discord-message-transcript 1.3.1-dev.3.35 → 1.3.2-dev.0.49

package/dist/core/{urlResolver.js → assetResolver/url/messageUrlResolver.js}

@@ -1,48 +1,29 @@
 import { JsonComponentType } from "discord-message-transcript-base";
-import { cdnResolver } from "./cdnResolver.js";
-import { imageToBase64 } from "./imageToBase64.js";
-import { isJsonComponentInContainer } from "./componentToJson.js";
-import { FALLBACK_PIXEL, isSafeForHTML, resolveImageURL } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
-export async function urlResolver(url, options, cdnOptions, urlCache) {
-    if (url == FALLBACK_PIXEL || url == "")
-        return url;
-    if (urlCache.has(url)) {
-        const cache = urlCache.get(url);
-        if (cache)
-            return await cache;
-    }
-    let returnUrl;
-    if (cdnOptions)
-        returnUrl = cdnResolver(url, options, cdnOptions);
-    else if (options.saveImages)
-        returnUrl = imageToBase64(url, options.disableWarnings);
-    if (returnUrl) {
-        urlCache.set(url, returnUrl);
-        return await returnUrl;
-    }
-    return url;
-}
+import { imageUrlResolver } from "./imageUrlResolver.js";
+import { isSafeForHTML } from "@/networkSecurity";
+import { urlResolver } from "./urlResolver.js";
+import { isJsonComponentInContainer } from "@/core/discordParser/componentToJson.js";
 export async function messagesUrlResolver(messages, options, cdnOptions, urlCache) {
     return await Promise.all(messages.map(async (message) => {
         // Needs to wait for resolve correct when used attachment://
         const attachments = await Promise.all(message.attachments.map(async (attachment) => {
-            let url;
+            let safeUrlObject;
             if (attachment.contentType?.startsWith("image/")) {
-                url = await resolveImageURL(attachment.url, options, false, message.attachments);
+                safeUrlObject = await imageUrlResolver(attachment.url, options, false, message.attachments);
             }
             else {
-                url = await isSafeForHTML(attachment.url, options) ? attachment.url : "";
+                safeUrlObject = await isSafeForHTML(attachment.url, options);
             }
             return {
                 ...attachment,
-                url: await urlResolver(url, options, cdnOptions, urlCache)
+                url: await urlResolver(safeUrlObject, options, cdnOptions, urlCache)
             };
         }));
         const embedsPromise = Promise.all(message.embeds.map(async (embed) => {
-            const authorIconUrl = embed.author?.iconURL ? await resolveImageURL(embed.author.iconURL, options, true, attachments) : null;
-            const footerIconUrl = embed.footer?.iconURL ? await resolveImageURL(embed.footer.iconURL, options, true, attachments) : null;
-            const imageUrl = embed.image?.url ? await resolveImageURL(embed.image.url, options, true, attachments) : null;
-            const thumbnailUrl = embed.thumbnail?.url ? await resolveImageURL(embed.thumbnail.url, options, true, attachments) : null;
+            const authorIconUrl = embed.author?.iconURL ? await imageUrlResolver(embed.author.iconURL, options, true, attachments) : null;
+            const footerIconUrl = embed.footer?.iconURL ? await imageUrlResolver(embed.footer.iconURL, options, true, attachments) : null;
+            const imageUrl = embed.image?.url ? await imageUrlResolver(embed.image.url, options, true, attachments) : null;
+            const thumbnailUrl = embed.thumbnail?.url ? await imageUrlResolver(embed.thumbnail.url, options, true, attachments) : null;
             return {
                 ...embed,
                 author: embed.author ? { ...embed.author, iconURL: authorIconUrl ? await urlResolver(authorIconUrl, options, cdnOptions, urlCache) : null } : null,
@@ -53,14 +34,14 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
         }));
         async function componentsFunction(components) {
             return Promise.all(components.map(async (component) => {
-                if (component.type == JsonComponentType.Section) {
+                if (component.type == JsonComponentType.Section && component.accessory) {
                     if (component.accessory.type == JsonComponentType.Thumbnail) {
                         return {
                             ...component,
                             accessory: {
                                 ...component.accessory,
                                 media: {
-                                    url: await urlResolver((await resolveImageURL(component.accessory.media.url, options, false, attachments)), options, cdnOptions, urlCache),
+                                    url: await urlResolver((await imageUrlResolver(component.accessory.media.url, options, false, attachments)), options, cdnOptions, urlCache),
                                 }
                             }
                         };
@@ -72,15 +53,16 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
                         items: await Promise.all(component.items.map(async (item) => {
                             return {
                                 ...item,
-                                media: { url: await urlResolver((await resolveImageURL(item.media.url, options, false, attachments)), options, cdnOptions, urlCache) },
+                                media: { url: await urlResolver((await imageUrlResolver(item.media.url, options, false, attachments)), options, cdnOptions, urlCache) },
                             };
                         }))
                     };
                 }
                 if (component.type == JsonComponentType.File) {
+                    const safeUrlObject = await isSafeForHTML(component.url, options);
                     return {
                         ...component,
-                        url: await urlResolver((await isSafeForHTML(component.url, options) ? component.url : ""), options, cdnOptions, urlCache),
+                        url: await urlResolver(safeUrlObject, options, cdnOptions, urlCache),
                     };
                 }
                 if (component.type == JsonComponentType.Container) {
@@ -105,11 +87,3 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
         };
     }));
 }
-export async function authorUrlResolver(authors, options, cdnOptions, urlCache) {
-    return await Promise.all(Array.from(authors.values()).map(async (author) => {
-        return {
-            ...author,
-            avatarURL: await urlResolver((await resolveImageURL(author.avatarURL, options, false)), options, cdnOptions, urlCache),
-        };
-    }));
-}

