@tokenoftrust/cli 3.0.6 → 3.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "3.0.6",
+  "version": "3.0.7",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/validate.mjs

@@ -459,6 +459,39 @@ export function isSafeRehostedAssetPathForTenant(value, tenantId) {
   return value.startsWith("/shared/") || value.startsWith(`/tenants/${tenantId}/`);
 }
 
+export function isPlatformPoolImagePath(value) {
+  return typeof value === "string" && /^\/_a\/[0-9a-f]{64}(?:\.[a-z0-9]{1,8})?$/.test(value);
+}
+
+const IMAGE_SOURCE_DNS_NAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/i;
+const IMAGE_SOURCE_BLOCKED_NAME = /(?:^|\.)(?:localhost|localdomain|local|internal|intranet|lan|home|arpa)$/i;
+const IMAGE_SOURCE_IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+
+export function imageSourceUrlRefusal(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 2048) return "unsupported";
+  let url;
+  try { url = new URL(value); } catch { return "unsupported"; }
+  if (url.protocol !== "https:") return "unsafe-scheme";
+  if (url.username || url.password) return "userinfo";
+  if (url.port) return "nonstandard-port";
+  const hostname = url.hostname;
+  if (!hostname || hostname.includes("%")) return "blocked-address";
+  if (IMAGE_SOURCE_IPV4.test(hostname)) return "ip-literal";
+  const name = hostname.endsWith(".") ? hostname.slice(0, -1) : hostname;
+  if (IMAGE_SOURCE_BLOCKED_NAME.test(name) || !IMAGE_SOURCE_DNS_NAME.test(hostname)) return "blocked-address";
+  return null;
+}
+
+export function isPageBlockImageReference(value, tenantId) {
+  if (typeof value !== "string") return false;
+  if (tenantId === undefined || tenantId === null
+    ? isSafeRehostedAssetPath(value)
+    : isSafeRehostedAssetPathForTenant(value, tenantId)) return true;
+  if (isPlatformPoolImagePath(value)) return true;
+  if (!/^https:\/\//i.test(value) || /[\u0000-\u0020\u007f"'<>\\`]/.test(value)) return false;
+  return imageSourceUrlRefusal(value) === null;
+}
+
 export function isSafeStorefrontHref(value) {
   if (typeof value !== "string" || !value.startsWith("/") || value.startsWith("//")) return false;
   if (value.includes("\\") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f]/.test(value)) return false;
@@ -509,11 +542,8 @@ function validateProductSource(value, file, at) {
 }
 
 function validateVisualAsset(value, file, at, out, tenantId) {
-  const safe = tenantId
-    ? isSafeRehostedAssetPathForTenant(value, tenantId)
-    : isSafeRehostedAssetPath(value);
-  if (!safe) {
-    out.push(mk(ERROR, "asset-path", file, `${at} must be a /shared/... asset or belong to the active tenant`));
+  if (!isPageBlockImageReference(value, tenantId || undefined)) {
+    out.push(mk(ERROR, "asset-path", file, `${at} must be a /shared/... or active-tenant asset, a /_a/<sha256> pool reference, or an https source URL on a public host (captured into the pool at preview and publish)`));
   }
 }