beachviber 1.0.34 → 1.0.35

package/dist/image-download.js

@@ -2,7 +2,7 @@ import { mkdirSync, existsSync, readdirSync, statSync, unlinkSync, writeFileSync
 import { join } from "path";
 import { tmpdir } from "os";
 import { randomUUID } from "crypto";
-import { resolve as dnsResolve } from "dns/promises";
+import { lookup as dnsLookup } from "dns/promises";
 const IMAGE_DIR = join(tmpdir(), "beachviber-images");
 const ALLOWED_EXTENSIONS = new Set(["png", "jpg", "jpeg", "gif", "webp", "svg", "bmp", "heic"]);
 const ALLOWED_CONTENT_TYPES = new Set([
@@ -59,17 +59,16 @@ export async function downloadImage(url) {
         throw new Error(`Image download blocked: only HTTPS URLs are allowed (got ${parsed.protocol})`);
     }
     // Resolve hostname and block private/reserved IPs to prevent SSRF.
-    // Pin the resolved IP to prevent DNS rebinding between validation and fetch.
+    // Uses dns.lookup (OS resolver) instead of dns.resolve (raw DNS queries)
+    // for reliable resolution across all platforms.
     const hostname = parsed.hostname;
-    let resolvedIP;
     try {
-        const addresses = await dnsResolve(hostname);
-        for (const addr of addresses) {
-            if (isPrivateIP(addr)) {
-                throw new Error(`Image download blocked: hostname "${hostname}" resolves to private IP ${addr}`);
+        const results = await dnsLookup(hostname, { all: true });
+        for (const { address } of results) {
+            if (isPrivateIP(address)) {
+                throw new Error(`Image download blocked: hostname "${hostname}" resolves to private IP ${address}`);
             }
         }
-        resolvedIP = addresses[0];
     }
     catch (err) {
         if (err instanceof Error && err.message.startsWith("Image download blocked"))
@@ -80,13 +79,11 @@ export async function downloadImage(url) {
     const ext = extFromUrl(url);
     const filename = `${randomUUID()}.${ext}`;
     const filepath = join(IMAGE_DIR, filename);
-    // Fetch using the pinned IP to prevent DNS rebinding.
-    // Replace hostname with the resolved IP and set Host header for TLS/virtual hosting.
-    const pinnedUrl = new URL(url);
-    pinnedUrl.hostname = resolvedIP;
-    const response = await fetch(pinnedUrl.toString(), {
+    // Fetch using the original URL — IP pinning is not used because replacing
+    // the hostname with a raw IP breaks TLS certificate validation for S3 and
+    // other virtual-hosted services.
+    const response = await fetch(url, {
         signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        headers: { Host: hostname },
     });
     if (!response.ok) {
         throw new Error(`Failed to download image: ${response.status} ${response.statusText}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beachviber",
-  "version": "1.0.34",
+  "version": "1.0.35",
   "description": "BeachViber Agent — control Claude Code remotely from your phone",
   "type": "module",
   "license": "MIT",