@nocobase/utils 2.1.0-beta.13 → 2.1.0-beta.15

package/lib/index.d.ts

@@ -44,4 +44,5 @@ export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
 export * from './liquidjs';
+export * from './server-request';
 export { lodash };

package/lib/index.js

@@ -80,6 +80,7 @@ __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
+__reExport(src_exports, require("./server-request"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Schema,
@@ -119,5 +120,6 @@ __reExport(src_exports, require("./liquidjs"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
-  ...require("./liquidjs")
+  ...require("./liquidjs"),
+  ...require("./server-request")
 });

package/lib/server-request.d.ts

@@ -0,0 +1,36 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { AxiosRequestConfig, AxiosResponse } from 'axios';
+/**
+ * Match a hostname against a domain pattern.
+ * `*.example.com` matches exactly one subdomain level (e.g. `foo.example.com`)
+ * but not `example.com` itself or deeper levels like `a.b.example.com`.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Validate a URL against the SERVER_REQUEST_WHITELIST environment variable.
+ *
+ * Throws an error if:
+ *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
+ *
+ * Silently returns for relative URLs (no scheme) so that internal API calls
+ * that use a relative path are not affected.
+ *
+ * Prefer using {@link serverRequest} over calling this directly.
+ */
+export declare function checkUrlAgainstWhitelist(url?: string): void;
+/**
+ * Drop-in replacement for `axios.request()` with built-in SSRF protection.
+ *
+ * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
+ * forwarding to axios. Use this instead of calling axios directly for all
+ * server-initiated outbound HTTP requests.
+ */
+export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -0,0 +1,128 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var server_request_exports = {};
+__export(server_request_exports, {
+  checkUrlAgainstWhitelist: () => checkUrlAgainstWhitelist,
+  matchesDomainPattern: () => matchesDomainPattern,
+  serverRequest: () => serverRequest
+});
+module.exports = __toCommonJS(server_request_exports);
+var import_ipaddr = __toESM(require("ipaddr.js"));
+var import_axios = __toESM(require("axios"));
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function matchesIpEntry(hostname, entry) {
+  try {
+    let addr = import_ipaddr.default.parse(hostname);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    if (entry.includes("/")) {
+      const cidr = import_ipaddr.default.parseCIDR(entry);
+      if (addr.kind() !== cidr[0].kind()) return false;
+      if (addr.kind() === "ipv4") {
+        return addr.match(cidr);
+      }
+      return addr.match(cidr);
+    }
+    let entryAddr = import_ipaddr.default.parse(entry);
+    if (entryAddr.kind() === "ipv6" && entryAddr.isIPv4MappedAddress()) {
+      entryAddr = entryAddr.toIPv4Address();
+    }
+    return addr.toString() === entryAddr.toString();
+  } catch {
+    return false;
+  }
+}
+__name(matchesIpEntry, "matchesIpEntry");
+function matchesDomainPattern(hostname, pattern) {
+  const h = hostname.toLowerCase();
+  const p = pattern.toLowerCase();
+  if (p.startsWith("*.")) {
+    const suffix = p.slice(1);
+    if (!h.endsWith(suffix) || h.length <= suffix.length) return false;
+    const prefix = h.slice(0, h.length - suffix.length);
+    return !prefix.includes(".");
+  }
+  return h === p;
+}
+__name(matchesDomainPattern, "matchesDomainPattern");
+function matchesEntry(hostname, entry) {
+  const e = entry.trim();
+  if (!e) return false;
+  return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
+}
+__name(matchesEntry, "matchesEntry");
+function checkUrlAgainstWhitelist(url) {
+  if (!url) return;
+  if (!url.includes("://")) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(
+      `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
+    );
+  }
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  if (!whitelist || !whitelist.trim()) return;
+  const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
+  if (entries.length === 0) return;
+  const { hostname } = parsed;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  for (const entry of entries) {
+    if (matchesEntry(host, entry)) return;
+  }
+  throw new Error(
+    `Outbound request to "${host}" is blocked. Add it to SERVER_REQUEST_WHITELIST to allow this request.`
+  );
+}
+__name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
+async function serverRequest(config) {
+  checkUrlAgainstWhitelist(config.url);
+  return import_axios.default.request(config);
+}
+__name(serverRequest, "serverRequest");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkUrlAgainstWhitelist,
+  matchesDomainPattern,
+  serverRequest
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.1.0-beta.13",
+  "version": "2.1.0-beta.15",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -8,16 +8,18 @@
     "@budibase/handlebars-helpers": "0.14.0",
     "@hapi/topo": "^6.0.0",
     "@rc-component/mini-decimal": "^1.1.0",
+    "axios": "^1.7.0",
     "dayjs": "^1.11.9",
     "deepmerge": "^4.2.2",
     "flat-to-nested": "^1.1.1",
     "fs-extra": "^11.1.1",
     "graphlib": "^2.1.8",
     "handlebars": "^4.7.8",
+    "ipaddr.js": "^1.9.1",
     "liquidjs": "^10.23.0",
     "multer": "^1.4.5-lts.2",
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "691716e5f4e5f8bd3859d65bc8a29b4e3c32209b"
+  "gitHead": "dc1aceea6357e6ab149976c2a236fc4b6bee1370"
 }