domma-cms 1.8.14 → 1.8.15

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [1.8.15] - 2026-10-16
+
+- **Fixed: a view or filter on a MongoDB collection could run JavaScript inside the database server.** A saved view, the view editor's live results, a `[view]` or `[collection]` on a page, a collection filter, an `/api/v1` query or an API Builder endpoint could carry `$where`, `$function`, `$accumulator` and the like - hidden at any depth - and MongoDB would run it. Every query is now checked in one place before MongoDB sees it, and refused with a plain message if it holds anything that runs code, writes (`$out`, `$merge`), reads beyond the site's own collections (`$unionWith`, `$graphLookup`, a `$lookup` into another database or something that is not one of the site's collections) or uses a name like `__proto__`. A view is checked when it is saved, too. Ordinary filters and views work as before; a `$lookup` that names a collection by its plain name (`people` rather than `cms_people`) now works on MongoDB as it already did on files. An entry id sent as anything but text (`{"$ne": ""}` in an Action's run request, say) no longer picks whichever MongoDB entry matched first.
+- **Fixed: webhooks could call addresses inside the server's own network.** An Action's webhook step and a form's webhook would send a request anywhere - `http://127.0.0.1:…`, a private LAN address, or the cloud metadata address. They now reach public addresses only: the name is looked up first and every address it gives must be public and not this server's own, the request goes to the address that was checked (so a second lookup cannot swap in an internal one), redirects into a private address are refused, and only ports 80 and 443 are used. A webhook's own headers (an API key, say) are not passed on when it redirects to another site, and it cannot set `Host`. A form's webhook that answers with an error is now reported like any other failed form action. Self-hosted sites that send webhooks to their own network can allow it in `config/server.json` with `outboundAllowPrivate` - `true`, or a list of host names, addresses and ranges. It has no effect on a site its host runs signed-only (every site Domma CMS Manager hosts).
+
 ## [1.8.14] - 2026-10-16
 
 - **Signed-only sites close every way of putting plugin code on the server.** With `requireSignedPlugins: true` in `config/server.json` (or `DOMMA_SIGNED_ONLY=1` in the environment, which Domma CMS Manager sets on the sites it hosts), unsigned plugin files are refused straight away with a plain message - no "install anyway?" question first - and New plugin and changes in a plugin's code editor are refused too: the Marketplace screen leaves New plugin off, and the code editor opens read only. Installing and updating from the Marketplace work as before. A licensed plugin's source stays closed on such a site, Super Admins included. MongoDB connection options that could start a program or read a file on the server (`autoEncryption`, `tls…File` and the like) are refused there as well. Self-hosted sites, where the setting is off, are unchanged.

package/CLAUDE.md

@@ -125,6 +125,17 @@ Collection entry I/O is delegated to a storage adapter. Schema management is alw
 - System preset collections (`presetCollections.js` - roles, user profiles, projects, notifications, api tokens/endpoints) are **always** file-based whatever their schema says, and cannot be moved (`isFixedToFile()`)
 - **Exception - the user-data presets** (`USER_DATA_PRESET_SLUGS`: `notes-notes`, `todo-items`, `contacts-contacts`, `contacts-groups`): `resolveUserDataPreset()` in `adapterRegistry.js` uses MongoDB only when the schema declares it (notes and todo do by default, contacts declare file), the named connection is connected, AND their `data.json` holds no rows; otherwise files. Rows in files (or in both stores) keep it on files and are logged with counts (`getStorageConflicts()`), because switching would show users an empty store - the Storage move (id-preserving) settles it. No connection configured = files, silently (MongoDB is Pro); configured but down = files + the storage-down notice. `seedAll()` keeps these presets' existing `storage` block, so a move survives a restart
 - Absence of `config/connections.json` = file mode (server.js wraps Mongo init in try/catch)
+- **User-shaped queries reach MongoDB only through `mongoQueryGuard.js`**: `toSafeMongoQuery()` (MongoAdapter.list - so every
+  filter source: `[collection]`, `/api/v1` params, API Builder) and `toSafeMongoPipeline()` (views' native aggregation;
+  `validateStages()` runs the same check on save). Refused at any depth, dotted keys a part at a time: code
+  (`$where`, `$function`, `$accumulator`, BSON Code), writes/other data (`$out`, `$merge`, `$unionWith`,
+  `$graphLookup`, server-state stages, a `$lookup` not into a site `cms_<slug>` collection) and `__proto__`/`constructor`/
+  `prototype`. A new path that hands user input to `find`/`aggregate` must go through one of the two
+- **Outbound requests to user-chosen URLs go through `services/outbound.js` `safeFetch()`** (Actions' webhook step,
+  form webhooks; plugins fetching a user's URL should too) - never bare `fetch`. Public addresses only after DNS, the
+  connection pinned to the checked address, never this server's own addresses, redirects re-checked, ports 80/443.
+  `server.json` `outboundAllowPrivate` (`true` or a list of hosts/addresses/CIDRs) lifts it for self-hosters and is
+  ignored when `codePolicy.signedOnly()`. `wpImport/fetch.js` shares its address rules and pinned request
 
