@microsoft/agents-hosting 1.9.1 → 1.10.0-beta.14.ge6d1defc27

package/src/utils/env.ts

@@ -87,11 +87,19 @@ export const envParserUtils = {
  *   unrecognized.
  */
 export function parseBooleanEnv (value: string | undefined): boolean | undefined {
-  if (value === undefined) return undefined
+  if (value === undefined) {
+    return undefined
+  }
   const v = value.trim().toLowerCase()
-  if (v === 'true' || v === '1') return true
-  if (v === '') return undefined
-  if (v === 'false' || v === '0') return false
+  if (v === 'true' || v === '1') {
+    return true
+  }
+  if (v === '') {
+    return undefined
+  }
+  if (v === 'false' || v === '0') {
+    return false
+  }
   return undefined
 }
 
@@ -104,7 +112,9 @@ export function parseBooleanEnv (value: string | undefined): boolean | undefined
  * @returns A finite integer, or `fallback` when the input cannot be parsed.
  */
 export function parseIntEnv (value: string | undefined, fallback: number): number {
-  if (value === undefined || value.trim() === '') return fallback
+  if (value === undefined || value.trim() === '') {
+    return fallback
+  }
   const parsed = parseInt(value, 10)
   return Number.isNaN(parsed) ? fallback : parsed
 }
@@ -132,7 +142,9 @@ export function suggestClosest (
   candidates: readonly string[],
   maxDistance = 2
 ): string | undefined {
-  if (!input) return undefined
+  if (!input) {
+    return undefined
+  }
   const a = input.toLowerCase()
   const cutoff = Math.min(maxDistance, Math.max(1, Math.ceil(a.length / 2)))
   let best: { name: string, distance: number } | undefined
@@ -140,7 +152,9 @@ export function suggestClosest (
     const d = levenshtein(a, candidate.toLowerCase())
     if (d <= cutoff && (!best || d < best.distance)) {
       best = { name: candidate, distance: d }
-      if (d === 0) break
+      if (d === 0) {
+        break
+      }
     }
   }
   return best?.name
@@ -148,11 +162,19 @@ export function suggestClosest (
 
 /** Standard Levenshtein edit distance using a single-row dynamic-programming table. */
 function levenshtein (a: string, b: string): number {
-  if (a === b) return 0
-  if (a.length === 0) return b.length
-  if (b.length === 0) return a.length
+  if (a === b) {
+    return 0
+  }
+  if (a.length === 0) {
+    return b.length
+  }
+  if (b.length === 0) {
+    return a.length
+  }
   const row = new Array<number>(b.length + 1)
-  for (let j = 0; j <= b.length; j++) row[j] = j
+  for (let j = 0; j <= b.length; j++) {
+    row[j] = j
+  }
   for (let i = 1; i <= a.length; i++) {
     let prev = i - 1
     row[0] = i

package/src/utils/ipAddress.ts

@@ -0,0 +1,63 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { isIP } from 'node:net'
+
+function normalizeAddress (address: string): string | undefined {
+  const unwrapped = address.startsWith('[') && address.endsWith(']') ? address.slice(1, -1) : address
+  const version = isIP(unwrapped)
+  if (version === 0) {
+    return undefined
+  }
+  return version === 6 ? new URL(`http://[${unwrapped}]`).hostname.slice(1, -1) : unwrapped
+}
+
+function mappedIPv4 (address: string): string | undefined {
+  const match = address.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
+  if (!match) {
+    return undefined
+  }
+  const high = parseInt(match[1], 16)
+  const low = parseInt(match[2], 16)
+  return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`
+}
+
+export function isPrivateOrLoopbackAddress (address: string): boolean {
+  const normalized = normalizeAddress(address)
+  if (!normalized) {
+    return false
+  }
+  const ipv4 = mappedIPv4(normalized) ?? normalized
+  if (isIP(ipv4) === 4) {
+    const bytes = ipv4.split('.').map(Number)
+    return bytes[0] === 127 ||
+      bytes[0] === 10 ||
+      (bytes[0] === 172 && bytes[1] >= 16 && bytes[1] <= 31) ||
+      (bytes[0] === 192 && bytes[1] === 168) ||
+      (bytes[0] === 169 && bytes[1] === 254)
+  }
+
+  if (normalized === '::1') {
+    return true
+  }
+  const firstHextet = parseInt(normalized.split(':')[0], 16)
+  return (firstHextet & 0xfe00) === 0xfc00 ||
+    (firstHextet & 0xffc0) === 0xfe80 ||
+    (firstHextet & 0xffc0) === 0xfec0
+}
+
+export function isBlockedOutboundAddress (address: string): boolean {
+  const normalized = normalizeAddress(address)
+  if (!normalized) {
+    return true
+  }
+  const ipv4 = mappedIPv4(normalized) ?? normalized
+  const [first, second] = ipv4.split('.').map(Number)
+  // RFC 6598 shared space is outbound-only; it must not become trusted sidecar space.
+  return normalized === '::' ||
+    ipv4 === '0.0.0.0' ||
+    (first === 100 && second >= 64 && second <= 127) ||
+    isPrivateOrLoopbackAddress(normalized)
+}

package/src/utils/outboundUrl.ts

@@ -0,0 +1,50 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+
+import { promises as dns } from 'node:dns'
+import { isIP } from 'node:net'
+import { debug } from '@microsoft/agents-telemetry'
+import { isBlockedOutboundAddress } from './ipAddress'
+
+const logger = debug('agents:outboundHostValidator')
+
+export function getHttpsUrl (input: string | URL | null | undefined): URL | undefined {
+  if (!input) {
+    return undefined
+  }
+  try {
+    const url = input instanceof URL ? input : new URL(input)
+    return url.protocol === 'https:' && !url.username && !url.password ? url : undefined
+  } catch {
+    return undefined
+  }
+}
+
+export function isLocalOrBlockedHost (host: string): boolean {
+  const unwrapped = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host
+  return host === 'localhost' || host.endsWith('.localhost') ||
+    (isIP(unwrapped) !== 0 && isBlockedOutboundAddress(unwrapped))
+}
+
+export async function hasAllowedOutboundAddresses (url: URL, allowPrivateNetworkAddresses = false): Promise<boolean> {
+  if (allowPrivateNetworkAddresses) {
+    return true
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '')
+  if (isLocalOrBlockedHost(host)) {
+    return false
+  }
+  if (isIP(host) !== 0) {
+    return true
+  }
+
+  try {
+    const addresses = await dns.lookup(host, { all: true })
+    return addresses.length > 0 && addresses.every(({ address }) => !isBlockedOutboundAddress(address))
+  } catch {
+    logger.warn(`Attachment destination DNS lookup failed. Host='${host}'`)
+    return false
+  }
+}

package/src/utils.ts

@@ -18,7 +18,9 @@ export const mergeDefined = <T extends Record<string, any>>(
 ): T => {
   const result: Partial<T> = {}
   for (const layer of layers) {
-    if (layer) Object.assign(result, prune(layer))
+    if (layer) {
+      Object.assign(result, prune(layer))
+    }
   }
   return result as T
 }