package/dist/core/assetResolver/url/urlResolver.d.ts

@@ -0,0 +1,3 @@
+import { CDNOptions, safeUrlReturn } from "@/types/types.js";
+import { TranscriptOptionsBase } from "discord-message-transcript-base";
+export declare function urlResolver(safeUrlObject: safeUrlReturn, options: TranscriptOptionsBase, cdnOptions: CDNOptions | null, urlCache: Map<string, Promise<string>>): Promise<string>;

package/dist/core/assetResolver/url/urlResolver.js

@@ -0,0 +1,24 @@
+import { FALLBACK_PIXEL } from "discord-message-transcript-base";
+import { cdnResolver } from "../cdn/cdnResolver.js";
+import { imageToBase64 } from "../base64/imageToBase64.js";
+export async function urlResolver(safeUrlObject, options, cdnOptions, urlCache) {
+    if (safeUrlObject.safe == false)
+        return "";
+    if (safeUrlObject.url == FALLBACK_PIXEL)
+        return safeUrlObject.url;
+    if (urlCache.has(safeUrlObject.url)) {
+        const cache = urlCache.get(safeUrlObject.url);
+        if (cache)
+            return await cache;
+    }
+    let returnUrl;
+    if (cdnOptions)
+        returnUrl = cdnResolver(safeUrlObject, options, cdnOptions);
+    else if (options.saveImages)
+        returnUrl = imageToBase64(safeUrlObject, options.disableWarnings);
+    if (returnUrl) {
+        urlCache.set(safeUrlObject.url, returnUrl);
+        return await returnUrl;
+    }
+    return safeUrlObject.url;
+}

package/dist/core/{componentToJson.d.ts → discordParser/componentToJson.d.ts}

@@ -1,4 +1,4 @@
 import { TopLevelComponent } from "discord.js";
-import { JsonTopLevelComponent, JsonComponentInContainer, TranscriptOptionsBase } from "discord-message-transcript-base";
+import { JsonTopLevelComponent, TranscriptOptionsBase, JsonComponentInContainer } from "discord-message-transcript-base";
 export declare function componentsToJson(components: TopLevelComponent[], options: TranscriptOptionsBase): Promise<JsonTopLevelComponent[]>;
 export declare function isJsonComponentInContainer(component: JsonTopLevelComponent): component is JsonComponentInContainer;

