ai 6.0.202 → 6.0.203

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # ai
 
+## 6.0.203
+
+### Patch Changes
+
+- f42aa79: fix: harden download URL SSRF guard against hostname and redirect bypasses
+
+  `validateDownloadUrl` and the file download helpers (`downloadBlob`, `download`) could be bypassed in several ways when handling untrusted URLs:
+
+  - A fully-qualified hostname with a trailing dot (e.g. `localhost.`, `myhost.local.`) skipped the localhost/`.local` blocklist.
+  - IPv6 addresses that embed an IPv4 address in their last 32 bits — IPv4-compatible (`::127.0.0.1`), IPv4-translated (`::ffff:0:127.0.0.1`), and NAT64 (`64:ff9b::127.0.0.1`, including the `64:ff9b:1::/48` local-use prefix) — were not decoded and checked against the private IPv4 ranges.
+  - Redirects were validated only _after_ `fetch` had already followed them, so the request to a redirect target (e.g. an internal/metadata address) had already been issued before the check ran.
+  - Several reserved/internal address ranges were not blocked: CGNAT (`100.64.0.0/10`, used by some cloud providers for internal traffic), benchmarking (`198.18.0.0/15`), IETF protocol assignments (`192.0.0.0/24`), the reserved `240.0.0.0/4` block (including the `255.255.255.255` broadcast address), and IPv6 site-local (`fec0::/10`) and multicast (`ff00::/8`).
+
+  The validator now strips trailing dots before the hostname checks and fully expands IPv6 addresses to detect embedded private IPv4 targets. The download helpers now follow redirects manually (`redirect: 'manual'`), re-validating each hop before requesting it, so an unsafe redirect target is never fetched. When a redirect cannot be inspected because the runtime returns an opaque response, the helpers fail closed (reject the redirect) on the server; only in a real browser — where SSRF is not reachable (fetch is constrained by CORS and cannot reach a server's internal network or cloud-metadata endpoints) — is the redirect followed natively so legitimate redirected downloads keep working.
+
+- 5291f7e: Harden stream text processing and middleware against prototype pollution from stream part IDs.
+- b4b575a: fix: redact server error details from UI message streams by default
+
+  `streamText(...).toUIMessageStream()` and `createUIMessageStream` defaulted their `onError` callback to `getErrorMessage`, which serializes the raw error (`error.toString()` / `JSON.stringify(error)`) into the client-facing `{ type: 'error', errorText }` chunk — and also into `tool-output-error` parts. The documented default was `() => 'An error occurred.'`, so applications relying on the documented behavior were unknowingly streaming server exception details (internal hostnames, paths, provider request data, validation inputs) to end users.
+
+  The default `onError` now returns the documented generic `'An error occurred.'`. Raw error details are only emitted when the developer explicitly supplies an `onError` handler. This also redacts `tool-output-error` and invalid-tool-input error text by default; pass an `onError` to surface richer messages.
+
+- Updated dependencies [bfa5864]
+- Updated dependencies [f42aa79]
+  - @ai-sdk/provider-utils@4.0.29
+  - @ai-sdk/gateway@3.0.129
+
 ## 6.0.202
 
 ### Patch Changes

package/dist/index.d.mts

@@ -4296,7 +4296,7 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
  * Creates a UI message stream that can be used to send messages to the client.
  *
  * @param options.execute - A function that is called with a writer to write UI message chunks to the stream.
- * @param options.onError - A function that extracts an error message from an error. Defaults to `getErrorMessage`.
+ * @param options.onError - A function that extracts an error message from an error. Defaults to `() => 'An error occurred.'` so server-side error details are not leaked to the client; supply your own to surface richer messages.
  * @param options.originalMessages - The original messages. If provided, persistence mode is assumed
  *   and a message ID is provided for the response message.
  * @param options.onStepFinish - A callback that is called when each step finishes. Useful for persisting intermediate messages.
@@ -4305,7 +4305,8 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
  *
  * @returns A `ReadableStream` of UI message chunks.
  */
-declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, originalMessages, onStepFinish, onFinish, generateId, }: {
+declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, // prevent leaking server error details to the client by default
+originalMessages, onStepFinish, onFinish, generateId, }: {
     execute: (options: {
         writer: UIMessageStreamWriter<UI_MESSAGE>;
     }) => Promise<void> | void;

