@nuxt/scripts 1.3.2 → 1.3.4

package/dist/runtime/server/proxy-handler.js

@@ -1,6 +1,7 @@
-import { createError, defineEventHandler, getHeaders, getQuery, getRequestIP, getRequestWebStream, readBody, readRawBody, setResponseHeader, setResponseStatus } from "h3";
-import { useNitroApp, useRuntimeConfig } from "nitropack/runtime";
+import { createError, defineEventHandler, getHeaders, getQuery, getRequestIP, getRequestWebStream, sendStream, setResponseHeader, setResponseStatus } from "#nuxt-scripts/h3";
+import { useNitroApp, useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { matchDomain } from "./utils/match-domain.js";
+import { closePublicNetworkDispatcher, createPublicNetworkDispatcher, isPrivateNetworkResolutionError, isPublicNetworkHostname } from "./utils/network-host.js";
 import {
   anonymizeIP,
   mergePrivacy,
@@ -12,7 +13,29 @@ import {
 } from "./utils/privacy.js";
 const COMPRESSION_RE = /gzip|deflate|br|compress|base64/i;
 const CLIENT_HINT_VERSION_RE = /;v="(\d+)\.[^"]*"/g;
-const SKIP_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["set-cookie", "transfer-encoding", "content-encoding", "content-length"]);
+const MAX_TRANSFORM_BODY_SIZE = 2 * 1024 * 1024;
+const UPSTREAM_TIMEOUT_MS = 15e3;
+const SKIP_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+  "alt-svc",
+  "clear-site-data",
+  "connection",
+  "content-encoding",
+  "content-length",
+  "keep-alive",
+  "nel",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "report-to",
+  "reporting-endpoints",
+  "set-cookie",
+  "set-cookie2",
+  "strict-transport-security",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "www-authenticate"
+]);
 export const SKIP_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "connection",
   "keep-alive",
@@ -23,12 +46,101 @@ export const SKIP_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "transfer-encoding",
   "upgrade"
 ]);
+async function readTransformBody(event) {
+  const contentLength = Number(getHeaders(event)["content-length"] || 0);
+  if (Number.isFinite(contentLength) && contentLength > MAX_TRANSFORM_BODY_SIZE) {
+    throw createError({ statusCode: 413, statusMessage: "Proxy request body too large" });
+  }
+  const stream = getRequestWebStream(event);
+  if (!stream)
+    return void 0;
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (!value)
+        continue;
+      total += value.byteLength;
+      if (total > MAX_TRANSFORM_BODY_SIZE) {
+        try {
+          await reader.cancel("Proxy request body too large");
+        } catch {
+        }
+        throw createError({ statusCode: 413, statusMessage: "Proxy request body too large" });
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(body);
+}
+export function withResponseBodyIdleTimeout(body, timeoutMs, onTimeout) {
+  const reader = body.getReader();
+  let stopped = false;
+  let timeoutId;
+  const clearIdleTimeout = () => {
+    if (timeoutId !== void 0) {
+      clearTimeout(timeoutId);
+      timeoutId = void 0;
+    }
+  };
+  return new ReadableStream({
+    async pull(controller) {
+      timeoutId = setTimeout(() => {
+        stopped = true;
+        const error = createError({
+          statusCode: 504,
+          statusMessage: "Gateway Timeout",
+          message: "Upstream response body timed out"
+        });
+        onTimeout();
+        controller.error(error);
+        void reader.cancel(error).catch((cancelError) => {
+          Object.assign(error, { cause: cancelError });
+        });
+      }, timeoutMs);
+      const result = await reader.read().catch((error) => {
+        clearIdleTimeout();
+        if (!stopped)
+          controller.error(error);
+        return void 0;
+      });
+      clearIdleTimeout();
+      if (!result || stopped)
+        return;
+      if (result.done) {
+        stopped = true;
+        controller.close();
+        return;
+      }
+      controller.enqueue(result.value);
+    },
+    async cancel(reason) {
+      stopped = true;
+      clearIdleTimeout();
+      await reader.cancel(reason);
+    }
+  });
+}
 function stripQueryFingerprinting(query, privacy) {
   const stripped = stripPayloadFingerprinting(query, privacy);
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(stripped)) {
-    if (value !== void 0 && value !== null) {
-      params.set(key, typeof value === "object" ? JSON.stringify(value) : String(value));
+    const values = Array.isArray(value) ? value : [value];
+    for (const item of values) {
+      if (item !== void 0 && item !== null)
+        params.append(key, typeof item === "object" ? JSON.stringify(item) : String(item));
     }
   }
   return { queryString: params.toString(), stripped };
@@ -61,6 +173,13 @@ export default defineEventHandler(async (event) => {
       message: `No domain in proxy path: ${path}`
     });
   }
+  if (!isPublicNetworkHostname(domain)) {
+    log("[proxy] Rejected local or non-public target:", domain);
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Local network targets are not allowed"
+    });
+  }
   let perScriptInput;
   for (const [configDomain, privacyInput] of Object.entries(domainPrivacy)) {
     if (matchDomain(domain, configDomain)) {
@@ -168,7 +287,7 @@ export default defineEventHandler(async (event) => {
     if (!shouldTransformBody) {
       passthroughBody = true;
     } else if (transformableBodyType === "form") {