package/dist/core/discordParser/componentToJson.js

@@ -0,0 +1,159 @@
+import { ComponentType } from "discord.js";
+import { mapButtonStyle, mapSelectorType, mapSeparatorSpacing } from "../mappers.js";
+import { JsonComponentType } from "discord-message-transcript-base";
+import { isValidHexColor } from "discord-message-transcript-base";
+export async function componentsToJson(components, options) {
+    const filtered = components.filter(c => options.includeV2Components || c.type === ComponentType.ActionRow);
+    const processed = await Promise.all(filtered.map(c => convertComponent(c, options)));
+    return processed.filter(c => c != null);
+}
+async function convertComponent(component, options) {
+    switch (component.type) {
+        case ComponentType.ActionRow:
+            return convertActionRow(component, options);
+        case ComponentType.Container:
+            return convertContainer(component, options);
+        case ComponentType.File:
+            return convertFile(component);
+        case ComponentType.MediaGallery:
+            return convertMediaGallery(component);
+        case ComponentType.Section:
+            return convertSection(component);
+        case ComponentType.Separator:
+            return convertSeparator(component);
+        case ComponentType.TextDisplay:
+            return convertTextDisplay(component);
+        default:
+            return null;
+    }
+}
+async function convertActionRow(component, options) {
+    const rowComponents = await Promise.all(component.components
+        .filter(c => (c.type === ComponentType.Button ? options.includeButtons : options.includeComponents))
+        .map(c => convertActionRowChild(c)));
+    if (rowComponents.length === 0)
+        return null;
+    return { type: JsonComponentType.ActionRow, components: rowComponents };
+}
+async function convertActionRowChild(component) {
+    switch (component.type) {
+        case ComponentType.Button: {
+            return {
+                type: JsonComponentType.Button,
+                style: mapButtonStyle(component.style),
+                label: component.label,
+                emoji: component.emoji?.name ?? null,
+                url: component.url,
+                disabled: component.disabled,
+            };
+        }
+        case ComponentType.StringSelect: {
+            return {
+                type: JsonComponentType.StringSelect,
+                placeholder: component.placeholder,
+                disabled: component.disabled,
+                options: component.options.map(option => ({
+                    label: option.label,
+                    description: option.description ?? null,
+                    emoji: option.emoji ? { id: option.emoji.id ?? null, name: option.emoji.name ?? null, animated: option.emoji.animated ?? false } : null,
+                })),
+            };
+        }
+        default: {
+            return {
+                type: mapSelectorType(component.type),
+                placeholder: component.placeholder,
+                disabled: component.disabled,
+            };
+        }
+    }
+}
+async function convertContainer(component, options) {
+    const newOptions = { ...options, includeComponents: true, includeButtons: true };
+    const componentsJson = await componentsToJson(component.components, newOptions);
+    return {
+        type: JsonComponentType.Container,
+        components: componentsJson.filter(isJsonComponentInContainer), // Input components that are container-safe must always produce container-safe output.
+        hexAccentColor: isValidHexColor(component.hexAccentColor, false),
+        spoiler: component.spoiler,
+    };
+}
+function convertFile(component) {
+    return {
+        type: JsonComponentType.File,
+        fileName: component.data.name ?? null,
+        size: component.data.size ?? 0,
+        url: component.file.url,
+        spoiler: component.spoiler,
+    };
+}
+async function convertMediaGallery(component) {
+    const mediaItems = await Promise.all(component.items.map(item => {
+        return {
+            media: { url: item.media.url },
+            spoiler: item.spoiler,
+        };
+    }));
+    return {
+        type: JsonComponentType.MediaGallery,
+        items: mediaItems,
+    };
+}
+function convertSection(component) {
+    let accessoryJson = null;
+    switch (component.accessory.type) {
+        case ComponentType.Button: {
+            accessoryJson = {
+                type: JsonComponentType.Button,
+                style: mapButtonStyle(component.accessory.style),
+                label: component.accessory.label,
+                emoji: component.accessory.emoji?.name ? component.accessory.emoji.name : null,
+                url: component.accessory.url,
+                disabled: component.accessory.disabled,
+            };
+            break;
+        }
+        case ComponentType.Thumbnail: {
+            accessoryJson = {
+                type: JsonComponentType.Thumbnail,
+                media: {
+                    url: component.accessory.media.url,
+                },
+                spoiler: component.accessory.spoiler,
+            };
+            break;
+        }
+        default:
+            break;
+    }
+    const sectionComponents = component.components.map(c => ({
+        type: JsonComponentType.TextDisplay,
+        content: c.content,
+    }));
+    return {
+        type: JsonComponentType.Section,
+        accessory: accessoryJson,
+        components: sectionComponents,
+    };
+}
+function convertSeparator(component) {
+    return {
+        type: JsonComponentType.Separator,
+        spacing: mapSeparatorSpacing(component.spacing),
+        divider: component.divider,
+    };
+}
+function convertTextDisplay(component) {
+    return {
+        type: JsonComponentType.TextDisplay,
+        content: component.content,
+    };
+}
+export function isJsonComponentInContainer(component) {
+    return (component.type == JsonComponentType.ActionRow ||
+        component.type == JsonComponentType.File ||
+        component.type == JsonComponentType.MediaGallery ||
+        component.type == JsonComponentType.Section ||
+        component.type == JsonComponentType.Separator ||
+        component.type == JsonComponentType.TextDisplay);
+}

