@the-40-thieves/obsidian-tc-shared 1.31.2 → 1.31.4

package/dist/net-host.js

@@ -54,6 +54,75 @@ export function isLoopbackHost(host) {
     }
     return false;
 }
+function ipv4OctetsOf(h) {
+    if (!isStrictIpv4(h))
+        return null;
+    const parts = h.split(".").map(Number);
+    return parts;
+}
+// THE-1125 (security-review follow-up) — private/reserved IPv4 ranges a telemetry endpoint must
+// never be allowed to name literally: RFC1918 private space (10/8, 172.16/12, 192.168/16),
+// RFC3927 link-local (169.254/16 — this is ALSO the cloud metadata address, 169.254.169.254, on
+// every major cloud provider), RFC6598 carrier-grade NAT (100.64/10), and 0/8 ("this network").
+// 127/8 (loopback) is deliberately excluded here — it is checked and ALLOWED separately by
+// isLoopbackHost.
+function isDisallowedPrivateIpv4(octets) {
+    const [a, b] = octets;
+    if (a === 0)
+        return true;
+    if (a === 10)
+        return true;
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    if (a === 169 && b === 254)
+        return true;
+    if (a === 192 && b === 168)
+        return true;
+    return false;
+}
+// THE-1125 — the IPv6 counterparts: "::" (unspecified), fc00::/7 (unique-local, RFC4193 —
+// fd00::/8 in practice, the IPv6 analogue of RFC1918), fe80::/10 (link-local). "::1" (loopback) is
+// deliberately excluded — allowed separately by isLoopbackHost. `h` must already be
+// normalizeHostForBind'd (lowercase, unbracketed).
+function isDisallowedPrivateIpv6(h) {
+    if (h === "::")
+        return true;
+    if (h.startsWith("fc") || h.startsWith("fd"))
+        return true;
+    if (/^fe[89ab]/.test(h))
+        return true;
+    return false;
+}
+/**
+ * True when `host` is a LITERAL IP address (v4, v6, or an IPv4-mapped IPv6 form) in a private,
+ * link-local, carrier-grade-NAT, unspecified, or cloud-metadata range. Loopback is NOT included
+ * here (see isLoopbackHost) — it is the one such range a config is allowed to name.
+ *
+ * Deliberately does NOT resolve DNS: a hostname that happens to RESOLVE to one of these ranges at
+ * request time is out of scope by design (this is an operator-configured value, documented as
+ * such — resolving it here would need a network call inside config validation, and the resolved
+ * address could differ at send time anyway). This function only ever looks at the literal text of
+ * the host, exactly as `new URL(...).hostname` reports it.
+ */
+export function isDisallowedLiteralHost(host) {
+    const h = normalizeHostForBind(host);
+    const direct = ipv4OctetsOf(h);
+    if (direct)
+        return direct[0] !== 127 && isDisallowedPrivateIpv4(direct);
+    if (h.startsWith("::ffff:")) {
+        const rest = h.slice("::ffff:".length);
+        const dotted = ipv4OctetsOf(rest) ? rest : ipv4MappedHexToDotted(rest);
+        const mapped = dotted !== null ? ipv4OctetsOf(dotted) : null;
+        if (!mapped)
+            return false; // unparseable — not this function's job to flag.
+        return mapped[0] !== 127 && isDisallowedPrivateIpv4(mapped);
+    }
+    if (h.includes(":"))
+        return isDisallowedPrivateIpv6(h); // a bare IPv6 literal.
+    return false; // a hostname, not a literal IP — see the "does not resolve DNS" note above.
+}
 // THE-1084 review round 1, finding 1: parses with the RUNTIME `URL` class, which canonicalizes
 // non-canonical-but-valid forms exactly as `new URL()`/`fetch` will before the request actually
 // goes out ("http:evil.example/path" -> scheme "http", host "evil.example" — verified against

package/dist/net-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"net-host.js","sourceRoot":"","sources":["../src/net-host.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,wBAAwB;AACxB,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,0FAA0F;AAC1F,gGAAgG;AAChG,oGAAoG;AACpG,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,+FAA+F;AAC/F,gGAAgG;AAChG,8FAA8F;AAC9F,mGAAmG;AACnG,6FAA6F;AAC7F,2CAA2C;AAC3C,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,sFAAsF;AACtF,iGAAiG;AACjG,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,OAAO,GAAI,UAAuC,CAAC,GAAG,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,CAAS;IAET,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;AACvE,CAAC;AAED;;wFAEwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AACpC,CAAC"}
+{"version":3,"file":"net-host.js","sourceRoot":"","sources":["../src/net-host.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,wBAAwB;AACxB,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,0FAA0F;AAC1F,gGAAgG;AAChG,oGAAoG;AACpG,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,KAAyC,CAAC;AACnD,CAAC;AAED,gGAAgG;AAChG,2FAA2F;AAC3F,gGAAgG;AAChG,gGAAgG;AAChG,2FAA2F;AAC3F,kBAAkB;AAClB,SAAS,uBAAuB,CAAC,MAAiD;IAChF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0FAA0F;AAC1F,mGAAmG;AACnG,oFAAoF;AACpF,mDAAmD;AACnD,SAAS,uBAAuB,CAAC,CAAS;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,CAAC,iDAAiD;QAC5E,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,uBAAuB;IAC/E,OAAO,KAAK,CAAC,CAAC,4EAA4E;AAC5F,CAAC;AAYD,+FAA+F;AAC/F,gGAAgG;AAChG,8FAA8F;AAC9F,mGAAmG;AACnG,6FAA6F;AAC7F,2CAA2C;AAC3C,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,sFAAsF;AACtF,iGAAiG;AACjG,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,OAAO,GAAI,UAAuC,CAAC,GAAG,CAAC;IAC7D,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAClC,CAAS;IAET,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,EAAE,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC;AACvE,CAAC;AAED;;wFAEwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,iBAAiB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-40-thieves/obsidian-tc-shared",
-  "version": "1.31.2",
+  "version": "1.31.4",
   "description": "Shared Zod schemas and types for obsidian-tc",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -17,11 +17,12 @@
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {
-    "zod": "^4.0.0"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
+    "@types/node": "^24.0.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.1"
   },
   "repository": {
     "type": "git",