@medialane/sdk 0.105.0 → 0.107.0

package/dist/index.cjs

@@ -1377,8 +1377,19 @@ function createRateLimiter(windowMs, max) {
     return true;
   };
 }
+var TRUSTED_APP_IP_HEADER = "x-medialane-client-ip";
 function requestIp(req) {
-  return req.headers.get("x-forwarded-for")?.split(",")[0].trim() ?? "unknown";
+  const fromApp = req.headers.get(TRUSTED_APP_IP_HEADER)?.trim();
+  if (fromApp) return fromApp;
+  const fromEdge = req.headers.get("x-vercel-forwarded-for")?.split(",")[0]?.trim();
+  if (fromEdge) return fromEdge;
+  const forwarded = req.headers.get("x-forwarded-for");
+  if (forwarded) {
+    const hops = forwarded.split(",").map((hop) => hop.trim()).filter(Boolean);
+    const nearest = hops[hops.length - 1];
+    if (nearest) return nearest;
+  }
+  return "unknown";
 }
 
 // src/server/origin.ts
@@ -1467,43 +1478,135 @@ var ALLOWED_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
 ]);
 var MAX_IMAGE_REDIRECTS = 5;
 var MAX_IMAGE_PROXY_BYTES = 15 * 1024 * 1024;
+function parseIpv4(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = [];
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const n = Number(part);
+    if (n > 255) return null;
+    bytes.push(n);
+  }
+  return bytes;
+}
+function isPrivateIpv4(bytes) {
+  const a = bytes[0];
+  const b = bytes[1];
+  const c = bytes[2];
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 0 && c === 0) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 198 && (b === 18 || b === 19)) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function expandIpv6(rawIp) {
+  let ip = rawIp;
+  let embeddedV4 = null;
+  const v4Tail = ip.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (v4Tail && ip.includes(":")) {
+    embeddedV4 = parseIpv4(v4Tail[1]);
+    if (!embeddedV4) return null;
+    ip = ip.slice(0, ip.length - v4Tail[1].length) + "0:0";
+  }
+  const sides = ip.split("::");
+  if (sides.length > 2) return null;
+  const head = sides[0] ? sides[0].split(":").filter(Boolean) : [];
+  const tail = sides.length === 2 && sides[1] ? sides[1].split(":").filter(Boolean) : [];
+  let groups;
+  if (sides.length === 1) {
+    groups = head;
+    if (groups.length !== 8) return null;
+  } else {
+    const missing = 8 - head.length - tail.length;
+    if (missing < 0) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...tail];
+  }
+  if (groups.length !== 8) return null;
+  const bytes = [];
+  for (const group of groups) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+    const n = parseInt(group, 16);
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  if (embeddedV4) {
+    bytes[12] = embeddedV4[0];
+    bytes[13] = embeddedV4[1];
+    bytes[14] = embeddedV4[2];
+    bytes[15] = embeddedV4[3];
+  }
+  return bytes;
+}
+function isPrivateIpv6(bytes) {
+  if (bytes.every((b) => b === 0)) return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1) return true;
+  if ((bytes[0] & 254) === 252) return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128) return true;
+  if (bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255) {
+    return isPrivateIpv4(bytes.slice(12));
+  }
+  return false;
+}
+function parseNumber(part) {
+  if (/^0x[0-9a-f]+$/i.test(part)) return parseInt(part.slice(2), 16);
+  if (/^0[0-7]+$/.test(part)) return parseInt(part, 8);
+  if (/^\d+$/.test(part)) return parseInt(part, 10);
+  return null;
+}
+function normalizeNumericHostname(host) {
+  const parts = host.trim().split(".");
+  if (parts.length < 1 || parts.length > 4) return null;
+  const values = [];
+  for (const part of parts) {
+    const value = parseNumber(part);
+    if (value === null || value < 0) return null;
+    values.push(value);
+  }
+  const leading = values.slice(0, -1);
+  if (leading.some((v) => v > 255)) return null;
+  const tail = values[values.length - 1];
+  const tailBytes = 4 - leading.length;
+  if (tail > 2 ** (8 * tailBytes) - 1) return null;