-      const formBody = await readRawBody(event);
+      const formBody = await readTransformBody(event);
       rawBody = formBody;
       if (formBody != null) {
         const params = new URLSearchParams(formBody);
@@ -196,7 +315,18 @@ export default defineEventHandler(async (event) => {
         body = transformed.toString();
       }
     } else {
-      rawBody = await readBody(event);
+      const jsonBody = await readTransformBody(event);
+      if (jsonBody !== void 0) {
+        try {
+          rawBody = JSON.parse(jsonBody);
+        } catch (error) {
+          throw createError({
+            statusCode: 400,
+            statusMessage: "Invalid JSON proxy request body",
+            cause: error
+          });
+        }
+      }
       if (Array.isArray(rawBody)) {
         body = rawBody.map(
           (item) => item && typeof item === "object" && !Array.isArray(item) ? stripPayloadFingerprinting(item, privacy) : item
@@ -209,7 +339,7 @@ export default defineEventHandler(async (event) => {
     }
   }
   const nitro = useNitroApp();
-  await nitro.hooks.callHook("nuxt-scripts:proxy", {
+  await nitro.hooks?.callHook?.("nuxt-scripts:proxy", {
     timestamp: Date.now(),
     path: event.path,
     targetUrl,
@@ -233,51 +363,81 @@ export default defineEventHandler(async (event) => {
   const timeoutId = setTimeout(() => {
     timedOut = true;
     controller.abort();
-  }, 15e3);
+  }, UPSTREAM_TIMEOUT_MS);
   let fetchBody;
-  if (passthroughBody) {
+  if (passthroughBody && originalHeaders["content-length"] !== "0") {
     fetchBody = getRequestWebStream(event);
   } else if (body !== void 0) {
     fetchBody = transformableBodyType === "json" ? JSON.stringify(body) : String(body);
   }
   let response;
+  let network;
   try {
-    response = await fetch(targetUrl, {
+    network = await createPublicNetworkDispatcher();
+    const requestInit = {
       method: method || "GET",
       headers,
       body: fetchBody,
       credentials: "omit",
       // Don't send cookies to third parties
       signal: controller.signal,
-      // @ts-expect-error Node fetch supports duplex for streaming request bodies
-      duplex: passthroughBody ? "half" : void 0
-    });
+      redirect: "manual",
+      duplex: fetchBody instanceof ReadableStream ? "half" : void 0
+    };
+    response = await network.fetch(targetUrl, requestInit);
+    clearTimeout(timeoutId);
   } catch (err) {
+    clearTimeout(timeoutId);
+    await closePublicNetworkDispatcher(network, err);
     log("[proxy] Upstream error:", err);
+    const blockedPrivateNetwork = isPrivateNetworkResolutionError(err);
     throw createError({
-      statusCode: timedOut ? 504 : 502,
-      statusMessage: timedOut ? "Gateway Timeout" : "Bad Gateway",
-      message: `Proxy upstream request failed: ${targetUrl}`,
+      statusCode: blockedPrivateNetwork ? 403 : timedOut ? 504 : 502,
+      statusMessage: blockedPrivateNetwork ? "Local network targets are not allowed" : timedOut ? "Gateway Timeout" : "Bad Gateway",
+      message: "Proxy upstream request failed",
       cause: err,
       data: {
         errorName: err?.name,
         errorCode: timedOut ? "TIMEOUT" : err?.code
       }
     });
-  } finally {
-    clearTimeout(timeoutId);
   }
   log("[proxy] Response:", response.status, response.statusText);
+  if (response.status >= 300 && response.status < 400 && response.status !== 304) {
+    clearTimeout(timeoutId);
+    const redirectError = createError({
+      statusCode: 502,
+      statusMessage: "Unsafe upstream redirect",
+      message: "Proxy upstream returned a redirect that was not followed"
+    });
+    await response.body?.cancel(redirectError).catch((cancelError) => Object.assign(redirectError, { cleanupError: cancelError }));
+    await closePublicNetworkDispatcher(network, redirectError);
+    throw redirectError;
+  }
+  const responseConnectionHeaders = new Set(
+    (response.headers.get("connection") || "").split(",").map((header) => header.trim().toLowerCase()).filter(Boolean)
+  );
   response.headers.forEach((value, key) => {
-    if (!SKIP_RESPONSE_HEADERS.has(key.toLowerCase())) {
+    const lowerKey = key.toLowerCase();
+    if (!SKIP_RESPONSE_HEADERS.has(lowerKey) && !responseConnectionHeaders.has(lowerKey)) {
       setResponseHeader(event, key, value);
     }
   });
+  setResponseHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'");
+  setResponseHeader(event, "X-Content-Type-Options", "nosniff");
   setResponseStatus(event, response.status, response.statusText);
-  const responseContentType = response.headers.get("content-type") || "";
-  const isTextContent = responseContentType.includes("text") || responseContentType.includes("javascript") || responseContentType.includes("json");
-  if (isTextContent) {
-    return await response.text();
+  if (!response.body) {
+    await closePublicNetworkDispatcher(network);
+    return null;
+  }
+  const guardedBody = withResponseBodyIdleTimeout(response.body, UPSTREAM_TIMEOUT_MS, () => controller.abort());
+  let streamError;
+  try {
+    return await sendStream(event, guardedBody);
+  } catch (error) {
+    streamError = error;
+    throw error;
+  } finally {
+    await closePublicNetworkDispatcher(network, streamError);
   }
-  return Buffer.from(await response.arrayBuffer());
 });