 ## Roles & Permissions
 
@@ -367,7 +378,7 @@ restarting) mid-run - keep that file's name and meaning.
 - **The XML reader is its own** (`xml.js`): any DOCTYPE or ENTITY is refused, only the predefined and numeric
   entities decode - do not swap in a parser that expands entities. Zips (`zip.js`) are read by offset with
   zip-slip names dropped and ratio/size caps; nothing is ever extracted under its own name.
-- **Media downloads go through `fetch.js` only**: the export's own hosts, every resolved address public, the
+- **Media downloads go through `fetch.js` only** (address rules and pinned request shared with `services/outbound.js`): the export's own hosts, every resolved address public, the
   connection pinned to the checked address, never the server's own interface addresses, ports 80/443 only, no
   redirect off-host; a non-image/PDF body that sniffs as HTML or script is refused (it would be served from /media).
   `WP_IMPORT_ALLOW_PRIVATE_HOSTS=1` (ignored when `NODE_ENV=production`) is the tests' and local browser checks' way

package/docs/configuration.md

@@ -31,6 +31,7 @@ Controls the HTTP server.
 | `logging.level` | string | Log verbosity: `fatal`, `error`, `warn`, `info`, `debug`, `trace`, `silent`. Defaults to `info` in development, `warn` otherwise. `warn` hides 4xx responses and plugin `log.info` output, so a failed admin action leaves no trace - raise it to `info` if you need to diagnose one. Overridden by the `LOG_LEVEL` env var. |
 | `restartOnPluginToggle` | boolean | `true` | Restart the server automatically when an admin enables or disables a plugin. See **Plugin toggles restart the server** below |
 | `requireSignedPlugins` | boolean | `false` | When `true`, the site runs only plugin code the Marketplace signed: an unsigned `.dcmsplugin` (e.g. one exported from another site) is refused even if the installer confirms it, New plugin is refused, a plugin's files cannot be changed in the code editor (it opens read only), licensed source cannot be read even by a Super Admin, and MongoDB connection options that start a program or read a file (`autoEncryption`, `tls…File`, …) cannot be saved. A bundle with a signature that does not verify is always refused, whatever this is set to. Read fresh on every check, and also as it was at boot, so changing the file on a running site can switch it on but not off. `DOMMA_SIGNED_ONLY=1` in the environment turns it on whatever the file says - Domma CMS Manager sets it on the sites it hosts. Nothing in the admin writes `server.json`. See `server/services/codePolicy.js` |
+| `outboundAllowPrivate` | boolean \| string[] | `false` | Webhooks (an Action's webhook step, a form's webhook) reach public addresses only: the name is looked up and every address must be public and not the server's own, the request is pinned to that address, redirects into private addresses are refused, and only ports 80 and 443 are used. A self-hosted site that sends webhooks inside its own network sets `true` to lift those rules for every request, or a list of host names, addresses and CIDR ranges (`["n8n.lan", "192.168.10.0/24", "fd00::/8"]`) to lift them for those only - a name passes if it is listed, or if every address it resolves to is. Ignored on a signed-only site (`requireSignedPlugins` / `DOMMA_SIGNED_ONLY=1`), so a hosted site's admin cannot open the host's network. Read fresh on every request. See `server/services/outbound.js` |
 
 ### Plugin toggles restart the server
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.14",
+  "version": "1.8.15",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/routes/api/forms.js

@@ -45,6 +45,7 @@ import {hooks} from '../../services/hooks.js';
 import {saveMedia} from '../../services/content.js';
 import {v4 as uuidv4} from 'uuid';
 import {ago, clip, plural} from '../../services/sidebarBadges.js';
+import {safeFetch} from '../../services/outbound.js';
 
 /**
  * Detect form↔collection mismatches at save time so admins know BEFORE
@@ -961,11 +962,15 @@ export async function formsRoutes(fastify) {
         const webhookAction = form.actions?.webhook;
         if (record && webhookAction?.enabled && webhookAction.url) {
             try {
-                await fetch(webhookAction.url, {
-                    method:  webhookAction.method || 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body:    JSON.stringify({ form: slug, data })
+                // services/outbound.js: public addresses only, pinned, no redirect inward.
+                const method = String(webhookAction.method || 'POST').toUpperCase();
+                const res = await safeFetch(webhookAction.url, {
+                    method,
+                    headers:  { 'Content-Type': 'application/json' },
+                    body:     method === 'GET' || method === 'HEAD' ? undefined : JSON.stringify({ form: slug, data }),
+                    truncate: true
                 });
+                if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);
             } catch (err) {
                 fastify.log.warn(`[forms] Webhook failed for "${slug}": ${err.message}`);
                 formActionFailed(slug, form.title, 'webhook', err.message);

package/server/services/actions.js

@@ -203,10 +203,13 @@ async function executeStep(step, collection, entry, context) {
             const body    = cfg.body ? interpolateValue(cfg.body, context) : undefined;
             const headers = { 'Content-Type': 'application/json', ...(cfg.headers || {}) };
 
-            const res = await fetch(url, {
+            // services/outbound.js: public addresses only, pinned, no redirect inward.
+            const { safeFetch } = await import('./outbound.js');
+            const res = await safeFetch(url, {
                 method,
                 headers,
-                body: body !== undefined ? JSON.stringify(body) : undefined
+                body: body !== undefined && method !== 'GET' && method !== 'HEAD' ? JSON.stringify(body) : undefined,
+                truncate: true
             });
 
             if (!res.ok) throw new Error(`Webhook returned HTTP ${res.status}`);

package/server/services/adapters/MongoAdapter.js

@@ -19,7 +19,7 @@
  *   count(slug)               → number
  *   archive(slug)             → string|null (set the entries aside after a storage move)
  */
-import { toMongoQuery } from '../filterEngine.js';
+import { toSafeMongoQuery } from '../mongoQueryGuard.js';
 
 /** Prefix applied to all CMS collection names in MongoDB to avoid collisions. */
 const PREFIX = 'cms_';
@@ -36,6 +36,19 @@ function strip(doc) {
     return rest;
 }
 
+/**
+ * An entry id as it may be put in a query: text only. An object from a JSON
+ * body (`{"$ne": ""}`) would otherwise be read as an operator and pick
+ * whichever entry matched first.
+ *
+ * @param {unknown} entryId
+ * @returns {string}
+ */
+function idOf(entryId) {
+    if (typeof entryId !== 'string' && typeof entryId !== 'number') throw Object.assign(new Error('Entry not found'), {statusCode: 404});
+    return String(entryId);
+}
+
 export class MongoAdapter {
 
