browserclaw 0.2.5 → 0.2.7

package/dist/index.js

@@ -399,7 +399,8 @@ async function launchChrome(opts = {}) {
       args.push("--no-sandbox", "--disable-setuid-sandbox");
     }
     if (process.platform === "linux") args.push("--disable-dev-shm-usage");
-    if (opts.chromeArgs?.length) args.push(...opts.chromeArgs);
+    const extraArgs = Array.isArray(opts.chromeArgs) ? opts.chromeArgs.filter((a) => typeof a === "string" && a.trim().length > 0) : [];
+    if (extraArgs.length) args.push(...extraArgs);
     args.push("about:blank");
     return spawn(exe.path, args, {
       stdio: "pipe",
@@ -1396,7 +1397,76 @@ function assertSafeOutputPath(path2, allowedRoots) {
     }
   }
 }
+function expandIPv6(ip) {
+  let normalized = ip;
+  const v4Match = normalized.match(/^(.+:)(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (v4Match) {
+    const octets = v4Match[2].split(".").map(Number);
+    if (octets.some((o) => o > 255)) return null;
+    const hexHi = (octets[0] << 8 | octets[1]).toString(16).padStart(4, "0");
+    const hexLo = (octets[2] << 8 | octets[3]).toString(16).padStart(4, "0");
+    normalized = v4Match[1] + hexHi + ":" + hexLo;
+  }
+  const halves = normalized.split("::");
+  if (halves.length > 2) return null;
+  if (halves.length === 2) {
+    const left = halves[0] !== "" ? halves[0].split(":") : [];
+    const right = halves[1] !== "" ? halves[1].split(":") : [];
+    const needed = 8 - left.length - right.length;
+    if (needed < 0) return null;
+    const groups2 = [...left, ...Array(needed).fill("0"), ...right];
+    if (groups2.length !== 8) return null;
+    return groups2.map((g) => g.padStart(4, "0")).join(":");
+  }
+  const groups = normalized.split(":");
+  if (groups.length !== 8) return null;
+  return groups.map((g) => g.padStart(4, "0")).join(":");
+}
+function hexToIPv4(hiHex, loHex) {
+  const hi = parseInt(hiHex, 16);
+  const lo = parseInt(loHex, 16);
+  return `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
+}
+function extractEmbeddedIPv4(lower) {
+  if (lower.startsWith("::ffff:")) {
+    return lower.slice(7);
+  }
+  const expanded = expandIPv6(lower);
+  if (expanded === null) return "";
+  const groups = expanded.split(":");
+  if (groups.length !== 8) return "";
+  if (groups[0] === "0064" && groups[1] === "ff9b" && groups[2] === "0000" && groups[3] === "0000" && groups[4] === "0000" && groups[5] === "0000") {
+    return hexToIPv4(groups[6], groups[7]);
+  }
+  if (groups[0] === "0064" && groups[1] === "ff9b" && groups[2] === "0001") {
+    return hexToIPv4(groups[6], groups[7]);
+  }
+  if (groups[0] === "2002") {
+    return hexToIPv4(groups[1], groups[2]);
+  }
+  if (groups[0] === "2001" && groups[1] === "0000") {
+    const hiXored = (parseInt(groups[6], 16) ^ 65535).toString(16).padStart(4, "0");
+    const loXored = (parseInt(groups[7], 16) ^ 65535).toString(16).padStart(4, "0");
+    return hexToIPv4(hiXored, loXored);
+  }
+  return null;
+}
+function isStrictDecimalOctet(part) {
+  if (!/^[0-9]+$/.test(part)) return false;
+  const n = parseInt(part, 10);
+  if (n < 0 || n > 255) return false;
+  if (String(n) !== part) return false;
+  return true;
+}
+function isUnsupportedIPv4Literal(ip) {
+  if (/^[0-9]+$/.test(ip)) return true;
+  const parts = ip.split(".");
+  if (parts.length !== 4) return true;
+  if (!parts.every(isStrictDecimalOctet)) return true;
+  return false;
+}
 function isInternalIP(ip) {
+  if (!ip.includes(":") && isUnsupportedIPv4Literal(ip)) return true;
   if (/^127\./.test(ip)) return true;
   if (/^10\./.test(ip)) return true;
   if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) return true;
@@ -1408,9 +1478,10 @@ function isInternalIP(ip) {
   if (lower === "::1") return true;
   if (lower.startsWith("fe80:")) return true;
   if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  if (lower.startsWith("::ffff:")) {
-    const v4 = lower.replace(/^::ffff:/, "");
-    return isInternalIP(v4);
+  const embedded = extractEmbeddedIPv4(lower);
+  if (embedded !== null) {
+    if (embedded === "") return true;
+    return isInternalIP(embedded);
   }
   return false;
 }