package/dist/runtime/server/utils/cache-config.d.ts

@@ -0,0 +1,14 @@
+/** Dedicated Nitro storage mount used by Nuxt Scripts' upstream caches. */
+export declare const NUXT_SCRIPTS_CACHE_BASE = "nuxt-scripts-cache";
+/**
+ * Conservative defaults for the in-process fallback. Applications can replace
+ * this mount with Redis, KV, filesystem, or their own storage configuration.
+ */
+export declare const NUXT_SCRIPTS_CACHE_MAX_ENTRIES = 500;
+export declare const NUXT_SCRIPTS_CACHE_MAX_SIZE: number;
+export declare const NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE: number;
+interface NitroOptionsWithStorage {
+    storage?: Record<string, unknown>;
+}
+export declare function ensureNuxtScriptsCacheStorage(nitroOptions: NitroOptionsWithStorage): void;
+export {};

package/dist/runtime/server/utils/cache-config.js

@@ -0,0 +1,13 @@
+export const NUXT_SCRIPTS_CACHE_BASE = "nuxt-scripts-cache";
+export const NUXT_SCRIPTS_CACHE_MAX_ENTRIES = 500;
+export const NUXT_SCRIPTS_CACHE_MAX_SIZE = 32 * 1024 * 1024;
+export const NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE = 8 * 1024 * 1024;
+export function ensureNuxtScriptsCacheStorage(nitroOptions) {
+  nitroOptions.storage ||= {};
+  nitroOptions.storage[NUXT_SCRIPTS_CACHE_BASE] ||= {
+    driver: "lru-cache",
+    max: NUXT_SCRIPTS_CACHE_MAX_ENTRIES,
+    maxSize: NUXT_SCRIPTS_CACHE_MAX_SIZE,
+    maxEntrySize: NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE
+  };
+}

