@medialane/sdk 0.89.0 → 0.91.0

package/dist/index.cjs

@@ -1381,6 +1381,66 @@ function createRpcProxyHandler(config) {
   return createBackendProxyHandler({ ...config, path: "/v1/rpc" });
 }
 
+// src/server/ssrf-guard.ts
+var ALLOWED_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/jpg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "image/svg+xml",
+  "image/avif",
+  "image/bmp",
+  "image/tiff"
+]);
+var MAX_IMAGE_REDIRECTS = 5;
+var MAX_IMAGE_PROXY_BYTES = 15 * 1024 * 1024;
+function isPrivateHost(hostname) {
+  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (h === "localhost" || h === "127.0.0.1" || h === "0.0.0.0") return true;
+  if (/^\d+$/.test(h)) {
+    const n = parseInt(h, 10);
+    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
+  }
+  if (/^0x[0-9a-f]+$/i.test(h)) {
+    const n = parseInt(h, 16);
+    if (n === 2130706433 || n === 0 || n >= 2886729728 && n <= 2887778303 || n >= 3232235520 && n <= 3232301055 || n >= 167772160 && n <= 184549375 || n >= 2851995648 && n <= 2852061183) return true;
+  }
+  if (/^0\d+\.\d+\.\d+\.\d+$/.test(h)) return true;
+  if (h === "::1" || /^0*:0*:0*:0*:0*:0*:0*:0*1$/.test(h)) return true;
+  const v4mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+  if (v4mapped) return isPrivateHost(v4mapped[1]);
+  if (/^10\./.test(h)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h)) return true;
+  if (/^192\.168\./.test(h)) return true;
+  if (/^169\.254\./.test(h)) return true;
+  if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true;
+  if (/^fe80:/i.test(h)) return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(h)) return true;
+  if (h.endsWith(".local")) return true;
+  if (h === "metadata.google.internal") return true;
+  if (h === "metadata.azure.internal") return true;
+  return false;
+}
+function validateUrl(raw) {
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    return { error: "Invalid url", status: 400 };
+  }
+  if (parsed.protocol !== "https:") {
+    return { error: "Only https URLs allowed", status: 400 };
+  }
+  if (parsed.username || parsed.password) {
+    return { error: "URL credentials not allowed", status: 400 };
+  }
+  if (isPrivateHost(parsed.hostname)) {
+    return { error: "URL not allowed", status: 400 };
+  }
+  return { url: parsed };
+}
+
 // src/server/backend-metadata.ts
 function endpoint(config, path) {
   return `${config.backendUrl.replace(/\/$/, "")}/v1/metadata/${path}`;
@@ -1523,12 +1583,15 @@ function resolveSafeImageContentType(contentType) {
 }
 var MAX_IPFS_GATEWAY_RESPONSE_BYTES = 25 * 1024 * 1024;
 
+exports.ALLOWED_IMAGE_CONTENT_TYPES = ALLOWED_IMAGE_CONTENT_TYPES;
 exports.ApiClient = ApiClient;
 exports.CHAINS = CHAINS;
 exports.DEFAULT_CHAIN = DEFAULT_CHAIN;
 exports.DEFAULT_CURRENCY = DEFAULT_CURRENCY;
 exports.FeeConfigSchema = FeeConfigSchema;
 exports.IPFS_SAFE_CONTENT_TYPE_PREFIXES = IPFS_SAFE_CONTENT_TYPE_PREFIXES;
+exports.MAX_IMAGE_PROXY_BYTES = MAX_IMAGE_PROXY_BYTES;
+exports.MAX_IMAGE_REDIRECTS = MAX_IMAGE_REDIRECTS;
 exports.MAX_IPFS_GATEWAY_RESPONSE_BYTES = MAX_IPFS_GATEWAY_RESPONSE_BYTES;
 exports.MedialaneApiError = MedialaneApiError;
 exports.OPEN_LICENSES = OPEN_LICENSES;
@@ -1589,6 +1652,7 @@ exports.getStarknetCoordinates = getStarknetCoordinates;
 exports.getTokenByAddress = getTokenByAddress;
 exports.getTokenBySymbol = getTokenBySymbol;
 exports.hasCapability = hasCapability;
+exports.isPrivateHost = isPrivateHost;
 exports.isSameOrigin = isSameOrigin;
 exports.isServiceId = isServiceId;
 exports.isTransientRpcError = isTransientRpcError;
@@ -1609,5 +1673,6 @@ exports.u256ToBigInt = u256ToBigInt;
 exports.uploadDirectoryToBackend = uploadDirectoryToBackend;
 exports.uploadFileToBackend = uploadFileToBackend;
 exports.uploadJsonToBackend = uploadJsonToBackend;
+exports.validateUrl = validateUrl;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map