package/dist/core/discordParser/fetchMessages.d.ts

@@ -0,0 +1,7 @@
+import { JsonMessage } from "discord-message-transcript-base";
+import { FetchMessagesContext } from "@/types";
+export declare function fetchMessages(ctx: FetchMessagesContext): Promise<{
+    messages: JsonMessage[];
+    end: boolean;
+    newLastMessageId: string | undefined;
+}>;

package/dist/core/{fetchMessages.js → discordParser/fetchMessages.js}

@@ -1,7 +1,7 @@
 import { EmbedType } from "discord.js";
 import { componentsToJson } from "./componentToJson.js";
+import { isValidHexColor, sanitize } from "discord-message-transcript-base";
 import { getMentions } from "./getMentions.js";
-import { isValidHexColor, sanitize } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
 export async function fetchMessages(ctx) {
     const { channel, options, transcriptState, lastMessageId } = ctx;
     const { authors, mentions } = transcriptState;

package/dist/core/{getMentions.d.ts → discordParser/getMentions.d.ts}

@@ -1,3 +1,3 @@
 import { Message } from "discord.js";
-import { MapMentions } from "../types/types.js";
+import { MapMentions } from "@/types";
 export declare function getMentions(message: Message, mentions: MapMentions): Promise<void>;

package/dist/core/{getMentions.js → discordParser/getMentions.js}

@@ -1,5 +1,5 @@
 import { ChannelType } from "discord.js";
-import { isValidHexColor, sanitize } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
+import { isValidHexColor, sanitize } from "discord-message-transcript-base";
 export async function getMentions(message, mentions) {
     message.mentions.channels.forEach(channel => {
         if (!mentions.channels.has(channel.id)) {

package/dist/core/discordParser/index.d.ts

@@ -0,0 +1,4 @@
+import { CDNOptions, ReturnDiscordParser } from "@/types/types.js";
+import { TranscriptOptionsBase } from "discord-message-transcript-base";
+import { TextBasedChannel } from "discord.js";
+export declare function discordParser(channel: TextBasedChannel, options: TranscriptOptionsBase, cdnOptions: CDNOptions | null): Promise<ReturnDiscordParser>;