package/dist/runtime/server/utils/cached-upstream.d.ts

@@ -33,15 +33,36 @@ export interface CachedBinaryFetchOptions {
     redirect?: 'follow' | 'manual';
     ignoreResponseError?: boolean;
 }
+export interface CachedBinaryFetchConfig {
+    /** Validate the initial URL and every redirect before requesting it. */
+    allowUrl?: (url: URL) => boolean;
+    /** Reject invalid payload types before reading or caching the response body. */
+    allowContentType?: (contentType: string) => boolean;
+    maxRedirects?: number;
+    /** Maximum decoded response size stored in cache. Defaults to 10 MiB. */
+    maxResponseBytes?: number;
+}
+export interface CachedJsonFetchConfig<T> {
+    /** Validate the initial URL and every redirect before requesting it. */
+    allowUrl: (url: URL) => boolean;
+    maxRedirects?: number;
+    responseType?: 'json' | 'text';
+    contentTypePrefixes?: string[];
+    /** Maximum decoded response size stored in cache. Defaults to 2 MiB. */
+    maxResponseBytes?: number;
+    /** Runs before caching. Throw to reject an invalid upstream response. */
+    validateResponse?: (data: T) => void;
+}
 export interface CachedBinaryResult extends CachedBinaryResponse {
     body: Buffer;
     status: number;
 }
+export declare function isSafeHttpsUrl(url: URL): boolean;
 /**
  * Cache upstream binary/image fetches. Returns a helper that restores the
  * response body as a Buffer so the handler can pipe it straight to the client.
  */
-export declare function createCachedBinaryFetch(name: string, maxAge: number): (url: string, opts?: CachedBinaryFetchOptions) => Promise<CachedBinaryResult>;
+export declare function createCachedBinaryFetch(name: string, maxAge: number, config?: CachedBinaryFetchConfig): (url: string, opts?: CachedBinaryFetchOptions) => Promise<CachedBinaryResult>;
 /**
  * Cache upstream JSON/text fetches. `getKey` is caller-controlled so handlers
  * can normalize on whichever inner params identify the resource (tweet ID,
@@ -50,7 +71,7 @@ export declare function createCachedBinaryFetch(name: string, maxAge: number): (
  */
 export declare function createCachedJsonFetch<T>(name: string, maxAge: number, getKey: (url: string, opts?: {
     headers?: Record<string, string>;
-}) => string): (url: string, opts?: {
+}) => string, config: CachedJsonFetchConfig<T>): (url: string, opts?: {
     headers?: Record<string, string>;
     timeout?: number;
 }) => Promise<T>;