     /**
@@ -67,7 +80,7 @@ export class MongoAdapter {
      * and structured filtering.
      *
      * `filter` is translated to native MongoDB query operators via
-     * `filterEngine.toMongoQuery()` and pushed down to the database - page
+     * `mongoQueryGuard.toSafeMongoQuery()` and pushed down to the database - page
      * authors writing `[collection where_salary_gte="50000"]` get index-aware
      * queries automatically. When `search` is present, all documents are
      * fetched and filtered in memory (same behaviour as FileAdapter, kept
@@ -88,7 +101,9 @@ export class MongoAdapter {
 
         const sortField = sort === 'createdAt' ? 'meta.createdAt' : `data.${sort}`;
         const sortDir   = order === 'desc' ? -1 : 1;
-        const query     = filter ? toMongoQuery(filter) : {};
+        // The one translation of a user-shaped filter for MongoDB - refuses
+        // anything that would run code on the server (mongoQueryGuard.js).
+        const query     = toSafeMongoQuery(filter);
 
         if (search) {
             // Fetch matching (by filter) docs and substring-match in memory.
@@ -140,8 +155,9 @@ export class MongoAdapter {
      * @returns {Promise<object|null>}
      */
     async get(slug, entryId) {
+        if (typeof entryId !== 'string' && typeof entryId !== 'number') return null;
         const col = await this._col(slug);
-        const doc = await col.findOne({ id: entryId }, { projection: { _id: 0 } });
+        const doc = await col.findOne({ id: idOf(entryId) }, { projection: { _id: 0 } });
         return doc || null;
     }
 
@@ -169,7 +185,7 @@ export class MongoAdapter {
      */
     async update(slug, entryId, updated) {
         const col    = await this._col(slug);
-        const result = await col.replaceOne({ id: entryId }, { ...updated });
+        const result = await col.replaceOne({ id: idOf(entryId) }, { ...updated });
         if (result.matchedCount === 0) throw new Error('Entry not found');
         return updated;
     }
@@ -184,7 +200,7 @@ export class MongoAdapter {
      */
     async remove(slug, entryId) {
         const col    = await this._col(slug);
-        const result = await col.deleteOne({ id: entryId });
+        const result = await col.deleteOne({ id: idOf(entryId) });
         if (result.deletedCount === 0) throw new Error('Entry not found');
     }
 

package/server/services/filterEngine.js

@@ -262,7 +262,9 @@ export function toMongoQuery(filter) {
 
     // Collapse single-operator sub-docs that only contain $eq back to a flat value.
     for (const [path, sub] of Object.entries(query)) {
-        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub) {
+        // Only a plain value: an object here would be read as operators, not matched as a value.
+        if (sub && typeof sub === 'object' && Object.keys(sub).length === 1 && '$eq' in sub
+            && (sub.$eq === null || typeof sub.$eq !== 'object')) {
             query[path] = sub.$eq;
         }
     }

