deadbyte-mcp 0.15.18 → 0.15.19

package/src/commander-url-reader-r48.mjs

@@ -0,0 +1,201 @@
+import { createHash } from 'node:crypto';
+import { lookup as dnsLookup } from 'node:dns/promises';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+
+const REDIRECTS=new Set([301,302,303,307,308]);
+const DEFAULT_MAX_BYTES=8*1024*1024;
+const DEFAULT_TIMEOUT_MS=15000;
+const DEFAULT_MAX_REDIRECTS=5;
+
+function sha256(bytes){return createHash('sha256').update(bytes).digest('hex');}
+function ipv4Number(address){
+  const parts=address.split('.').map(Number);
+  if(parts.length!==4||parts.some(x=>!Number.isInteger(x)||x<0||x>255)) return null;
+  return (((parts[0]*256+parts[1])*256+parts[2])*256+parts[3])>>>0;
+}
+function inV4(value,cidrBase,prefix){
+  const base=ipv4Number(cidrBase); if(base===null) return false;
+  if(prefix===0) return true;
+  const mask=(0xffffffff << (32-prefix))>>>0;
+  return (value&mask)===(base&mask);
+}
+function ipv6BigInt(address){
+  let value=address.toLowerCase();
+  const zone=value.indexOf('%'); if(zone>=0) value=value.slice(0,zone);
+  if(value.includes('.')){
+    const lastColon=value.lastIndexOf(':');
+    const v4=ipv4Number(value.slice(lastColon+1));
+    if(v4===null) return null;
+    value=value.slice(0,lastColon)+':'+((v4>>>16)&0xffff).toString(16)+':'+(v4&0xffff).toString(16);
+  }
+  const halves=value.split('::');
+  if(halves.length>2) return null;
+  const left=halves[0]?halves[0].split(':'):[];
+  const right=halves.length===2&&halves[1]?halves[1].split(':'):[];
+  if(left.some(x=>!/^[0-9a-f]{1,4}$/.test(x))||right.some(x=>!/^[0-9a-f]{1,4}$/.test(x))) return null;
+  const missing=8-left.length-right.length;
+  if((halves.length===1&&missing!==0)||(halves.length===2&&missing<1)) return null;
+  const groups=[...left,...Array(Math.max(0,missing)).fill('0'),...right];
+  if(groups.length!==8) return null;
+  let out=0n;
+  for(const group of groups) out=(out<<16n)|BigInt(parseInt(group,16));
+  return out;
+}
+function v6In(value,base,prefix){
+  const b=ipv6BigInt(base); if(b===null) return false;
+  if(prefix===0) return true;
+  const shift=128n-BigInt(prefix);
+  return (value>>shift)===(b>>shift);
+}
+
+export function isPublicInternetAddress(address){
+  const family=net.isIP(address);
+  if(family===4){
+    const v=ipv4Number(address); if(v===null) return false;
+    const denied=[
+      ['0.0.0.0',8],['10.0.0.0',8],['100.64.0.0',10],['127.0.0.0',8],
+      ['169.254.0.0',16],['172.16.0.0',12],['192.0.0.0',24],['192.0.2.0',24],
+      ['192.88.99.0',24],['192.168.0.0',16],['198.18.0.0',15],['198.51.100.0',24],
+      ['203.0.113.0',24],['224.0.0.0',4],['240.0.0.0',4]
+    ];
+    return !denied.some(([base,prefix])=>inV4(v,base,prefix));
+  }
+  if(family===6){
+    const v=ipv6BigInt(address); if(v===null) return false;
+    if(v===0n||v===1n) return false;
+    if(v6In(v,'::ffff:0:0',96)){
+      const lower=Number(v&0xffffffffn)>>>0;
+      const mapped=[lower>>>24,(lower>>>16)&255,(lower>>>8)&255,lower&255].join('.');
+      return isPublicInternetAddress(mapped);
+    }
+    const denied=[
+      ['fc00::',7],['fe80::',10],['ff00::',8],['2001:db8::',32],['2001:10::',28]
+    ];
+    return !denied.some(([base,prefix])=>v6In(v,base,prefix));
+  }
+  return false;
+}
+
+async function defaultLookup(hostname){
+  if(net.isIP(hostname)) return [{address:hostname,family:net.isIP(hostname)}];
+  return dnsLookup(hostname,{all:true,verbatim:true});
+}
+function normalizeHeaders(headers){
+  const out={};
+  for(const [key,value] of Object.entries(headers??{})){
+    if(Array.isArray(value)) out[key.toLowerCase()]=value.join(', ');
+    else if(value!==undefined) out[key.toLowerCase()]=String(value);
+  }
+  return out;
+}
+function defaultRequestOnce({url,address,maxBytes,timeoutMs}){
+  return new Promise((resolve,reject)=>{
+    const client=url.protocol==='https:'?https:http;
+    let settled=false,total=0;
+    const chunks=[];
+    const finish=(fn,value)=>{if(settled)return;settled=true;clearTimeout(timer);fn(value);};
+    const pinnedLookup=(hostname,options,callback)=>{
+      const cb=typeof options==='function'?options:callback;
+      cb(null,address.address,address.family);
+    };
+    const req=client.request({
+      protocol:url.protocol,hostname:url.hostname,port:url.port||undefined,
+      method:'GET',path:url.pathname+url.search,
+      headers:{'Accept-Encoding':'identity','User-Agent':'DEADBYTE-MCP-Commander-Compat-R48'},
+      lookup:pinnedLookup
+    },res=>{
+      res.on('data',chunk=>{
+        if(settled)return;
+        total+=chunk.length;
+        if(total>maxBytes){
+          req.destroy();