package/dist/runtime/server/utils/cached-upstream.js

@@ -1,25 +1,201 @@
 import { Buffer } from "node:buffer";
-import { defineCachedFunction } from "nitropack/runtime";
-import { $fetch } from "ofetch";
+import { createFetch } from "ofetch";
 import { hash } from "ohash";
-export function createCachedBinaryFetch(name, maxAge) {
+import { defineCachedFunction } from "#nuxt-scripts/nitro";
+import { NUXT_SCRIPTS_CACHE_BASE } from "./cache-config.js";
+import { closePublicNetworkDispatcher, createPublicNetworkDispatcher, isPublicNetworkHostname } from "./network-host.js";
+const DEFAULT_BINARY_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+const DEFAULT_JSON_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+export function isSafeHttpsUrl(url) {
+  return url.protocol === "https:" && !url.username && !url.password && (!url.port || url.port === "443") && isPublicNetworkHostname(url.hostname);
+}
+function upstreamError(message, statusCode, statusMessage, cause) {
+  return Object.assign(new Error(message, cause === void 0 ? void 0 : { cause }), {
+    statusCode,
+    statusMessage
+  });
+}
+function resolveMaxResponseBytes(value, fallback) {
+  const maxBytes = value ?? fallback;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+    throw new TypeError("maxResponseBytes must be a non-negative safe integer");
+  return maxBytes;
+}
+async function cancelBody(body, error) {
+  if (!body)
+    return;
+  await body.cancel(error).catch((cancelError) => {
+    if (error) {
+      Object.assign(error, { cause: cancelError });
+      return;
+    }
+    throw cancelError;
+  });
+}
+async function readBoundedResponseBody(body, options) {
+  if (!body)
+    return new Uint8Array();
+  const reader = body.getReader();
+  const chunks = [];
+  let size = 0;
+  let timeoutId;
+  const timeoutError = upstreamError("Upstream response body timed out", 504, "Gateway Timeout");
+  const timeout = options.timeoutMs > 0 ? new Promise((_resolve, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(timeoutError);
+      void reader.cancel(timeoutError).catch((cancelError) => Object.assign(timeoutError, { cause: cancelError }));
+    }, options.timeoutMs);
+  }) : void 0;
+  try {
+    while (true) {
+      const result = await (timeout ? Promise.race([reader.read(), timeout]) : reader.read());
+      if (result.done)
+        break;
+      size += result.value.byteLength;
+      if (size > options.maxBytes) {
+        const error = upstreamError(
+          `Upstream response exceeded ${options.maxBytes} bytes`,
+          502,
+          "Upstream response too large"
+        );
+        await reader.cancel(error).catch((cancelError) => Object.assign(error, { cause: cancelError }));
+        throw error;
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    if (timeoutId !== void 0)
+      clearTimeout(timeoutId);
+  }
+  const data = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    data.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return data;
+}
+async function rejectResponse(response, error) {
+  await cancelBody(response._data, error);
+  throw error;
+}
+function parseUpstreamUrl(url) {
+  try {
+    return new URL(url);
+  } catch (cause) {
+    throw upstreamError("Upstream URL is invalid", 400, "Invalid upstream URL", cause);
+  }
+}
+function assertAllowedUrl(url, allowUrl) {
+  if (allowUrl && !allowUrl(url))
+    throw upstreamError("Upstream URL is not allowed", 403, "Upstream URL not allowed");
+}
+function resolveRedirect(response, currentUrl, redirectCount, policy) {
+  if (response.status < 300 || response.status >= 400 || response.status === 304)
+    return;
+  const location = response.headers.get("location");
+  if (!location)
+    throw upstreamError("Upstream redirect has no Location header", 502, "Invalid upstream redirect");
+  if (redirectCount >= (policy.maxRedirects ?? 5))
+    throw upstreamError("Upstream redirect limit exceeded", 502, "Too many upstream redirects");
+  let nextUrl;
+  try {
+    nextUrl = new URL(location, currentUrl);
+  } catch (cause) {
+    throw upstreamError("Upstream redirect URL is invalid", 502, "Invalid upstream redirect", cause);
+  }
+  assertAllowedUrl(nextUrl, policy.allowUrl);
+  return nextUrl;
+}
+async function fetchBoundedUpstream(url, options) {
+  let currentUrl = parseUpstreamUrl(url);
+  assertAllowedUrl(currentUrl, options.allowUrl);
+  if (options.redirect === "follow" && !options.allowUrl)
+    throw new Error("Automatic redirects require an allowUrl redirect policy");
+  const network = await createPublicNetworkDispatcher();
+  let primaryError;
+  try {
+    const safeFetch = createFetch({ fetch: network.fetch });
+    for (let redirectCount = 0; ; redirectCount++) {
+      const response = await safeFetch.raw(currentUrl.toString(), {
+        responseType: "stream",
+        timeout: options.timeoutMs,
+        redirect: "manual",
+        ignoreResponseError: true,
+        headers: options.headers
+      });
+      if (options.redirect === "follow") {
+        let nextUrl;
+        try {
+          nextUrl = resolveRedirect(response, currentUrl, redirectCount, options);
+        } catch (error) {
+          await rejectResponse(response, error);
+        }
+        if (nextUrl) {