package/server/services/mongoQueryGuard.js

@@ -0,0 +1,193 @@
+/**
+ * The one gate between a user-shaped query and MongoDB.
+ *
+ * Site users shape queries in many places - saved views and the view editor,
+ * the `[view]` and `[collection]` shortcodes, collection filters, `/api/v1`
+ * query parameters, API Builder endpoints. Every one of them reaches MongoDB
+ * through one of two translations, and both go through this module:
+ *
+ *   - a structured filter -> `toSafeMongoQuery()` (MongoAdapter.list)
+ *   - a view pipeline     -> `toSafeMongoPipeline()` (views.executeMongoView)
+ *
+ * Refused, at any depth (inside nested objects and arrays, `$lookup`
+ * sub-pipelines, `$expr`, `$group`...):
+ *
+ *   - anything that runs JavaScript inside the database server: `$where`,
+ *     `$function`, `$accumulator`, `$code`, and BSON Code values;
+ *   - anything that writes, or reads outside the site's own collections:
+ *     `$out`, `$merge`, `$unionWith`, `$graphLookup`, the server-state stages
+ *     (`$currentOp`, `$collStats`, ...), and a `$lookup` that is not into one
+ *     of this site's `cms_<slug>` collections (no cross-database form);
+ *   - keys named `__proto__`, `constructor` or `prototype`.
+ *
+ * Plain operators (`$eq`, `$gt`, `$in`, `$regex`, `$expr` with ordinary
+ * expressions, `$group` with `$sum`...) pass untouched.
+ *
+ * @module services/mongoQueryGuard
+ */
+import {toMongoQuery} from './filterEngine.js';
+
+/** Operators that execute code on the database server. */
+export const CODE_OPERATORS = Object.freeze(['$where', '$function', '$accumulator', '$code', '$mapReduce']);
+
+/** Operators that write, or reach data or server state beyond the site's collections. */
+export const REACH_OPERATORS = Object.freeze([
+    '$out', '$merge', '$unionWith', '$graphLookup', '$documents',
+    '$currentOp', '$listSessions', '$listLocalSessions', '$collStats', '$indexStats',
+    '$planCacheStats', '$changeStream', '$listSearchIndexes', '$listSampledQueries', '$querySettings'
+]);
+
+const PROTOTYPE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const REFUSED = new Set([...CODE_OPERATORS, ...REACH_OPERATORS].map(k => k.toLowerCase()));
+const SITE_SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+const MAX_DEPTH = 64;
+
+export class UnsafeQueryError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'EUNSAFE_QUERY';
+        this.statusCode = 400;
+    }
+}
+
+/**
+ * Throw when a query, pipeline or any part of one could run code or reach
+ * outside the site's own collections.
+ *
+ * @param {unknown} value
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs; when given, a `$lookup` must name one
+ * @param {string} [opts.prefix='cms_'] - the MongoDB name prefix of a site collection
+ * @returns {unknown} the same value, for chaining
+ */
+export function assertSafeMongoQuery(value, opts = {}) {
+    const known = opts.collections ? new Set(opts.collections) : null;
+    const prefix = opts.prefix ?? 'cms_';
+    const seen = new Set();
+
+    const walk = (node, at, depth) => {
+        if (node === null || typeof node !== 'object') {
+            if (typeof node === 'function') throw new UnsafeQueryError(`${at || 'The query'} is a function - not allowed in a query.`);
+            return;
+        }
+        if (depth > MAX_DEPTH) throw new UnsafeQueryError('The query is nested too deeply.');
+        if (seen.has(node)) return;
+        seen.add(node);
+        // A BSON Code value runs as JavaScript wherever the server accepts one.
+        if (String(node._bsontype || '').toLowerCase().startsWith('code')) {
+            throw new UnsafeQueryError(`${at || 'The query'} holds JavaScript code - not allowed in a query.`);
+        }
+        if (Array.isArray(node)) {
+            node.forEach((item, i) => walk(item, `${at}[${i}]`, depth + 1));
+            return;
+        }
+        // Own keys, including a `__proto__` key that JSON.parse makes an own property.
+        for (const key of Reflect.ownKeys(node)) {
+            if (typeof key !== 'string') continue;
+            const here = at ? `${at}.${key}` : key;
+            const lower = key.toLowerCase();
+            // A dotted path ('data.x.__proto__', 'a.$where') is checked a part at a time.
+            for (const part of key.split('.')) {
+                if (PROTOTYPE_KEYS.has(part)) throw new UnsafeQueryError(`"${part}" is not allowed as a name in a query (at ${here}).`);
+                const p = part.toLowerCase();
+                if (REFUSED.has(p)) {
+                    throw new UnsafeQueryError(`${part} is not allowed in a query - it ${CODE_OPERATORS.some(k => k.toLowerCase() === p) ? 'runs code on the database server' : 'reaches beyond this site\'s own collections'} (at ${here}).`);
+                }
+            }
+            const child = node[key];
+            if (lower === '$lookup') checkLookup(child, here, known, prefix);
+            walk(child, here, depth + 1);
+        }
+    };
+
+    walk(value, '', 0);
+    return value;
+}
+
+function checkLookup(config, at, known, prefix) {
+    if (!config || typeof config !== 'object' || Array.isArray(config)) throw new UnsafeQueryError(`$lookup needs an object (at ${at}).`);
+    const from = config.from;
+    if (typeof from !== 'string') {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections, named as text - not another database (at ${at}.from).`);
+    }
+    // `cms_<slug>` or the bare `<slug>` (the file evaluator accepts both; the
+    // MongoDB translation prefixes a bare one), never `cms__` meta stores.
+    const slug = from.startsWith(prefix) ? from.slice(prefix.length) : from;
+    if (!SITE_SLUG.test(slug)) {
+        throw new UnsafeQueryError(`$lookup may only join one of this site's collections - "${from}" is not one (at ${at}.from).`);
+    }
+    if (known && !known.has(slug)) {
+        throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site (at ${at}.from).`);
+    }
+}
+
+/**
+ * A structured filter (filterEngine DSL) as a MongoDB query - refused when it
+ * would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {Record<string, unknown>|undefined} filter
+ * @returns {object}
+ */
+export function toSafeMongoQuery(filter) {
+    if (!filter) return {};
+    assertSafeMongoQuery(filter);
+    return assertSafeMongoQuery(toMongoQuery(filter));
+}
+
+/**
+ * Every `$lookup` target named in a (checked) pipeline, at any depth.
+ *
+ * @param {unknown} value
+ * @returns {string[]} the `from` collection names
+ */
+export function lookupTargets(value) {
+    const out = new Set();
+    const walk = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(walk);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string') out.add(v.from);
+            walk(v);
+        }
+    };
+    walk(value);
+    return [...out];
+}
+
+/**
+ * Stage descriptors (`{type, config}`) as a MongoDB aggregation pipeline,
+ * refused when any stage would carry anything `assertSafeMongoQuery` refuses.
+ *
+ * @param {object[]} stages
+ * @param {object} [opts]
+ * @param {Set<string>|string[]} [opts.collections] - the site's collection slugs
+ * @param {(slug: string) => Promise<boolean>} [opts.collectionExists] - asked for each `$lookup` target
+ * @returns {Promise<object[]>}
+ */
+export async function toSafeMongoPipeline(stages, opts = {}) {
+    const pipeline = (Array.isArray(stages) ? stages : []).map(stage => {
+        const type = String(stage?.type || '');
+        if (PROTOTYPE_KEYS.has(type)) throw new UnsafeQueryError(`"${type}" is not a stage.`);
+        return {[type]: stage.config};
+    });
+    assertSafeMongoQuery(pipeline, opts);
+    // A copy, so the saved view is not rewritten: every $lookup names its cms_ collection.
+    const out = structuredClone(pipeline);
+    const prefixLookups = (node) => {
+        if (!node || typeof node !== 'object') return;
+        if (Array.isArray(node)) return node.forEach(prefixLookups);
+        for (const [k, v] of Object.entries(node)) {
+            if (k === '$lookup' && typeof v?.from === 'string' && !v.from.startsWith('cms_')) v.from = `cms_${v.from}`;
+            prefixLookups(v);
+        }
+    };
+    prefixLookups(out);
+    if (opts.collectionExists) {
+        for (const from of lookupTargets(out)) {
+            if (!(await opts.collectionExists(from.slice('cms_'.length)))) {
+                throw new UnsafeQueryError(`$lookup names "${from}", which is not a collection on this site.`);
+            }
+        }
+    }
+    return out;
+}