+  const bytes = [...leading];
+  for (let i = tailBytes - 1; i >= 0; i--) bytes.push(tail >>> 8 * i & 255);
+  return bytes.join(".");
+}
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.azure.internal"
+]);
 function isPrivateHost(hostname) {
-  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return true;
-  if (/^\d+$/.test(h)) {
-    const n = parseInt(h, 10);
-    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
-  }
-  if (/^0x[0-9a-f]+$/i.test(h)) {
-    const n = parseInt(h, 16);
-    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
-  }
-  if (/^0\d+\.\d+\.\d+\.\d+$/.test(h)) return true;
-  if (h === "::1" || /^0*:0*:0*:0*:0*:0*:0*:0*1$/.test(h)) return true;
-  const v4mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  if (v4mapped) return isPrivateHost(v4mapped[1]);
-  if (/^10\./.test(h)) return true;
-  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
-  if (/^192\.168\./.test(h)) return true;
-  if (/^169\.254\./.test(h)) return true;
-  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true;
-  if (/^fe80:/i.test(h)) return true;
-  if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true;
-  if (h.endsWith(".local")) return true;
-  if (h === "metadata.google.internal") return true;
-  if (h === "metadata.azure.internal") return true;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (BLOCKED_HOSTNAMES.has(host)) return true;
+  if (host.endsWith(".local") || host.endsWith(".internal")) return true;
+  const candidate = normalizeNumericHostname(host) ?? host;
+  const v4 = parseIpv4(candidate);
+  if (v4) return isPrivateIpv4(v4);
+  const v6 = expandIpv6(candidate);
+  if (v6) return isPrivateIpv6(v6);
   return false;
 }
-function validateUrl(raw) {
+function validateUrl(raw, options = {}) {
+  const requireHttps = options.requireHttps ?? true;
   let parsed;
   try {
     parsed = new URL(raw);
   } catch {
     return { error: "Invalid url", status: 400 };
   }
-  if (parsed.protocol !== "https:") {
+  if (requireHttps && parsed.protocol !== "https:") {
     return { error: "Only https URLs allowed", status: 400 };
   }
+  if (!requireHttps && parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return { error: "Only http and https URLs allowed", status: 400 };
+  }
   if (parsed.username || parsed.password) {
     return { error: "URL credentials not allowed", status: 400 };
   }
@@ -1512,6 +1615,111 @@ function validateUrl(raw) {
   }
   return { url: parsed };
 }
+function isPrivateOrInsecureUrl(raw, requireHttps = true) {
+  return "error" in validateUrl(raw, { requireHttps });
+}
+
+// src/server/image-proxy.ts
+var DEFAULT_USER_AGENT = "Mozilla/5.0 (compatible; Medialane/1.0; +https://www.medialane.io)";
+function jsonError(message, status) {
+  return Response.json({ error: message }, { status });
+}
+async function readBodyWithCap(res, maxBytes) {
+  const declared = Number(res.headers.get("content-length") ?? 0);
+  if (declared > maxBytes) {
+    return { ok: false, error: "Image too large", status: 413 };
+  }
+  const reader = res.body?.getReader();
+  if (!reader) return { ok: false, error: "Empty response body", status: 502 };
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!value) continue;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      return { ok: false, error: "Image too large", status: 413 };
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { ok: true, body };
+}
+function createImageProxyHandler(config) {
+  const doFetch = config.fetchImpl ?? fetch;
+  const userAgent = config.userAgent ?? DEFAULT_USER_AGENT;
+  async function resolvesToPrivateHost(hostname) {
+    try {
+      const addresses = await config.resolveHostname(hostname);
+      if (addresses.length === 0) return true;
+      return addresses.some((address) => isPrivateHost(address));
+    } catch {
+      return true;
+    }
+  }
+  async function safeFetch(url, hopsLeft) {
