@ocap/util 1.24.9 → 1.25.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/esm/url.d.ts +2 -0
  2. package/esm/url.js +39 -0
  3. package/lib/url.d.ts +2 -0
  4. package/lib/url.js +43 -0
  5. package/package.json +2 -2
package/esm/url.d.ts ADDED
@@ -0,0 +1,2 @@
1
+ export declare function isIPv4(host: string): boolean;
2
+ export declare function verifyUrl(url: string): boolean;
package/esm/url.js ADDED
@@ -0,0 +1,39 @@
1
+ import { URL } from 'url';
2
+ export function isIPv4(host) {
3
+ const m = host.match(/^(\d{1,3}\.){3}\d{1,3}$/);
4
+ if (!m)
5
+ return false;
6
+ return host.split('.').every((p) => {
7
+ if (p.length === 0 || (p.length > 1 && p.startsWith('0')))
8
+ return false;
9
+ const n = Number(p);
10
+ return Number.isInteger(n) && n >= 0 && n <= 255;
11
+ });
12
+ }
13
+ export function verifyUrl(url) {
14
+ if (!url)
15
+ return false;
16
+ if (url.length > 2048)
17
+ return false;
18
+ try {
19
+ const u = new URL(url);
20
+ if (!['http:', 'https:'].includes(u.protocol))
21
+ return false;
22
+ if (!u.hostname)
23
+ return false;
24
+ // should not block localhost in test environment
25
+ if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test' && !process.env.CI) {
26
+ const host = u.hostname.toLowerCase();
27
+ // Block IP addresses
28
+ if (isIPv4(host) || host.includes(':'))
29
+ return false; // treat ":" as IPv6
30
+ // Block localhost
31
+ if (host === 'localhost')
32
+ return false;
33
+ }
34
+ return true;
35
+ }
36
+ catch {
37
+ return false;
38
+ }
39
+ }
package/lib/url.d.ts ADDED
@@ -0,0 +1,2 @@
1
+ export declare function isIPv4(host: string): boolean;
2
+ export declare function verifyUrl(url: string): boolean;
package/lib/url.js ADDED
@@ -0,0 +1,43 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.isIPv4 = isIPv4;
4
+ exports.verifyUrl = verifyUrl;
5
+ const url_1 = require("url");
6
+ function isIPv4(host) {
7
+ const m = host.match(/^(\d{1,3}\.){3}\d{1,3}$/);
8
+ if (!m)
9
+ return false;
10
+ return host.split('.').every((p) => {
11
+ if (p.length === 0 || (p.length > 1 && p.startsWith('0')))
12
+ return false;
13
+ const n = Number(p);
14
+ return Number.isInteger(n) && n >= 0 && n <= 255;
15
+ });
16
+ }
17
+ function verifyUrl(url) {
18
+ if (!url)
19
+ return false;
20
+ if (url.length > 2048)
21
+ return false;
22
+ try {
23
+ const u = new url_1.URL(url);
24
+ if (!['http:', 'https:'].includes(u.protocol))
25
+ return false;
26
+ if (!u.hostname)
27
+ return false;
28
+ // should not block localhost in test environment
29
+ if (process.env.NODE_ENV !== 'development' && process.env.NODE_ENV !== 'test' && !process.env.CI) {
30
+ const host = u.hostname.toLowerCase();
31
+ // Block IP addresses
32
+ if (isIPv4(host) || host.includes(':'))
33
+ return false; // treat ":" as IPv6
34
+ // Block localhost
35
+ if (host === 'localhost')
36
+ return false;
37
+ }
38
+ return true;
39
+ }
40
+ catch {
41
+ return false;
42
+ }
43
+ }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ocap/util",
3
- "version": "1.24.9",
3
+ "version": "1.25.0",
4
4
  "description": "utils shared across multiple forge js libs, works in both node.js and browser",
5
5
  "keywords": [
6
6
  "arcblock",
@@ -17,7 +17,7 @@
17
17
  "bs58": "^5.0.0",
18
18
  "lodash": "^4.17.21",
19
19
  "utf8": "^3.0.0",
20
- "@ocap/types": "^1.24.9"
20
+ "@ocap/types": "^1.25.0"
21
21
  },
22
22
  "resolutions": {
23
23
  "elliptic": "6.5.3"