discord-message-transcript 1.4.0-dev-next.1.60 → 1.4.0-dev-next.1.68

package/dist/core/networkSecurity/urlSafety.js

@@ -4,6 +4,27 @@ import { isPrivateIp } from "./ip.js";
 import { resolveAllIps } from "./dns.js";
 const cache = new Map();
 const CACHELIMIT = 1000 * 5;
+const MAX_CACHE = 500;
+const SIZE_TO_SWEEP = 100;
+function sweepCache() {
+    const now = Date.now();
+    for (const [key, value] of cache) {
+        if (now - value.createdAt > CACHELIMIT) {
+            cache.delete(key);
+        }
+    }
+}
+function maintainCacheSize() {
+    if (cache.size <= MAX_CACHE)
+        return;
+    sweepCache();
+    while (cache.size > MAX_CACHE) {
+        const firstKey = cache.keys().next().value;
+        if (!firstKey)
+            break;
+        cache.delete(firstKey);
+    }
+}
 export async function isSafeForHTML(url, options) {
     const { safeMode, disableWarnings } = options;
     if (!safeMode)
@@ -40,21 +61,23 @@ export async function isSafeForHTML(url, options) {
         CustomWarn(`Unsafe URL rejected: Blacklisted host "${host}"\nURL: ${url}`, disableWarnings);
         return { safe: false, safeIps: [], url: url };
     }
+    const path = u.pathname.toLowerCase();
+    // External SVGs can execute scripts → allow only from Discord CDN
+    if (path.endsWith(".svg")) {
+        CustomWarn(`Unsafe URL rejected: External SVG not from Discord CDN\nURL: ${url}`, disableWarnings);
+        return { safe: false, safeIps: [], url: url };
+    }
     let checkPromise;
     const cachedUrl = cache.get(u.origin);
-    if (cachedUrl && Date.now() - cachedUrl.expired < CACHELIMIT) {
+    if (cachedUrl && Date.now() - cachedUrl.createdAt < CACHELIMIT) {
         const safeReturn = await cachedUrl.safeUrlReturn;
         checkPromise = Promise.resolve({ safe: safeReturn.safe, safeIps: safeReturn.safeIps, url: url });
     }
     else {
         checkPromise = checkList(url, u, host, disableWarnings);
-        cache.set(u.origin, { safeUrlReturn: checkPromise, expired: Date.now() });
-    }
-    const path = u.pathname.toLowerCase();
-    // External SVGs can execute scripts → allow only from Discord CDN
-    if (path.endsWith(".svg")) {
-        CustomWarn(`Unsafe URL rejected: External SVG not from Discord CDN\nURL: ${url}`, disableWarnings);
-        return { safe: false, safeIps: [], url: url };
+        cache.set(u.origin, { safeUrlReturn: checkPromise, createdAt: Date.now() });
+        if (cache.size >= SIZE_TO_SWEEP)
+            maintainCacheSize();
     }
     return await checkPromise;
 }

package/dist/types/private/network.d.ts

@@ -12,5 +12,5 @@ export interface safeUrlReturn {
 }
 export interface cacheSafeUrlReturn {
     safeUrlReturn: Promise<safeUrlReturn>;
-    expired: number;
+    createdAt: number;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discord-message-transcript",
-  "version": "1.4.0-dev-next.1.60",
+  "version": "1.4.0-dev-next.1.68",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,7 +45,7 @@
   },
   "homepage": "https://github.com/HenriqueMairesse/discord-message-transcript#readme",
   "dependencies": {
-    "discord-message-transcript-base": "1.4.0-dev-next.1.60"
+    "discord-message-transcript-base": "1.4.0-dev-next.1.68"
   },
   "peerDependencies": {
     "discord.js": ">=14.19.0 <15"