+    if (hopsLeft < 0) throw new Error("Too many redirects");
+    if (await resolvesToPrivateHost(url.hostname)) {
+      throw new Error("Blocked: hostname resolves to a private address");
+    }
+    const res = await doFetch(url.toString(), {
+      redirect: "manual",
+      headers: { "User-Agent": userAgent }
+    });
+    if (res.status >= 300 && res.status < 400) {
+      const location = res.headers.get("location");
+      if (!location) throw new Error("Redirect with no Location header");
+      const next = new URL(location, url);
+      const validated = validateUrl(next.toString());
+      if ("error" in validated) throw new Error(`Redirect blocked: ${validated.error}`);
+      return safeFetch(validated.url, hopsLeft - 1);
+    }
+    return res;
+  }
+  return async function handleImageProxy(req) {
+    if (!config.checkRateLimit(requestIp(req))) {
+      return jsonError("Too many requests", 429);
+    }
+    const raw = new URL(req.url).searchParams.get("url");
+    if (!raw) return jsonError("Missing url", 400);
+    const validated = validateUrl(raw);
+    if ("error" in validated) return jsonError(validated.error, validated.status);
+    let upstream;
+    try {
+      upstream = await safeFetch(validated.url, MAX_IMAGE_REDIRECTS);
+    } catch {
+      return jsonError("Failed to fetch image", 502);
+    }
+    if (!upstream.ok) {
+      return jsonError(`Upstream returned ${upstream.status}`, upstream.status);
+    }
+    const contentType = upstream.headers.get("content-type") ?? "";
+    const baseType = contentType.split(";")[0].trim().toLowerCase();
+    if (!ALLOWED_IMAGE_CONTENT_TYPES.has(baseType)) {
+      return jsonError("Not an image", 400);
+    }
+    const capped = await readBodyWithCap(upstream, MAX_IMAGE_PROXY_BYTES);
+    if (!capped.ok) return jsonError(capped.error, capped.status);
+    return new Response(capped.body, {
+      status: 200,
+      headers: {
+        "Content-Type": contentType,
+        "X-Content-Type-Options": "nosniff",
+        "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox",
+        "Cache-Control": "public, max-age=86400, s-maxage=86400, stale-while-revalidate=604800",
+        "Access-Control-Allow-Origin": "*"
+      }
+    });
+  };
+}
 
 // src/server/backend-metadata.ts
 function endpoint(config, path) {
@@ -1784,6 +1992,7 @@ exports.STARKNET_POP_COLLECTION_CLASS_HASH = STARKNET_POP_COLLECTION_CLASS_HASH;
 exports.STARKNET_POP_FACTORY_CONTRACT = STARKNET_POP_FACTORY_CONTRACT;
 exports.SUPPORTED_TOKENS = SUPPORTED_TOKENS;
 exports.SUPPORTED_URL_CHAINS = SUPPORTED_URL_CHAINS;
+exports.TRUSTED_APP_IP_HEADER = TRUSTED_APP_IP_HEADER;
 exports.assetHref = assetHref;
 exports.buildAssetMetadata = buildAssetMetadata;
 exports.chainFromSlug = chainFromSlug;
@@ -1792,6 +2001,7 @@ exports.coinHref = coinHref;
 exports.collectionHref = collectionHref;
 exports.createBackendProxyHandler = createBackendProxyHandler;
 exports.createFailoverFetch = createFailoverFetch;
+exports.createImageProxyHandler = createImageProxyHandler;
 exports.createRateLimiter = createRateLimiter;
 exports.createRpcProxyHandler = createRpcProxyHandler;
 exports.encodeU256 = encodeU256;
@@ -1808,6 +2018,7 @@ exports.getTokenBySymbol = getTokenBySymbol;
 exports.hasCapability = hasCapability;
 exports.isPolicyRefusal = isPolicyRefusal;
 exports.isPrivateHost = isPrivateHost;
+exports.isPrivateOrInsecureUrl = isPrivateOrInsecureUrl;
 exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
 exports.isTransientRpcError = isTransientRpcError;
@@ -1818,6 +2029,7 @@ exports.listServices = listServices;
 exports.normalizeAddress = normalizeAddress;
 exports.normalizeHash = normalizeHash;
 exports.parseAmount = parseAmount;
+exports.readBodyWithCap = readBodyWithCap;
 exports.requestIp = requestIp;
 exports.resolveAppFeeConfig = resolveAppFeeConfig;
 exports.resolveConfig = resolveConfig;