+          await cancelBody(response._data);
+          currentUrl = nextUrl;
+          continue;
+        }
+      }
+      if (!options.ignoreResponseError && response.status >= 400 && response.status < 600) {
+        await rejectResponse(response, upstreamError(
+          `Upstream request failed with status ${response.status}`,
+          response.status,
+          response.statusText || "Upstream request failed"
+        ));
+      }
+      const contentType = response.headers.get("content-type");
+      const isRedirect = response.status >= 300 && response.status < 400 && response.status !== 304;
+      if (!isRedirect && (options.allowContentType || options.contentTypePrefixes?.length)) {
+        const normalizedContentType = contentType?.split(";", 1)[0]?.trim().toLowerCase();
+        if (options.contentTypePrefixes?.length && (!normalizedContentType || !options.contentTypePrefixes.some((prefix) => normalizedContentType.startsWith(prefix)))) {
+          await rejectResponse(
+            response,
+            upstreamError("Upstream response content type is not allowed", 415, "Unsupported upstream content type")
+          );
+        }
+        if (options.allowContentType && (!normalizedContentType || !options.allowContentType(normalizedContentType))) {
+          await rejectResponse(
+            response,
+            upstreamError("Upstream response content type is not allowed", 415, "Unsupported upstream content type")
+          );
+        }
+      }
+      const data = await readBoundedResponseBody(response._data, {
+        maxBytes: options.maxResponseBytes,
+        timeoutMs: options.timeoutMs
+      });
+      return { contentType, data, status: response.status };
+    }
+  } catch (error) {
+    primaryError = error;
+    throw error;
+  } finally {
+    await closePublicNetworkDispatcher(network, primaryError);
+  }
+}
+export function createCachedBinaryFetch(name, maxAge, config = {}) {
+  const maxResponseBytes = resolveMaxResponseBytes(config.maxResponseBytes, DEFAULT_BINARY_MAX_RESPONSE_BYTES);
   const cached = defineCachedFunction(
     async (url, opts) => {
-      const response = await $fetch.raw(url, {
-        responseType: "arrayBuffer",
-        timeout: opts?.timeout ?? 1e4,
-        redirect: opts?.redirect ?? "follow",
+      const response = await fetchBoundedUpstream(url, {
+        allowContentType: config.allowContentType,
+        allowUrl: config.allowUrl,
+        headers: opts?.headers,
         ignoreResponseError: opts?.ignoreResponseError ?? false,
-        headers: opts?.headers
+        maxRedirects: config.maxRedirects,
+        maxResponseBytes,
+        redirect: opts?.redirect ?? (config.allowUrl ? "follow" : "manual"),
+        timeoutMs: opts?.timeout ?? 1e4
       });
-      const data = response._data;
       return {
-        base64: data ? Buffer.from(data).toString("base64") : "",
-        contentType: response.headers.get("content-type"),
+        base64: response.data.byteLength ? Buffer.from(response.data).toString("base64") : "",
+        contentType: response.contentType,
         status: response.status
       };
     },
     {
+      base: NUXT_SCRIPTS_CACHE_BASE,
       name,
       maxAge,
       swr: true,
@@ -49,15 +225,36 @@ export function createCachedBinaryFetch(name, maxAge) {
     };
   };
 }
-export function createCachedJsonFetch(name, maxAge, getKey) {
+export function createCachedJsonFetch(name, maxAge, getKey, config) {
+  const maxResponseBytes = resolveMaxResponseBytes(config.maxResponseBytes, DEFAULT_JSON_MAX_RESPONSE_BYTES);
   return defineCachedFunction(
     async (url, opts) => {
-      return await $fetch(url, {
-        timeout: opts?.timeout ?? 1e4,
-        headers: opts?.headers
+      const response = await fetchBoundedUpstream(url, {
+        allowUrl: config.allowUrl,
+        contentTypePrefixes: config.contentTypePrefixes,
+        headers: opts?.headers,
+        ignoreResponseError: false,
+        maxRedirects: config.maxRedirects,
+        maxResponseBytes,
+        redirect: "follow",
+        timeoutMs: opts?.timeout ?? 1e4
       });
+      const text = new TextDecoder().decode(response.data);
+      let data;
+      if (config.responseType === "text") {
+        data = text;
+      } else {
+        try {
+          data = JSON.parse(text);
+        } catch (cause) {
+          throw upstreamError("Upstream response is not valid JSON", 502, "Invalid upstream response", cause);
+        }
+      }
+      config.validateResponse?.(data);
+      return data;
     },
     {
+      base: NUXT_SCRIPTS_CACHE_BASE,
       name,
       maxAge,
       swr: true,

package/dist/runtime/server/utils/image-proxy.d.ts

@@ -3,8 +3,9 @@ export interface ImageProxyConfig {
     accept?: string;
     userAgent?: string;
     cacheMaxAge?: number;
-    contentType?: string;
-    /** Follow redirects (default: true). Set to false to reject redirects (SSRF protection). */
+    /** Allowed response Content-Type prefixes. SVG is always rejected as active content. */
+    contentTypePrefixes?: string[];
+    /** Follow redirects after applying the same URL allowlist to every hop. */
     followRedirects?: boolean;
     /** Decode & in URL query parameter */
     decodeAmpersands?: boolean;