@patchstack/connect 0.3.26 → 0.3.27

package/dist/protect.js

@@ -782,6 +782,26 @@ function warnUnsupportedMatchType(type) {
     `[patchstack] Unsupported rule_v2 match type "${type}" \u2014 condition treated as no-match. Rules relying on it are not enforced by this engine.`
   );
 }
+function hostFromValue(value) {
+  const raw = String(value ?? "").trim();
+  if (raw === "") return "";
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.startsWith("//")) {
+    try {
+      return new URL(raw.startsWith("//") ? `http:${raw}` : raw).hostname;
+    } catch {
+      return raw;
+    }
+  }
+  if (raw.startsWith("[")) {
+    const end = raw.indexOf("]");
+    if (end > 0) return raw.slice(1, end);
+  }
+  const colon = raw.indexOf(":");
+  if (colon > 0 && raw.indexOf(":", colon + 1) === -1 && /^\d+$/.test(raw.slice(colon + 1))) {
+    return raw.slice(0, colon);
+  }
+  return raw;
+}
 function isInternalHost(hostname) {
   if (!hostname) return false;
   let host = String(hostname).toLowerCase().replace(/^\[|\]$/g, "");
@@ -871,8 +891,20 @@ function expandIPv6(host) {
   }
   return out;
 }
+var warnedScopes = /* @__PURE__ */ new Set();
+function warnUnrecognisedScope(when) {
+  const key = Object.keys(when).sort().join(",");
+  if (warnedScopes.has(key)) return;
+  warnedScopes.add(key);
+  console.warn(
+    `[patchstack] Rule scope \`when: { ${key} }\` names no supported key \u2014 the engine understands \`method\` and \`path\`. The scope is IGNORED and the rule applies to every request.`
+  );
+}
 function ruleAppliesTo(when, resolver) {
   try {
+    if (when.method === void 0 && when.path === void 0 && Object.keys(when).length > 0) {
+      warnUnrecognisedScope(when);
+    }
     if (when.method) {
       const methods = (Array.isArray(when.method) ? when.method : [when.method]).map((m) => String(m).toUpperCase());
       const actual = String(resolver.resolve("server.REQUEST_METHOD")[0] ?? "GET").toUpperCase();
@@ -1038,7 +1070,7 @@ function matchValue(type, value, matchVal, matchObj) {
       }
     }
     case "internal_host":
-      return isInternalHost(strValue);
+      return isInternalHost(hostFromValue(strValue));
     case "quotes":
     // engine-php exposes `inline_js_xss` as an alias of `quotes`.
     case "inline_js_xss":