package/dist/core/discordParser/index.js

@@ -0,0 +1,33 @@
+import { fetchMessages } from "./fetchMessages.js";
+import { Json } from "@/renderers/json/json.js";
+export async function discordParser(channel, options, cdnOptions) {
+    const urlCache = new Map();
+    const authors = new Map();
+    const mentions = {
+        channels: new Map(),
+        roles: new Map(),
+        users: new Map(),
+    };
+    const fetchMessageParameter = {
+        channel: channel,
+        options: options,
+        transcriptState: {
+            authors: authors,
+            mentions: mentions,
+        },
+        lastMessageId: undefined
+    };
+    const jsonTranscript = channel.isDMBased() ? new Json(null, channel, options, cdnOptions, urlCache) : new Json(channel.guild, channel, options, cdnOptions, urlCache);
+    while (true) {
+        const { messages, end, newLastMessageId } = await fetchMessages(fetchMessageParameter);
+        jsonTranscript.addMessages(messages);
+        fetchMessageParameter.lastMessageId = newLastMessageId;
+        if (end || (jsonTranscript.getMessages().length >= options.quantity && options.quantity != 0)) {
+            break;
+        }
+    }
+    if (options.quantity > 0 && jsonTranscript.getMessages().length > options.quantity) {
+        jsonTranscript.sliceMessages(options.quantity);
+    }
+    return [jsonTranscript, { ...fetchMessageParameter.transcriptState, urlCache }];
+}

package/dist/core/mappers.d.ts

@@ -1,6 +1,6 @@
 import { ButtonStyle, ComponentType, SeparatorSpacingSize } from "discord.js";
 import { JsonButtonStyle, JsonComponentType, JsonSeparatorSpacingSize, ReturnTypeBase } from "discord-message-transcript-base";
-import { ReturnType } from "../types/types.js";
+import { ReturnType } from "@/types";
 export declare function mapButtonStyle(style: ButtonStyle): JsonButtonStyle;
 export declare function mapSeparatorSpacing(spacing: SeparatorSpacingSize): JsonSeparatorSpacingSize;
 export declare function mapComponentType(componentType: ComponentType): JsonComponentType;

package/dist/core/mappers.js

@@ -1,6 +1,6 @@
 import { ButtonStyle, ComponentType, SeparatorSpacingSize } from "discord.js";
 import { CustomError, JsonButtonStyle, JsonComponentType, JsonSeparatorSpacingSize, ReturnTypeBase } from "discord-message-transcript-base";
-import { ReturnType } from "../types/types.js";
+import { ReturnType } from "@/types";
 export function mapButtonStyle(style) {
     switch (style) {
         case ButtonStyle.Primary:

package/dist/core/networkSecurity/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const DNS_SERVERS: string[];
+export declare const DNS_LOOKUP_TIMEOUT = 5000;
+export declare const TRUSTED_DISCORD_HOSTS: string[];

package/dist/core/networkSecurity/constants.js

@@ -0,0 +1,3 @@
+export const DNS_SERVERS = ["1.1.1.1", "8.8.8.8"];
+export const DNS_LOOKUP_TIMEOUT = 5000;
+export const TRUSTED_DISCORD_HOSTS = ["discordapp.com", "discordapp.net"];

package/dist/core/networkSecurity/dns.d.ts

@@ -0,0 +1,2 @@
+import { LookupResult } from "@/types";
+export declare function resolveAllIps(host: string): Promise<LookupResult[]>;

package/dist/core/networkSecurity/dns.js

@@ -0,0 +1,29 @@
+import { Resolver } from "dns/promises";
+import { DNS_LOOKUP_TIMEOUT, DNS_SERVERS } from "./constants.js";
+export async function resolveAllIps(host) {
+    const resolver = new Resolver();
+    resolver.setServers(DNS_SERVERS);
+    const lookupPromise = (async () => {
+        const results = [];
+        const [v4, v6] = await Promise.allSettled([
+            resolver.resolve4(host),
+            resolver.resolve6(host)
+        ]);
+        if (v4.status === "fulfilled") {
+            for (const ip of v4.value) {
+                results.push({ address: ip, family: 4 });
+            }
+        }
+        if (v6.status === "fulfilled") {
+            for (const ip of v6.value) {
+                results.push({ address: ip, family: 6 });
+            }
+        }
+        if (results.length === 0) {
+            throw new Error(`No DNS records found for ${host}`);
+        }
+        return results;
+    })();
+    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`DNS timeout for ${host}`)), DNS_LOOKUP_TIMEOUT));
+    return Promise.race([lookupPromise, timeoutPromise]);
+}