+          finish(reject,new Error(`URL response exceeds ${maxBytes} byte limit`));
+          return;
+        }
+        chunks.push(Buffer.from(chunk));
+      });
+      res.once('end',()=>finish(resolve,{status:res.statusCode??0,headers:normalizeHeaders(res.headers),body:Buffer.concat(chunks)}));
+      res.once('error',error=>finish(reject,error));
+    });
+    req.once('error',error=>finish(reject,error));
+    const timer=setTimeout(()=>{req.destroy();finish(reject,new Error(`URL fetch timed out after ${timeoutMs}ms`));},timeoutMs);
+    timer.unref?.();
+    req.end();
+  });
+}
+
+function validateUrl(input){
+  let url;
+  try{url=new URL(input);}catch{throw new Error('URL is invalid');}
+  if(url.protocol!=='http:'&&url.protocol!=='https:') throw new Error('URL protocol must be http or https');
+  if(url.username||url.password) throw new Error('URL credentials are not allowed');
+  if(url.hostname.length<1||url.hostname.length>253) throw new Error('URL hostname invalid');
+  return url;
+}
+async function resolvePublic(hostname,lookupFn){
+  const rows=await lookupFn(hostname);
+  if(!Array.isArray(rows)||rows.length<1) throw new Error('URL hostname resolved to no addresses');
+  const normalized=rows.map(row=>({address:String(row.address??''),family:Number(row.family??net.isIP(String(row.address??'')))}));
+  if(normalized.some(row=>!isPublicInternetAddress(row.address))) throw new Error('URL hostname resolved to a non-public address');
+  return normalized[0];
+}
+function contentKind(contentType,url){
+  const mime=String(contentType??'text/plain').split(';',1)[0].trim().toLowerCase()||'text/plain';
+  if(mime==='application/pdf'||url.pathname.toLowerCase().endsWith('.pdf')) return {mime,kind:'pdf'};
+  if(mime.startsWith('image/')) return {mime,kind:'image'};
+  if(mime.startsWith('text/')||['application/json','application/xml','application/javascript','application/x-javascript','application/xhtml+xml'].includes(mime)) return {mime,kind:'text'};
+  return {mime,kind:'binary'};
+}
+
+export function createCommanderUrlReader({
+  maxBytes=DEFAULT_MAX_BYTES,
+  timeoutMs=DEFAULT_TIMEOUT_MS,
+  maxRedirects=DEFAULT_MAX_REDIRECTS,
+  lookupFn=defaultLookup,
+  requestOnceFn=defaultRequestOnce
+}={}){
+  if(!Number.isInteger(maxBytes)||maxBytes<1||maxBytes>64*1024*1024) throw new Error('URL maxBytes out of range');
+  if(!Number.isInteger(timeoutMs)||timeoutMs<100||timeoutMs>120000) throw new Error('URL timeoutMs out of range');
+  if(!Number.isInteger(maxRedirects)||maxRedirects<0||maxRedirects>10) throw new Error('URL maxRedirects out of range');
+
+  return async function readCommanderUrl(input){
+    let url=validateUrl(input);
+    const visited=new Set();
+    for(let hop=0;hop<=maxRedirects;hop++){
+      if(visited.has(url.href)) throw new Error('URL redirect loop detected');
+      visited.add(url.href);
+      const address=await resolvePublic(url.hostname,lookupFn);
+      const response=await requestOnceFn({url,address,maxBytes,timeoutMs});
+      const status=Number(response?.status);
+      const headers=normalizeHeaders(response?.headers);
+      const body=Buffer.isBuffer(response?.body)?response.body:Buffer.from(response?.body??[]);
+      if(body.length>maxBytes) throw new Error(`URL response exceeds ${maxBytes} byte limit`);
+      if(REDIRECTS.has(status)){
+        const location=headers.location;
+        if(!location) throw new Error(`URL redirect ${status} missing Location header`);
+        if(hop===maxRedirects) throw new Error('URL redirect limit exceeded');
+        url=validateUrl(new URL(location,url).href);
+        continue;
+      }
+      if(status<200||status>=300) throw new Error(`URL HTTP status ${status}`);
+      const kind=contentKind(headers['content-type'],url);
+      if(kind.kind==='binary') throw new Error(`URL content type '${kind.mime}' is not a supported text, image, or PDF format`);
+      const digest=sha256(body);
+      if(kind.kind==='pdf'){
+        return {content:body.toString('base64'),mimeType:'application/pdf',isImage:false,isPdf:true,bytes:body.length,sha256:digest,url:url.href};
+      }
+      if(kind.kind==='image'){
+        return {content:body.toString('base64'),mimeType:kind.mime,isImage:true,isPdf:false,bytes:body.length,sha256:digest,url:url.href};
+      }
+      const decoder=new TextDecoder('utf-8',{fatal:true});
+      let content;
+      try{content=decoder.decode(body);}catch{throw new Error('URL text response is not valid UTF-8');}
+      return {content,mimeType:kind.mime,isImage:false,isPdf:false,bytes:body.length,sha256:digest,url:url.href};
+    }
+    throw new Error('URL redirect limit exceeded');
+  };
+}
+
+export const readCommanderUrl=createCommanderUrlReader();