package/dist/index.d.ts

@@ -4296,7 +4296,7 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
  * Creates a UI message stream that can be used to send messages to the client.
  *
  * @param options.execute - A function that is called with a writer to write UI message chunks to the stream.
- * @param options.onError - A function that extracts an error message from an error. Defaults to `getErrorMessage`.
+ * @param options.onError - A function that extracts an error message from an error. Defaults to `() => 'An error occurred.'` so server-side error details are not leaked to the client; supply your own to surface richer messages.
  * @param options.originalMessages - The original messages. If provided, persistence mode is assumed
  *   and a message ID is provided for the response message.
  * @param options.onStepFinish - A callback that is called when each step finishes. Useful for persisting intermediate messages.
@@ -4305,7 +4305,8 @@ interface UIMessageStreamWriter<UI_MESSAGE extends UIMessage = UIMessage> {
  *
  * @returns A `ReadableStream` of UI message chunks.
  */
-declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, originalMessages, onStepFinish, onFinish, generateId, }: {
+declare function createUIMessageStream<UI_MESSAGE extends UIMessage>({ execute, onError, // prevent leaking server error details to the client by default
+originalMessages, onStepFinish, onFinish, generateId, }: {
     execute: (options: {
         writer: UIMessageStreamWriter<UI_MESSAGE>;
     }) => Promise<void> | void;

package/dist/index.js

@@ -1281,7 +1281,7 @@ function detectMediaType({
 var import_provider_utils3 = require("@ai-sdk/provider-utils");
 
 // src/version.ts
-var VERSION = true ? "6.0.202" : "0.0.0-test";
+var VERSION = true ? "6.0.203" : "0.0.0-test";
 
 // src/util/download/download.ts
 var download = async ({
@@ -1291,19 +1291,17 @@ var download = async ({
 }) => {
   var _a22;
   const urlText = url.toString();
-  (0, import_provider_utils3.validateDownloadUrl)(urlText);
   try {
-    const response = await fetch(urlText, {
-      headers: (0, import_provider_utils3.withUserAgentSuffix)(
-        {},
-        `ai-sdk/${VERSION}`,
-        (0, import_provider_utils3.getRuntimeEnvironmentUserAgent)()
-      ),
-      signal: abortSignal
+    const headers = (0, import_provider_utils3.withUserAgentSuffix)(
+      {},
+      `ai-sdk/${VERSION}`,
+      (0, import_provider_utils3.getRuntimeEnvironmentUserAgent)()
+    );
+    const response = await (0, import_provider_utils3.fetchWithValidatedRedirects)({
+      url: urlText,
+      headers,
+      abortSignal
     });
-    if (response.redirected) {
-      (0, import_provider_utils3.validateDownloadUrl)(response.url);
-    }
     if (!response.ok) {
       throw new import_provider_utils3.DownloadError({
         url: urlText,
@@ -7047,8 +7045,8 @@ var DefaultStreamTextResult = class {
     let recordedNoOutputError;
     const pendingDeferredToolCalls = /* @__PURE__ */ new Map();
     let rootSpan;
-    let activeTextContent = {};
-    let activeReasoningContent = {};
+    let activeTextContent = createIdMap();
+    let activeReasoningContent = createIdMap();
     const eventProcessor = new TransformStream({
       async transform(chunk, controller) {
         var _a22, _b, _c, _d;
@@ -7164,8 +7162,8 @@ var DefaultStreamTextResult = class {
         }
         if (part.type === "start-step") {
           recordedContent = [];
-          activeReasoningContent = {};
-          activeTextContent = {};
+          activeReasoningContent = createIdMap();
+          activeTextContent = createIdMap();
           recordedRequest = part.request;
           recordedWarnings = part.warnings;
         }
@@ -8272,7 +8270,8 @@ var DefaultStreamTextResult = class {
     sendSources = false,
     sendStart = true,
     sendFinish = true,
-    onError = import_provider29.getErrorMessage
+    onError = () => "An error occurred."
+    // prevent leaking server error details to the client by default
   } = {}) {
     const responseMessageId = generateMessageId != null ? getResponseUIMessageId({
       originalMessages,
@@ -8710,7 +8709,8 @@ var ToolLoopAgent = class {
 var import_provider_utils22 = require("@ai-sdk/provider-utils");
 function createUIMessageStream({
   execute,
-  onError = import_provider_utils22.getErrorMessage,
+  onError = () => "An error occurred.",
+  // prevent leaking server error details to the client by default
   originalMessages,
   onStepFinish,
   onFinish,
@@ -12074,7 +12074,7 @@ function extractJsonMiddleware(options) {
     },
     wrapStream: async ({ doStream }) => {
       const { stream, ...rest } = await doStream();
-      const textBlocks = {};
+      const textBlocks = createIdMap();
       const SUFFIX_BUFFER_SIZE = 12;
       return {
         stream: stream.pipeThrough(
@@ -12237,7 +12237,7 @@ function extractReasoningMiddleware({
     },
     wrapStream: async ({ doStream }) => {
       const { stream, ...rest } = await doStream();
-      const reasoningExtractions = {};
+      const reasoningExtractions = createIdMap();
       let delayedTextStart;
       return {
         stream: stream.pipeThrough(