@pracht/image 0.1.0 → 0.1.1

package/README.md

@@ -40,8 +40,10 @@ export const GET = imageHandler;
 export const HEAD = imageHandler;
 ```
 
-Set `localOrigin` to the same trusted public origin used by
-`nodeAdapter({ canonicalOrigin })`. It may be omitted for loopback development.
+Set `localOrigin` to the same trusted origin used by
+`nodeAdapter({ canonicalOrigin })` in development and production. Relative
+sources fail closed when it is omitted; request and Host-derived origins are
+never trusted, even when they look like loopback addresses.
 
 See [docs/IMAGES.md](https://github.com/JoviDeCroock/pracht/blob/main/docs/IMAGES.md)
 for the full guide: loader configuration, endpoint security options, and

package/dist/index.mjs

@@ -16,10 +16,11 @@ function getNodeEnv() {
 	return globalThis.process?.env?.NODE_ENV;
 }
 function getImportMetaDev() {
-	const env = import.meta.env;
-	if (env?.MODE === "production") return false;
-	if (typeof env?.DEV === "boolean") return env.DEV;
-	if (typeof env?.MODE === "string") return env.MODE !== "production";
+	const mode = import.meta.env?.MODE;
+	if (mode === "production") return false;
+	const dev = import.meta.env?.DEV;
+	if (typeof dev === "boolean") return dev;
+	if (typeof mode === "string") return mode !== "production";
 }
 function isDevWarningsEnabled() {
 	const nodeEnv = getNodeEnv();

package/dist/node.d.mts

@@ -18,10 +18,9 @@ interface CreateImageHandlerOptions {
   /** Remote sources to allow. Defaults to none (same-origin only). */
   remotePatterns?: RemotePattern[];
   /**
-   * Trusted public origin used to resolve relative image paths in production.
-   * Required for non-loopback requests so an attacker-controlled Host header
-   * cannot turn the endpoint into an open proxy. Loopback origins remain
-   * available without configuration for local development.
+   * Trusted origin used to resolve relative image paths. Required whenever
+   * relative sources are served so an attacker-controlled Host header cannot
+   * turn the endpoint into an open proxy.
    */
   localOrigin?: string;
   /**
@@ -67,7 +66,9 @@ interface ImageHandlerArgs {
  * ```ts
  * // src/api/_pracht/image.ts
  * import { createImageHandler } from "@pracht/image/node";
- * const imageHandler = createImageHandler();
+ * const imageHandler = createImageHandler({
+ *   localOrigin: process.env.PRACHT_ORIGIN,
+ * });
  * export const GET = imageHandler;
  * export const HEAD = imageHandler;
  * ```
@@ -75,7 +76,7 @@ interface ImageHandlerArgs {
  * The handler resizes and re-encodes images with sharp (an optional peer
  * dependency — install it in your app), negotiates WebP/AVIF via the `Accept`
  * header, and answers with cacheable responses keyed on the query string.
- * Relative sources resolve against a trusted `localOrigin` in production;
+ * Relative sources resolve only against a configured, trusted `localOrigin`;
  * `remotePatterns` opts specific remote hosts in.
  */
 declare function createImageHandler(options?: CreateImageHandlerOptions): (args: ImageHandlerArgs) => Promise<Response>;

package/dist/node.mjs

@@ -55,10 +55,6 @@ function normalizeLocalOrigin(value) {
 	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw new Error("createImageHandler({ localOrigin }) expects an http(s) origin without a path.");
 	return url.origin;
 }
-function isLoopbackHostname(hostname) {
-	const host = hostname.toLowerCase();
-	return host === "localhost" || host.endsWith(".localhost") || host === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host);
-}
 function isAllowedTarget(url, localOrigin, patterns) {
 	if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password) return false;
 	return localOrigin !== void 0 && url.origin === localOrigin || matchesRemotePatterns(url, patterns);
@@ -114,7 +110,9 @@ function imageResponseBody(request, bytes) {
 * ```ts
 * // src/api/_pracht/image.ts
 * import { createImageHandler } from "@pracht/image/node";
-* const imageHandler = createImageHandler();
+* const imageHandler = createImageHandler({
+*   localOrigin: process.env.PRACHT_ORIGIN,
+* });
 * export const GET = imageHandler;
 * export const HEAD = imageHandler;
 * ```
@@ -122,7 +120,7 @@ function imageResponseBody(request, bytes) {
 * The handler resizes and re-encodes images with sharp (an optional peer
 * dependency — install it in your app), negotiates WebP/AVIF via the `Accept`
 * header, and answers with cacheable responses keyed on the query string.