package/server/services/outbound.js

@@ -0,0 +1,394 @@
+/**
+ * Outbound requests to addresses a site user chose - without becoming a way
+ * into the server's own network (SSRF).
+ *
+ * Every server-side request whose URL a site user can set goes through
+ * `safeFetch()` here: Actions' webhook step, a form's webhook, and any plugin
+ * that fetches a user's URL through core. The WordPress importer's media
+ * downloader (wpImport/fetch.js) uses the same address rules and pinned
+ * connection, with its own host list on top.
+ *
+ *  - http(s) only, no user name or password in the address, ports 80 and 443.
+ *  - The host name is resolved first, and EVERY address it resolves to must be
+ *    public: loopback, private, link-local (cloud metadata lives at
+ *    169.254.169.254), CGNAT, multicast, reserved and documentation ranges are
+ *    refused, IPv4-mapped and NAT64 IPv6 forms included - and so is every
+ *    address of this server's own interfaces, public ones too. The WHATWG URL
+ *    parser has already turned decimal, octal and hex IPv4 spellings
+ *    (http://2130706433/, http://0177.0.0.1/) into dotted form, so they are
+ *    checked as the address they are.
+ *  - The connection goes to the address that was checked (a pinned lookup), so
+ *    a second DNS answer cannot swap in an internal one (DNS rebinding).
+ *  - Redirects are followed at most three times, each one checked as above.
+ *  - A time limit for the whole request and a cap on the answer's size.
+ *
+ * Self-hosted sites that need internal targets (a webhook to n8n on the LAN)
+ * set `outboundAllowPrivate` in config/server.json: `true` lifts the address
+ * and port rules for every request, a list of host names, addresses and CIDR
+ * ranges lifts them for those only. It is IGNORED on a signed-only site
+ * (codePolicy.signedOnly() - every site a Manager hosts), because there the
+ * site's admin is a customer, not the owner of the network.
+ *
+ * @module services/outbound
+ */
+import dns from 'node:dns';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
+import {getConfig} from '../config.js';
+import {signedOnly} from './codePolicy.js';
+
+export const FETCH_PORTS = Object.freeze([80, 443]);
+
+export const OUTBOUND_LIMITS = Object.freeze({maxBytes: 1024 * 1024, timeoutMs: 15_000, maxRedirects: 3});
+
+export class FetchRefused extends Error {
+    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
+}
+
+/** The port an address would be fetched on. */
+export function portOf(raw) {
+    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
+}
+
+// ---------------------------------------------------------------------------
+// Addresses
+// ---------------------------------------------------------------------------
+
+const V4_BLOCKED = [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
+    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
+    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
+];
+
+function v4ToInt(ip) {
+    const p = String(ip).split('.').map(Number);
+    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
+    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
+}
+
+function v4InRange(n, base, bits) {
+    const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+    return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
+}
+
+function v4Blocked(ip) {
+    const n = v4ToInt(ip);
+    if (n === null) return true;
+    return V4_BLOCKED.some(([base, bits]) => v4InRange(n, base, bits));
+}
+
+/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
+function v6Groups(ip) {
+    let s = String(ip).toLowerCase().split('%')[0];
+    // A dotted IPv4 tail (::ffff:1.2.3.4).
+    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
+    if (tail) {
+        const n = v4ToInt(tail[1]);
+        if (n === null) return null;
+        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const halves = s.split('::');
+    if (halves.length > 2) return null;
+    const left = halves[0] ? halves[0].split(':') : [];
+    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
+    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
+    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
+    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
+}
+
+/**
+ * Is this address one a server-side fetch must never reach?
+ *
+ * @param {string} ip
+ * @returns {boolean}
+ */
+export function isBlockedAddress(ip) {
+    const kind = net.isIP(String(ip || ''));
+    if (kind === 4) return v4Blocked(ip);
+    if (kind !== 6) return true;
+    const g = v6Groups(ip);
+    if (!g) return true;
+    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    if (g.every(x => x === 0)) return true;                                   // ::
+    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
+    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
+    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
+    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
+    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
+    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
+    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
+    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
+    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
+    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
+    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
+    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
+    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
+    return false;
+}
+
+/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
+export function canonAddress(ip) {
+    const s = String(ip || '').toLowerCase().split('%')[0];
+    if (net.isIP(s) !== 6) return s;
+    const g = v6Groups(s);
+    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
+    return g ? g.map(x => x.toString(16)).join(':') : s;
+}
+
+/**
+ * This machine's own addresses - every interface, public ones included, plus
+ * the unspecified ones. A server must never fetch from itself, whatever its
+ * public address resolves as.
+ */
+export function ownAddresses(interfaces = os.networkInterfaces()) {
+    const out = new Set(['0.0.0.0', canonAddress('::')]);
+    for (const list of Object.values(interfaces || {})) {
+        for (const a of list || []) if (a?.address) out.add(canonAddress(a.address));
+    }
+    return out;
+}
+
+/** Does an address fall inside `a.b.c.d/n`, `v6::/n` or equal a plain address? */
+function addressMatches(ip, entry) {
+    const [base, bitsRaw] = String(entry).split('/');
+    const a = canonAddress(ip);
+    const b = canonAddress(base);
+    if (bitsRaw === undefined) return a === b;
+    const bits = Number(bitsRaw);
+    if (net.isIP(a) === 4 && net.isIP(b) === 4) {
+        return Number.isInteger(bits) && bits >= 0 && bits <= 32 && v4InRange(v4ToInt(a), b, bits);
+    }
+    const ga = v6Groups(a);
+    const gb = v6Groups(b);
+    if (!ga || !gb || !Number.isInteger(bits) || bits < 0 || bits > 128) return false;
+    for (let i = 0, left = bits; left > 0; i++, left -= 16) {
+        const take = Math.min(16, left);
+        const mask = (0xffff << (16 - take)) & 0xffff;
+        if ((ga[i] & mask) !== (gb[i] & mask)) return false;
+    }
+    return true;
+}
+
+/**
+ * Resolve a host and check every address.
+ *
+ * @param {string} hostname
+ * @param {object} [opts]
+ * @param {boolean} [opts.allowPrivate] - skip the address checks entirely
+ * @param {(address: string) => boolean} [opts.allowAddress] - addresses the site allowlisted
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @param {Set<string>} [opts.own] - this server's addresses
+ * @returns {Promise<{address: string, family: number, allowlisted: boolean}>} the address to connect to
+ */
+export async function resolvePublic(hostname, {allowPrivate = false, allowAddress = null, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
+    const host = String(hostname || '').replace(/^\[|\]$/g, '');
+    let addrs;
+    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
+    else {
+        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
+    }
+    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
+    const listed = (a) => !!allowAddress && allowAddress(a.address);
+    if (!allowPrivate) {
+        const bad = addrs.find(a => isBlockedAddress(a.address) && !listed(a));
+        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
+        const self = addrs.find(a => own.has(canonAddress(a.address)) && !listed(a));
+        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
+    }
+    return {address: addrs[0].address, family: addrs[0].family || net.isIP(addrs[0].address), allowlisted: allowPrivate || addrs.every(listed)};
+}
+
+/** Scheme and credentials (before any DNS). Returns the URL, or throws. */
+export function parseOutboundUrl(raw) {
+    let u;
+    try { u = new URL(String(raw || '').trim()); } catch { throw new FetchRefused('Not a web address.'); }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new FetchRefused(`${u.protocol} addresses are not fetched.`);
+    if (u.username || u.password) throw new FetchRefused('Addresses with a user name or password are not fetched.');