package/dist/core/networkSecurity/index.d.ts

@@ -0,0 +1,2 @@
+export * from './urlSafety.js';
+export * from './lookup.js';

package/dist/core/networkSecurity/index.js

@@ -0,0 +1,2 @@
+export * from './urlSafety.js';
+export * from './lookup.js';

package/dist/core/networkSecurity/ip.d.ts

@@ -0,0 +1 @@
+export declare function isPrivateIp(ip: string): boolean;

package/dist/core/networkSecurity/ip.js

@@ -0,0 +1,110 @@
+import net from "node:net";
+export function isPrivateIp(ip) {
+    const family = net.isIP(ip);
+    if (!family)
+        return true;
+    if (family === 4)
+        return isPrivateIPv4(ip);
+    return isPrivateIPv6(ip);
+}
+function isPrivateIPv4(ip) {
+    const parts = ip.split(".").map(Number);
+    if (parts.length !== 4 || parts.some(n => isNaN(n)))
+        return true;
+    const [a, b] = parts;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        a >= 224);
+}
+function parseIPv6(ip) {
+    if (net.isIP(ip) !== 6)
+        return null;
+    // handle IPv4 at end
+    if (ip.includes(".")) {
+        const lastColon = ip.lastIndexOf(":");
+        const ipv4Part = ip.slice(lastColon + 1);
+        const nums = ipv4Part.split(".").map(Number);
+        if (nums.length === 4 && nums.every(n => !isNaN(n))) {
+            const hex = ((nums[0] << 8) | nums[1]).toString(16) +
+                ":" +
+                ((nums[2] << 8) | nums[3]).toString(16);
+            ip = ip.slice(0, lastColon) + ":" + hex;
+        }
+    }
+    const sections = ip.split("::");
+    let head = sections[0] ? sections[0].split(":") : [];
+    let tail = sections[1] ? sections[1].split(":") : [];
+    if (sections.length === 2) {
+        const missing = 8 - (head.length + tail.length);
+        head = [...head, ...Array(missing).fill("0"), ...tail];
+    }
+    if (head.length !== 8)
+        return null;
+    const bytes = [];
+    for (const part of head) {
+        const n = parseInt(part || "0", 16);
+        if (isNaN(n))
+            return null;
+        bytes.push((n >> 8) & 0xff);
+        bytes.push(n & 0xff);
+    }
+    return bytes;
+}
+function extractEmbeddedIPv4(bytes) {
+    const isMapped = bytes.slice(0, 10).every(b => b === 0) &&
+        bytes[10] === 0xff &&
+        bytes[11] === 0xff;
+    if (isMapped) {
+        return `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`;
+    }
+    const isCompat = bytes.slice(0, 12).every(b => b === 0);
+    if (isCompat) {
+        return `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`;
+    }
+    const isNat64 = bytes[0] === 0x00 &&
+        bytes[1] === 0x64 &&
+        bytes[2] === 0xff &&
+        bytes[3] === 0x9b &&
+        bytes.slice(4, 12).every(b => b === 0);
+    if (isNat64) {
+        return `${bytes[12]}.${bytes[13]}.${bytes[14]}.${bytes[15]}`;
+    }
+    return null;
+}
+function isPrivateIPv6(ip) {
+    const bytes = parseIPv6(ip);
+    if (!bytes)
+        return true;
+    const embedded = extractEmbeddedIPv4(bytes);
+    if (embedded)
+        return isPrivateIPv4(embedded);
+    // ::
+    if (bytes.every(b => b === 0))
+        return true;
+    // ::1
+    if (bytes.slice(0, 15).every(b => b === 0) && bytes[15] === 1)
+        return true;
+    const first = bytes[0];
+    const second = bytes[1];
+    // fc00::/7
+    if ((first & 0xfe) === 0xfc)
+        return true;
+    // fe80::/10
+    if (first === 0xfe && (second & 0xc0) === 0x80)
+        return true;
+    // multicast
+    if (first === 0xff)
+        return true;
+    // 2001:db8::/32
+    if (bytes[0] === 0x20 &&
+        bytes[1] === 0x01 &&
+        bytes[2] === 0x0d &&
+        bytes[3] === 0xb8)
+        return true;
+    return false;
+}

