httpsAgent : this.httpAgent);
+    }
+    maybeGetFirstStringHeader(req, name) {
+        const value = req.getHeader(name);
+        if (Array.isArray(value)) {
+            return value[0].toString();
+        }
+        return value === null || value === void 0 ? void 0 : value.toString();
+    }
+}
+exports.MablHttpAgent = MablHttpAgent;

package/http/RequestFilteringHttpAgent.js

@@ -0,0 +1,119 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateAddress = exports.isForbiddenHeader = exports.isForbiddenHost = exports.RequestFilteringHttpAgent = void 0;
+const rangeCheck = __importStar(require("range_check"));
+const RequestSecurityError_1 = require("./RequestSecurityError");
+const MablHttpAgent_1 = require("./MablHttpAgent");
+const FORBIDDEN_HOSTS = new Set(['metadata.google.internal']);
+const FORBIDDEN_IP_RANGES = ['169.254.169.254/32'];
+const FORBIDDEN_HEADERS = {
+    'metadata-flavor': 'google',
+    'x-google-metadata-request': undefined,
+};
+const FORBIDDEN_HEADER_NAMES = Object.keys(FORBIDDEN_HEADERS);
+const RFC_1918_RANGES = ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'];
+const LOCAL_ADDRESSES = new Set(['127.0.0.1', '::1']);
+const LOCAL_HOSTS = new Set(['localhost']);
+class RequestFilteringHttpAgent extends MablHttpAgent_1.MablHttpAgent {
+    constructor(httpAgent, httpsAgent) {
+        super(httpAgent, httpsAgent);
+    }
+    static async createNewInstance() {
+        const constructorParameters = await MablHttpAgent_1.MablHttpAgent.getConstructorParameters();
+        return new RequestFilteringHttpAgent(constructorParameters.httpAgent, constructorParameters.httpsAgent);
+    }
+    callback(req, opts) {
+        if (isForbiddenHost(opts.host)) {
+            return Promise.reject(new RequestSecurityError_1.RequestSecurityError('Request contains forbidden host'));
+        }
+        else if (containsForbiddenHeader(opts.headers)) {
+            return Promise.reject(new RequestSecurityError_1.RequestSecurityError('Request contains forbidden header'));
+        }
+        else if (isPrivateAddress(opts.host)) {
+            return Promise.reject(new RequestSecurityError_1.RequestSecurityError('Request contains private address'));
+        }
+        return super.callback(req, opts);
+    }
+}
+exports.RequestFilteringHttpAgent = RequestFilteringHttpAgent;
+function isForbiddenHost(host) {
+    if (!host) {
+        return false;
+    }
+    if (rangeCheck.isIP(host)) {
+        return rangeCheck.inRange(host, FORBIDDEN_IP_RANGES);
+    }
+    const normalizedHost = host.toLowerCase();
+    return FORBIDDEN_HOSTS.has(normalizedHost);
+}
+exports.isForbiddenHost = isForbiddenHost;
+function containsForbiddenHeader(headers) {
+    if (!headers) {
+        return false;
+    }
+    return Object.keys(headers).some((header) => isForbiddenHeader(header, headers[header]));
+}
+function isForbiddenHeader(headerName, headerValue) {
+    const normalizedHeaderName = headerName.toLowerCase().trim();
+    if (!FORBIDDEN_HEADER_NAMES.includes(normalizedHeaderName)) {
+        return false;
+    }
+    const forbiddenHeaderValue = FORBIDDEN_HEADERS[normalizedHeaderName];
+    if (!forbiddenHeaderValue) {
+        return true;
+    }
+    if (!headerValue) {
+        return false;
+    }
+    const headerValueType = typeof headerValue;
+    if (headerValueType === 'string') {
+        const normalizedHeaderValue = headerValue.toLowerCase().trim();
+        return normalizedHeaderValue == forbiddenHeaderValue;
+    }
+    else if (headerValueType === 'number') {
+        return headerValue == forbiddenHeaderValue;
+    }
+    else if (Array.isArray(headerValue)) {
+        return headerValue.some((value) => isForbiddenHeader(headerName, value));
+    }
+    return false;
+}
+exports.isForbiddenHeader = isForbiddenHeader;
+function isPrivateAddress(host) {
+    if (!host) {
+        return false;
+    }
+    if (rangeCheck.isIP(host)) {
+        if (rangeCheck.inRange(host, RFC_1918_RANGES)) {
+            return true;
+        }
+        const normalizedIP = rangeCheck.searchIP(host);
+        return LOCAL_ADDRESSES.has(normalizedIP);
+    }
+    const normalizedHostname = host.toLowerCase();
+    return LOCAL_HOSTS.has(normalizedHostname);
+}
+exports.isPrivateAddress = isPrivateAddress;

package/http/RequestSecurityError.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestSecurityError = void 0;
+class RequestSecurityError extends Error {
+    constructor(message) {
+        super(message);
+        this.isRequestSecurityError = true;
+    }
+    static isInstance(error) {
+        return (error === null || error === void 0 ? void 0 : error.isRequestSecurityError) || false;
+    }
+}
+exports.RequestSecurityError = RequestSecurityError;