@nocobase/utils 2.3.0-beta.8 → 2.3.0-beta.9

package/lib/server-request.d.ts

@@ -18,6 +18,7 @@ export declare function matchesDomainPattern(hostname: string, pattern: string):
  *
  * Throws an error if:
  *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_DISALLOW_IP is true and the host is a literal IP address.
  *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
  *
  * Silently returns for relative URLs (no scheme) so that internal API calls

package/lib/server-request.js

@@ -189,13 +189,19 @@ function checkUrlAgainstWhitelist(url) {
     );
   }
   const host = getNormalizedHost(parsed);
+  if (process.env.SERVER_REQUEST_DISALLOW_IP === "true" && import_ipaddr.default.isValid(host)) {
+    throw new Error(`Outbound request to "${host}" is blocked because SERVER_REQUEST_DISALLOW_IP is enabled.`);
+  }
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
   if (!whitelist || !whitelist.trim()) {
     warnIfSsrfRiskTarget(host);
     return;
   }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
-  if (entries.length === 0) return;
+  if (entries.length === 0) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.3.0-beta.8",
+  "version": "2.3.0-beta.9",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -22,5 +22,5 @@
     "sanitize-html": "2.17.5",
     "ses": "^1.14.0"
   },
-  "gitHead": "5d458884528593b2d3142a6a33de93bf0ad96543"
+  "gitHead": "c215e60ed704afe6c086bd96304f4b0d3b46d02e"
 }