@wooksjs/http-proxy 0.7.16 → 0.7.18

package/dist/index.cjs

@@ -1,8 +1,42 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-let node_url = require("node:url");
 let _wooksjs_event_http = require("@wooksjs/event-http");
 
 //#region packages/http-proxy/src/proxy-utils.ts
+const ALLOWED_PROXY_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+* Resolves the upstream URL for a proxy target.
+*
+* The authority (protocol, host, port) is taken solely from `new URL(target)`.
+* The pathname is intentionally NOT re-parsed against the origin: re-parsing a
+* pathname that begins with `//` or `/\` would promote it to a protocol-relative
+* authority, letting request-derived path data hijack the upstream host (SSRF).
+* Only `http:`/`https:` targets are permitted.
+*
+* @param target - The proxy target URL string.
+* @param allowedHosts - Optional allowlist of upstream hostnames. When provided,
+*   the resolved hostname must match one entry (string = case-insensitive exact
+*   match, RegExp = tested against the hostname); otherwise the request is
+*   rejected. An empty array denies every host.
+* @returns A `URL` whose authority is fixed to the parsed target.
+* @throws HttpError(502) if the target is not a valid `http:`/`https:` URL or its
+*   host is not in `allowedHosts`.
+*/
+function resolveProxyTarget(target, allowedHosts) {
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		throw new _wooksjs_event_http.HttpError(502, "Invalid proxy target URL");
+	}
+	if (!ALLOWED_PROXY_PROTOCOLS.has(url.protocol)) throw new _wooksjs_event_http.HttpError(502, `Proxy target protocol "${url.protocol}" is not allowed`);
+	if (allowedHosts && !isHostAllowed(url.hostname, allowedHosts)) throw new _wooksjs_event_http.HttpError(502, `Proxy target host "${url.hostname}" is not allowed`);
+	url.hash = "";
+	return url;
+}
+function isHostAllowed(hostname, allowedHosts) {
+	const lower = hostname.toLowerCase();
+	return allowedHosts.some((entry) => typeof entry === "string" ? entry.toLowerCase() === lower : entry.test(hostname));
+}
 var IterableRecords = class {
 	constructor() {
 		this.index = 0;
@@ -102,8 +136,8 @@ function useProxy() {
 	const req = raw;
 	const logger = (0, _wooksjs_event_http.useLogger)();
 	return async function proxy(target, opts) {
-		const targetUrl = new node_url.URL(target);
-		const url = new node_url.URL(targetUrl.pathname || "/", targetUrl.origin).toString() + targetUrl.search;
+		const targetUrl = resolveProxyTarget(target, opts?.allowedHosts);
+		const url = targetUrl.toString();
 		const modifiedHeaders = {
 			...req.headers,
 			host: targetUrl.hostname

package/dist/index.d.ts

@@ -11,6 +11,13 @@ interface TWooksProxyControls {
 interface TWooksProxyOptions {
     /** Override the HTTP method used for the proxied request. */
     method?: string;
+    /**
+     * Allowlist of upstream hostnames. When set, the resolved target host must match
+     * one entry (string = case-insensitive exact match, RegExp = tested against the
+     * hostname) or the request is rejected with `502`. Use this when the target is
+     * built from request input. An empty array denies every host.
+     */
+    allowedHosts?: Array<string | RegExp>;
     /** Controls for filtering/transforming outgoing request headers. */
     reqHeaders?: TWooksProxyControls;
     /** Controls for filtering/transforming outgoing request cookies. */

package/dist/index.mjs

@@ -1,7 +1,41 @@
-import { URL } from "node:url";
-import { useLogger, useRequest, useResponse } from "@wooksjs/event-http";
+import { HttpError, useLogger, useRequest, useResponse } from "@wooksjs/event-http";
 
 //#region packages/http-proxy/src/proxy-utils.ts
+const ALLOWED_PROXY_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+* Resolves the upstream URL for a proxy target.
+*
+* The authority (protocol, host, port) is taken solely from `new URL(target)`.
+* The pathname is intentionally NOT re-parsed against the origin: re-parsing a
+* pathname that begins with `//` or `/\` would promote it to a protocol-relative
+* authority, letting request-derived path data hijack the upstream host (SSRF).
+* Only `http:`/`https:` targets are permitted.
+*
+* @param target - The proxy target URL string.
+* @param allowedHosts - Optional allowlist of upstream hostnames. When provided,
+*   the resolved hostname must match one entry (string = case-insensitive exact
+*   match, RegExp = tested against the hostname); otherwise the request is
+*   rejected. An empty array denies every host.
+* @returns A `URL` whose authority is fixed to the parsed target.
+* @throws HttpError(502) if the target is not a valid `http:`/`https:` URL or its
+*   host is not in `allowedHosts`.
+*/
+function resolveProxyTarget(target, allowedHosts) {
+	let url;
+	try {
+		url = new URL(target);
+	} catch {
+		throw new HttpError(502, "Invalid proxy target URL");
+	}
+	if (!ALLOWED_PROXY_PROTOCOLS.has(url.protocol)) throw new HttpError(502, `Proxy target protocol "${url.protocol}" is not allowed`);
+	if (allowedHosts && !isHostAllowed(url.hostname, allowedHosts)) throw new HttpError(502, `Proxy target host "${url.hostname}" is not allowed`);
+	url.hash = "";
+	return url;
+}
+function isHostAllowed(hostname, allowedHosts) {
+	const lower = hostname.toLowerCase();
+	return allowedHosts.some((entry) => typeof entry === "string" ? entry.toLowerCase() === lower : entry.test(hostname));
+}
 var IterableRecords = class {
 	constructor() {
 		this.index = 0;
@@ -101,8 +135,8 @@ function useProxy() {
 	const req = raw;
 	const logger = useLogger();
 	return async function proxy(target, opts) {
-		const targetUrl = new URL(target);
-		const url = new URL(targetUrl.pathname || "/", targetUrl.origin).toString() + targetUrl.search;
+		const targetUrl = resolveProxyTarget(target, opts?.allowedHosts);
+		const url = targetUrl.toString();
 		const modifiedHeaders = {
 			...req.headers,
 			host: targetUrl.hostname

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wooksjs/http-proxy",
-  "version": "0.7.16",
+  "version": "0.7.18",
   "description": "Proxy Wooks composable",
   "keywords": [
     "api",
@@ -42,10 +42,10 @@
   "devDependencies": {
     "typescript": "^5.9.3",
     "vitest": "^3.2.4",
-    "@wooksjs/event-http": "^0.7.16"
+    "@wooksjs/event-http": "^0.7.18"
   },
   "peerDependencies": {
-    "@wooksjs/event-http": "^0.7.16"
+    "@wooksjs/event-http": "^0.7.18"
   },
   "scripts": {
     "build": "rolldown -c ../../rolldown.config.mjs"