+    return u;
+}
+
+// ---------------------------------------------------------------------------
+// The site's allowlist (config/server.json outboundAllowPrivate)
+// ---------------------------------------------------------------------------
+
+/**
+ * What this site lets outbound requests reach beyond the public internet.
+ *
+ * @param {object} [opts]
+ * @param {object} [opts.server] - server.json (read fresh when omitted)
+ * @param {boolean} [opts.signed] - signed-only (codePolicy.signedOnly() when omitted)
+ * @returns {{all: boolean, hosts: string[], addresses: string[]}}
+ */
+export function outboundPolicy({server, signed} = {}) {
+    const none = {all: false, hosts: [], addresses: []};
+    if (signed ?? signedOnly()) return none;
+    let cfg = server;
+    if (cfg === undefined) { try { cfg = getConfig('server'); } catch { cfg = {}; } }
+    const v = cfg?.outboundAllowPrivate;
+    if (v === true) return {all: true, hosts: [], addresses: []};
+    if (!Array.isArray(v)) return none;
+    const entries = v.filter(x => typeof x === 'string' && x.trim()).map(x => x.trim().toLowerCase().replace(/^\[|\]$/g, ''));
+    return {
+        all: false,
+        addresses: entries.filter(x => net.isIP(x.split('/')[0])),
+        hosts: entries.filter(x => !net.isIP(x.split('/')[0]))
+    };
+}
+
+// ---------------------------------------------------------------------------
+// The request
+// ---------------------------------------------------------------------------
+
+/**
+ * One HTTP request to an address already checked, connecting only to that
+ * address. Never follows a redirect itself.
+ *
+ * @returns {Promise<{status: number, headers: object, buffer: Buffer, truncated: boolean, redirect?: string}>}
+ */
+export function pinnedRequest(u, {address, family, method = 'GET', headers = {}, body, deadline, maxBytes, signal, truncate = false}) {
+    return new Promise((resolve, reject) => {
+        const lib = u.protocol === 'https:' ? https : http;
+        const payload = body === undefined || body === null ? null : (Buffer.isBuffer(body) ? body : Buffer.from(String(body)));
+        if (payload && !Object.keys(headers).some(k => /^content-length$/i.test(k))) headers = {...headers, 'content-length': String(payload.length)};
+        let done = false;
+        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
+        const req = lib.request({
+            protocol: u.protocol,
+            hostname: u.hostname.replace(/^\[|\]$/g, ''),
+            servername: net.isIP(u.hostname.replace(/^\[|\]$/g, '')) ? undefined : u.hostname,
+            port: u.port || undefined,
+            path: `${u.pathname}${u.search}`,
+            method,
+            headers,
+            // Connect to the address that was checked - not to a fresh lookup.
+            lookup: (_host, options, cb) => {
+                if (options?.all) cb(null, [{address, family}]);
+                else cb(null, address, family);
+            },
+            agent: false,
+            signal
+        }, (res) => {
+            const status = res.statusCode || 0;
+            if (status >= 300 && status < 400 && res.headers.location) {
+                res.resume();
+                return finish(resolve, {status, headers: res.headers, buffer: Buffer.alloc(0), truncated: false, redirect: String(res.headers.location)});
+            }
+            const declared = Number(res.headers['content-length']);
+            if (!truncate && Number.isFinite(declared) && declared > maxBytes) {
+                res.destroy();
+                return finish(reject, new FetchRefused(`The answer is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+            }
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                if (size + c.length > maxBytes) {
+                    res.destroy();
+                    if (truncate) {
+                        chunks.push(c.subarray(0, maxBytes - size));
+                        finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: true});
+                    } else {
+                        finish(reject, new FetchRefused(`The answer is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
+                    }
+                    return;
+                }
+                size += c.length;
+                chunks.push(c);
+            });
+            res.on('end', () => finish(resolve, {status, headers: res.headers, buffer: Buffer.concat(chunks), truncated: false}));
+            res.on('error', (err) => finish(reject, err));
+        });
+        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The request took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
+        req.on('error', (err) => finish(reject, err));
+        if (payload) req.write(payload);
+        req.end();
+    });
+}
+
+/**
+ * Check one URL against the rules and the site's allowlist, and resolve it.
+ *
+ * @returns {Promise<{u: URL, address: string, family: number}>}
+ */
+export async function checkOutbound(raw, {policy = outboundPolicy(), lookup, own, allowPrivate = false} = {}) {
+    const u = parseOutboundUrl(raw);
+    const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    const hostListed = policy.all || allowPrivate || policy.hosts.includes(host);
+    const allowAddress = policy.addresses.length ? (ip) => policy.addresses.some(e => addressMatches(ip, e)) : null;
+    const {address, family, allowlisted} = await resolvePublic(host, {
+        allowPrivate: hostListed, allowAddress, ...(lookup && {lookup}), ...(own && {own})
+    });
+    const port = portOf(u.href);
+    if (!allowlisted && !FETCH_PORTS.includes(port)) throw new FetchRefused(`Port ${port} is not reached - only 80 and 443.`);
+    return {u, address, family};
+}
+
+/**
+ * Make a request to a URL a site user chose.
+ *
+ * @param {string} url
+ * @param {object} [opts]
+ * @param {string} [opts.method='GET']
+ * @param {object} [opts.headers]
+ * @param {string|Buffer} [opts.body]
+ * @param {number} [opts.timeoutMs]
+ * @param {number} [opts.maxBytes] - the answer's size cap
+ * @param {boolean} [opts.truncate] - cut an oversized answer instead of failing
+ * @param {number} [opts.maxRedirects]
+ * @param {AbortSignal} [opts.signal]
+ * @param {object} [opts.policy] - outboundPolicy(), read fresh when omitted
+ * @param {Function} [opts.lookup] - tests
+ * @param {Set<string>} [opts.own] - tests
+ * @returns {Promise<{ok: boolean, status: number, headers: object, buffer: Buffer, text: () => string, json: () => unknown, url: string, truncated: boolean}>}
+ */
+export async function safeFetch(url, opts = {}) {
+    const lim = {...OUTBOUND_LIMITS, ...Object.fromEntries(Object.entries(opts).filter(([, v]) => v !== undefined))};
+    const deadline = Date.now() + lim.timeoutMs;
+    const policy = opts.policy || outboundPolicy();
+    let method = String(opts.method || 'GET').toUpperCase();
+    let body = opts.body;
+    // Headers that steer the connection itself are the request's, not the caller's.
+    const callerHeaders = Object.fromEntries(Object.entries(opts.headers || {})
+        .filter(([k]) => !/^(host|connection|transfer-encoding|content-length|keep-alive|upgrade|te|trailer|proxy-.*)$/i.test(k)));
+    let headers = {'user-agent': 'DommaCMS/1', ...callerHeaders};
+    let current = url;
+    let first = null;
+    for (let hop = 0; hop <= lim.maxRedirects; hop++) {
+        const {u, address, family} = await checkOutbound(current, {policy, lookup: opts.lookup, own: opts.own});
+        if (first === null) first = u;
+        else if (u.origin !== first.origin) {
+            // A redirect to another origin (or from https down to http) takes none of
+            // the caller's headers - an API key meant for the first host stays there.
+            headers = Object.fromEntries(Object.entries(headers).filter(([k]) => /^(user-agent|content-type|accept)$/i.test(k)));
+        }
+        const res = await pinnedRequest(u, {
+            address, family, method, headers, body, deadline,
+            maxBytes: lim.maxBytes, truncate: !!opts.truncate, signal: opts.signal
+        });
+        if (res.redirect) {
+            if (hop === lim.maxRedirects) throw new FetchRefused('Too many redirects.');
+            current = new URL(res.redirect, u).href;
+            // As browsers do: 303, and 301/302 after a POST, continue as a GET without the body.
+            if (res.status === 303 || ((res.status === 301 || res.status === 302) && method === 'POST')) {
+                method = 'GET';
+                body = undefined;
+                headers = Object.fromEntries(Object.entries(headers).filter(([k]) => !/^content-(type|length)$/i.test(k)));
+            }
+            continue;
+        }
+        const buffer = res.buffer;
+        return {
+            ok: res.status >= 200 && res.status < 300,
+            status: res.status,
+            headers: res.headers,
+            buffer,
+            truncated: res.truncated,
+            url: u.href,
+            text: () => buffer.toString('utf8'),
+            json: () => JSON.parse(buffer.toString('utf8'))
+        };
+    }
+    throw new FetchRefused('Too many redirects.');
+}