-* Relative sources resolve against a trusted `localOrigin` in production;
+* Relative sources resolve only against a configured, trusted `localOrigin`;
 * `remotePatterns` opts specific remote hosts in.
 */
 function createImageHandler(options = {}) {
@@ -147,7 +145,6 @@ function createImageHandler(options = {}) {
 			headers: { allow: "GET, HEAD" }
 		});
 		const requestUrl = new URL(request.url);
-		const localOrigin = configuredLocalOrigin ?? (isLoopbackHostname(requestUrl.hostname) ? requestUrl.origin : void 0);
 		const source = requestUrl.searchParams.get("url");
 		const widthParam = requestUrl.searchParams.get("w");
 		const qualityParam = requestUrl.searchParams.get("q");
@@ -163,8 +160,9 @@ function createImageHandler(options = {}) {
 			if (target.username || target.password) return errorResponse(400, "The \"url\" parameter may not contain credentials.");
 			if (!matchesRemotePatterns(target, remotePatterns)) return errorResponse(403, `Remote image "${source}" is not allowed. Add its host to the remotePatterns option of createImageHandler() to opt it in.`);
 		} else if (source.startsWith("/")) {
-			if (!localOrigin) return errorResponse(500, "Relative image sources require createImageHandler({ localOrigin }) outside local development.");
-			target = new URL(source, localOrigin);
+			if (!configuredLocalOrigin) return errorResponse(500, "Relative image sources require createImageHandler({ localOrigin }).");
+			target = new URL(source, configuredLocalOrigin);
+			if (target.origin !== configuredLocalOrigin) return errorResponse(400, "Relative \"url\" values must remain on the configured localOrigin.");
 		} else return errorResponse(400, "The \"url\" parameter must be a relative path (starting with \"/\") or an absolute http(s) URL.");
 		if (!widthParam) return errorResponse(400, "Missing required \"w\" query parameter.");
 		const width = Number(widthParam);
@@ -195,7 +193,7 @@ function createImageHandler(options = {}) {
 			} catch {
 				return errorResponse(502, `Source image "${source}" returned an invalid redirect.`);
 			}
-			if (!isAllowedTarget(nextTarget, localOrigin, remotePatterns)) return errorResponse(403, `Source image "${source}" redirected to a host that is not allowed.`);
+			if (!isAllowedTarget(nextTarget, configuredLocalOrigin, remotePatterns)) return errorResponse(403, `Source image "${source}" redirected to a host that is not allowed.`);
 			try {
 				await upstream.body?.cancel();
 			} catch {}
@@ -209,7 +207,7 @@ function createImageHandler(options = {}) {
 			} catch {
 				finalUrl = void 0;
 			}
-			if (finalUrl && !isAllowedTarget(finalUrl, localOrigin, remotePatterns)) return errorResponse(403, `Source image "${source}" redirected to a host that is not allowed.`);
+			if (finalUrl && !isAllowedTarget(finalUrl, configuredLocalOrigin, remotePatterns)) return errorResponse(403, `Source image "${source}" redirected to a host that is not allowed.`);
 		}
 		if (!upstream.ok) return errorResponse(502, `Source image "${source}" responded with ${upstream.status}.`);
 		const sourceType = (upstream.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pracht/image",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Responsive, CLS-safe <Image> component for Pracht with pluggable optimization loaders and a Node image endpoint.",
   "keywords": [
     "pracht",