@poe-platform/safe-bash 0.1.236 → 0.1.238

package/dist/safe-bash/browser.js

@@ -17776,6 +17776,7 @@ function createFetchTransport(options3 = {}) {
     input3.signal.throwIfAborted();
     const url = new URL(input3.url);
     if (url.protocol !== "http:" && url.protocol !== "https:") throw new CurlError(1, "Unsupported protocol");
+    if (input3.denyPrivateNetworks === true) throw new CurlError(7, "Fetch transport cannot enforce private-network denial");
     const stopped = new AbortController();
     const signal = AbortSignal.any([input3.signal, stopped.signal]);
     const body = requestBody(input3.body, signal);
@@ -17823,6 +17824,9 @@ function createFetchTransport(options3 = {}) {
 
 // packages/safe-bash/src/commands/network/authorizer.ts
 init_platform();
+
+// packages/safe-bash/src/commands/network/private-address.ts
+init_platform();
 function privateIPv4(first, second) {
   return first === 10 || first === 127 || first === 0 || first === 169 && second === 254 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31;
 }
@@ -17852,7 +17856,10 @@ function privateHostname(input3) {
   const [first, second] = octets;
   return privateIPv4(first, second);
 }
+
+// packages/safe-bash/src/commands/network/authorizer.ts
 function createOriginAuthorizer(allowlist = "*", options3 = {}) {
+  const denyPrivateNetworks = options3.denyPrivateNetworks === true;
   const origins = /* @__PURE__ */ new Set();
   const hosts = /* @__PURE__ */ new Set();
   for (const entry of allowlist === "*" ? [] : allowlist) {
@@ -17872,7 +17879,10 @@ function createOriginAuthorizer(allowlist = "*", options3 = {}) {
   return (request) => {
     const url = new URL(request.url);
     const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
-    if (options3.denyPrivateNetworks && privateHostname(hostname)) return false;
+    if (denyPrivateNetworks) {
+      request.requirePrivateNetworkDeny?.();
+      if (privateHostname(hostname)) return false;
+    }
     return allowlist === "*" || origins.has(url.origin) || hosts.has(hostname);
   };
 }