package/server/services/views.js

@@ -24,6 +24,11 @@
  *
  * Forbidden stage types:
  *   $out, $merge, $function, $accumulator, $graphLookup
+ *
+ * Stage CONFIGS are checked too, at any depth (mongoQueryGuard.js): no
+ * `$where`/`$function`/`$accumulator` hidden in a `$match`, `$group` or
+ * `$lookup` sub-pipeline, and a `$lookup` only into this site's `cms_<slug>`
+ * collections. Checked on save and again before MongoDB runs the pipeline.
  */
 import fs from 'fs/promises';
 import path from 'path';
@@ -35,6 +40,7 @@ import {getEffectiveLevel} from './userRoles.js';
 import {executePipeline} from './viewPipeline.js';
 import * as cache from './cache/index.js';
 import {fileIn} from './safePath.js';
+import {assertSafeMongoQuery, toSafeMongoPipeline} from './mongoQueryGuard.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT      = path.resolve(__dirname, '..', '..');
@@ -88,6 +94,7 @@ function validateStages(stages) {
         if (!ALLOWED_STAGES.has(stage.type)) {
             throw new Error(`Stage type "${stage.type}" is not in the allowed list`);
         }
+        assertSafeMongoQuery({[stage.type]: stage.config});
     }
 }
 