package/dist/core/networkSecurity/lookup.d.ts

@@ -0,0 +1,2 @@
+export declare function urlToIpUrl(url: string, ip: string): string;
+export declare function createLookup(safeIps: string[]): ((_hostname: string, _opts: any, cb: any) => void) | undefined;

package/dist/core/networkSecurity/lookup.js

@@ -0,0 +1,14 @@
+import net from "node:net";
+export function urlToIpUrl(url, ip) {
+    // If got here shouldn't throw a error
+    const u = new URL(url);
+    return `${u.protocol}//${ip}` + `${u.port ? ":" + u.port : ""}` + `${u.pathname}${u.search}`;
+}
+export function createLookup(safeIps) {
+    if (safeIps.length == 0)
+        return undefined;
+    return (_hostname, _opts, cb) => {
+        const ip = safeIps[Math.floor(Math.random() * safeIps.length)];
+        cb(null, ip, net.isIP(ip));
+    };
+}

package/dist/core/networkSecurity/urlSafety.d.ts

@@ -0,0 +1,3 @@
+import { TranscriptOptionsBase } from "discord-message-transcript-base";
+import { safeUrlReturn } from "@/types";
+export declare function isSafeForHTML(url: string, options: TranscriptOptionsBase): Promise<safeUrlReturn>;

package/dist/core/networkSecurity/urlSafety.js

@@ -0,0 +1,71 @@
+import { CustomWarn } from "discord-message-transcript-base";
+import { TRUSTED_DISCORD_HOSTS } from "./constants.js";
+import { isPrivateIp } from "./ip.js";
+import { resolveAllIps } from "./dns.js";
+export async function isSafeForHTML(url, options) {
+    const { safeMode, disableWarnings } = options;
+    if (!safeMode)
+        return { safe: true, safeIps: [], url: url };
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        CustomWarn(`Unsafe URL rejected: Invalid URL format\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    const host = u.hostname.toLowerCase();
+    // If is from discord accept
+    if (isTrustedDiscordHost(host))
+        return { safe: true, safeIps: [], url: url };
+    // Don't accept if isn't https or http
+    if (!["http:", "https:"].includes(u.protocol)) {
+        CustomWarn(`Unsafe URL rejected: Invalid protocol "${u.protocol}"\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    if (u.username || u.password) {
+        CustomWarn(`Unsafe URL rejected: Contains username or password\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    if (u.port && !["80", "443", ""].includes(u.port)) {
+        CustomWarn(`Unsafe URL rejected: Invalid port "${u.port}"\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    // Block localhost and loopback addresses (SSRF protection)
+    if (host === "localhost" ||
+        host === "127.0.0.1" ||
+        host.startsWith("0.")) {
+        CustomWarn(`Unsafe URL rejected: Blacklisted host "${host}"\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    let ips;
+    try {
+        ips = await resolveAllIps(host);
+    }
+    catch (e) {
+        CustomWarn(`Unsafe URL rejected: DNS lookup failed or timed out for host "${host}". Error: ${e.message}\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    const safeIps = [];
+    // Block private/internal network IPs (SSRF protection)
+    for (const ip of ips) {
+        if (isPrivateIp(ip.address)) {
+            CustomWarn(`Unsafe URL rejected: Private IP address "${ip.address}" resolved for host "${host}"\nURL: ${url}`, disableWarnings);
+            return { safe: false, safeIps: [], url: url };
+        }
+        safeIps.push(ip.address);
+    }
+    const path = u.pathname.toLowerCase();
+    // External SVGs can execute scripts → allow only from Discord CDN
+    if (path.endsWith(".svg")) {
+        CustomWarn(`Unsafe URL rejected: External SVG not from Discord CDN\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
+    return { safe: true, safeIps: safeIps, url: url };
+}
+function isTrustedDiscordHost(host) {
+    host = host.toLowerCase();
+    return TRUSTED_DISCORD_HOSTS.some(trusted => {
+        return host === trusted || host.endsWith("." + trusted);
+    });
+}