@revenexx/integrations-node-sdk 1.8.1 → 1.9.0

package/dist/index.cjs

@@ -572,6 +572,15 @@ async function guardUrl(url, ctxSignal, effectiveMs) {
     clearTimeout(timer);
   }
 }
+function hasContent(body) {
+  if (body == null) return false;
+  if (typeof body === "string") return body.length > 0;
+  if (body instanceof ArrayBuffer) return body.byteLength > 0;
+  if (ArrayBuffer.isView(body)) return body.byteLength > 0;
+  if (body instanceof Blob) return body.size > 0;
+  if (body instanceof URLSearchParams) return body.toString().length > 0;
+  return true;
+}
 async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   let currentUrl = url;
   let currentInit = { ...fetchOptions, redirect: "manual" };
@@ -604,7 +613,6 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
     if (base.protocol === "https:" && nextUrl.protocol !== "https:") {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
-    await guardUrl(nextUrl, ctxSignal, effectiveMs);
     const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
@@ -614,6 +622,14 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-type");
       headers.delete("content-length");
     }
+    if (hasContent(body) && nextUrl.origin !== base.origin) {
+      throw new NodeError(
+        "BLOCKED_ADDRESS",
+        `Blocked ${redirectStatus} redirect to another origin: it would resend the request body to ${nextUrl.origin}`,
+        { status: 0 }
+      );
+    }
+    await guardUrl(nextUrl, ctxSignal, effectiveMs);
     if (nextUrl.origin !== base.origin) {
       for (const name of [...headers.keys()]) {
         if (!headerCrossesOrigin(name)) headers.delete(name);

package/dist/index.js

@@ -480,6 +480,15 @@ async function guardUrl(url, ctxSignal, effectiveMs) {
     clearTimeout(timer);
   }
 }
+function hasContent(body) {
+  if (body == null) return false;
+  if (typeof body === "string") return body.length > 0;
+  if (body instanceof ArrayBuffer) return body.byteLength > 0;
+  if (ArrayBuffer.isView(body)) return body.byteLength > 0;
+  if (body instanceof Blob) return body.size > 0;
+  if (body instanceof URLSearchParams) return body.toString().length > 0;
+  return true;
+}
 async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
   let currentUrl = url;
   let currentInit = { ...fetchOptions, redirect: "manual" };
@@ -512,7 +521,6 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
     if (base.protocol === "https:" && nextUrl.protocol !== "https:") {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
-    await guardUrl(nextUrl, ctxSignal, effectiveMs);
     const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
@@ -522,6 +530,14 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       headers.delete("content-type");
       headers.delete("content-length");
     }
+    if (hasContent(body) && nextUrl.origin !== base.origin) {
+      throw new NodeError(
+        "BLOCKED_ADDRESS",
+        `Blocked ${redirectStatus} redirect to another origin: it would resend the request body to ${nextUrl.origin}`,
+        { status: 0 }
+      );
+    }
+    await guardUrl(nextUrl, ctxSignal, effectiveMs);
     if (nextUrl.origin !== base.origin) {
       for (const name of [...headers.keys()]) {
         if (!headerCrossesOrigin(name)) headers.delete(name);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/integrations-node-sdk",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "TypeScript interfaces and utilities for Revenexx integration nodes",
   "license": "MIT",
   "author": "revenexx GmbH",