@mintlify/common 1.0.659 → 1.0.660

package/dist/asyncapi/checkForExternalRefs.d.ts

@@ -0,0 +1,11 @@
+export declare class ExternalRefError extends Error {
+    readonly refs: Array<{
+        path: string;
+        value: string;
+    }>;
+    constructor(message: string, refs: Array<{
+        path: string;
+        value: string;
+    }>);
+}
+export declare function checkForExternalRefs(input: unknown): void;

package/dist/asyncapi/checkForExternalRefs.js

@@ -0,0 +1,67 @@
+import yaml from 'js-yaml';
+export class ExternalRefError extends Error {
+    constructor(message, refs) {
+        super(message);
+        this.refs = refs;
+        this.name = 'ExternalRefError';
+    }
+}
+function tryParse(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch (_a) {
+        try {
+            const result = yaml.load(value);
+            return typeof result === 'object' ? result : null;
+        }
+        catch (_b) {
+            return null;
+        }
+    }
+}
+function validateParseable(input) {
+    try {
+        JSON.parse(input);
+    }
+    catch (_a) {
+        yaml.load(input);
+    }
+}
+function findExternalRefs(input, path = '', refs = [], visited = new WeakSet()) {
+    if (typeof input === 'string') {
+        const parsed = tryParse(input);
+        if (parsed)
+            findExternalRefs(parsed, path, refs, visited);
+        return refs;
+    }
+    if (!input || typeof input !== 'object' || visited.has(input))
+        return refs;
+    visited.add(input);
+    if (Array.isArray(input)) {
+        input.forEach((item, i) => findExternalRefs(item, `${path}[${i}]`, refs, visited));
+    }
+    else {
+        for (const [key, value] of Object.entries(input)) {
+            const newPath = path ? `${path}.${key}` : key;
+            if (key === '$ref' && typeof value === 'string' && !value.startsWith('#')) {
+                refs.push({ path: newPath, value });
+            }
+            else {
+                findExternalRefs(value, newPath, refs, visited);
+            }
+        }
+    }
+    return refs;
+}
+export function checkForExternalRefs(input) {
+    if (input == null || (typeof input !== 'string' && typeof input !== 'object'))
+        return;
+    if (typeof input === 'string')
+        validateParseable(input);
+    const refs = findExternalRefs(input);
+    if (refs.length > 0) {
+        const details = refs.map((r) => `  - ${r.path}: ${r.value}`).join('\n');
+        throw new ExternalRefError(`External $ref references are not allowed. Found ${refs.length} external reference(s):\n${details}`, refs);
+    }
+}

package/dist/asyncapi/validateAsyncApi.js

@@ -8,9 +8,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { Parser } from '@asyncapi/parser';
+import { checkForExternalRefs } from './checkForExternalRefs.js';
 export function validateAsyncApi(str) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
+            // Throws error if external $ref is found
+            checkForExternalRefs(str);
             const parser = new Parser();
             const { document, diagnostics } = yield parser.parse(str);
             if (diagnostics.length > 0) {

package/dist/openapi/validate.js

@@ -8,6 +8,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { validate as scalarValidate } from '@mintlify/openapi-parser';
+import { checkForExternalRefs } from '../asyncapi/checkForExternalRefs.js';
 export const validate = (document) => __awaiter(void 0, void 0, void 0, function* () {
     const result = yield safeValidate(document);
     if ('errorMessage' in result) {
@@ -16,6 +17,14 @@ export const validate = (document) => __awaiter(void 0, void 0, void 0, function
     return result;
 });
 export const safeValidate = (document) => __awaiter(void 0, void 0, void 0, function* () {
+    // Check for external $ref references before parsing to prevent SSRF
+    try {
+        checkForExternalRefs(document);
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        return { errors: [{ message: errorMessage }], valid: false, errorMessage };
+    }
     const result = yield scalarValidate(document);
     const { errors, schema, valid, version } = result;
     if (version === '2.0')