@@ -389,7 +396,12 @@ async function executeMongoView(view, { page, limit, user }) {
     const db = getDb(view.connection || 'default');
 
     const sourceCollection = `${COLLECTION_PREFIX}${view.pipeline.source}`;
-    const pipeline = buildPipelineStages(view.pipeline?.stages || []);
+    // The one translation of a view for MongoDB: refuses code-running
+    // operators at any depth and a $lookup outside this site's collections.
+    const {getCollection} = await import('./collections.js');
+    const pipeline = await toSafeMongoPipeline(view.pipeline?.stages || [], {
+        collectionExists: async (slug) => !!(await getCollection(slug).catch(() => null))
+    });
 
     // Prepend row-level $match if configured
     const rowLevel = view.access?.rowLevel;

package/server/services/wpImport/fetch.js

@@ -21,25 +21,15 @@
  *
  * @module services/wpImport/fetch
  */
-import dns from 'node:dns';
-import http from 'node:http';
-import https from 'node:https';
-import net from 'node:net';
-import os from 'node:os';
+import {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, pinnedRequest, portOf, resolvePublic} from '../outbound.js';
 
-export const FETCH_PORTS = Object.freeze([80, 443]);
-
-/** The port an address would be fetched on. */
-export function portOf(raw) {
-    try { const u = new URL(raw); return u.port ? Number(u.port) : (u.protocol === 'https:' ? 443 : 80); } catch { return 0; }
-}
+// The address rules and the pinned connection are shared with every other
+// outbound request (services/outbound.js); this module adds the WordPress
+// site's own host list, the 50 MB cap and "only a 200 is a file".
+export {FETCH_PORTS, FetchRefused, isBlockedAddress, ownAddresses, portOf, resolvePublic};
 
 export const FETCH_LIMITS = Object.freeze({maxBytes: 50 * 1024 * 1024, timeoutMs: 60_000, maxRedirects: 3});
 
-export class FetchRefused extends Error {
-    constructor(message) { super(message); this.code = 'EREFUSED_SSRF'; }
-}
-
 /**
  * The test-only switch: private addresses are allowed only outside
  * production AND with WP_IMPORT_ALLOW_PRIVATE_HOSTS=1 set.
@@ -48,121 +38,6 @@ export function testHostsAllowed(env = process.env) {
     return env.NODE_ENV !== 'production' && env.WP_IMPORT_ALLOW_PRIVATE_HOSTS === '1';
 }
 
-const V4_BLOCKED = [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12],
-    ['192.0.0.0', 24], ['192.0.2.0', 24], ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15],
-    ['198.51.100.0', 24], ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4]
-];
-
-function v4ToInt(ip) {
-    const p = ip.split('.').map(Number);
-    if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;
-    return ((p[0] << 24) >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3];
-}
-
-function v4Blocked(ip) {
-    const n = v4ToInt(ip);
-    if (n === null) return true;
-    return V4_BLOCKED.some(([base, bits]) => {
-        const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
-        return ((n & mask) >>> 0) === ((v4ToInt(base) & mask) >>> 0);
-    });
-}
-
-/** Expand an IPv6 address to 8 groups of numbers (null when it is not one). */
-function v6Groups(ip) {
-    let s = ip.toLowerCase().split('%')[0];
-    // A dotted IPv4 tail (::ffff:1.2.3.4).
-    const tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(s);
-    if (tail) {
-        const n = v4ToInt(tail[1]);
-        if (n === null) return null;
-        s = s.slice(0, -tail[1].length) + `${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
-    }
-    const halves = s.split('::');
-    if (halves.length > 2) return null;
-    const left = halves[0] ? halves[0].split(':') : [];
-    const right = halves.length === 2 && halves[1] ? halves[1].split(':') : [];
-    const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
-    const groups = [...left, ...Array(Math.max(0, fill)).fill('0'), ...right].map(g => Number.parseInt(g || '0', 16));
-    return groups.length === 8 && groups.every(g => Number.isInteger(g) && g >= 0 && g <= 0xffff) ? groups : null;
-}
-
-/**
- * Is this address one a server-side fetch must never reach?
- *
- * @param {string} ip
- * @returns {boolean}
- */
-export function isBlockedAddress(ip) {
-    const kind = net.isIP(String(ip || ''));
-    if (kind === 4) return v4Blocked(ip);
-    if (kind !== 6) return true;
-    const g = v6Groups(ip);
-    if (!g) return true;
-    const embeddedV4 = () => `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    if (g.every(x => x === 0)) return true;                                   // ::
-    if (g.slice(0, 7).every(x => x === 0) && g[7] === 1) return true;         // ::1
-    if (g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return v4Blocked(embeddedV4()); // ::ffff:a.b.c.d
-    if (g.slice(0, 4).every(x => x === 0) && g[4] === 0xffff && g[5] === 0) return true;      // ::ffff:0:0/96 (SIIT)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g[2] === 1) return true;          // 64:ff9b:1::/48 (local NAT64)
-    if (g[0] === 0x100 && g[1] === 0 && g[2] === 0 && g[3] === 0) return true; // 100::/64 (discard)
-    if (g.slice(0, 6).every(x => x === 0)) return true;                       // ::a.b.c.d (deprecated compat)
-    if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every(x => x === 0)) return v4Blocked(embeddedV4()); // NAT64
-    if ((g[0] & 0xfe00) === 0xfc00) return true;                              // fc00::/7 unique local
-    if ((g[0] & 0xffc0) === 0xfe80) return true;                              // fe80::/10 link-local
-    if ((g[0] & 0xffc0) === 0xfec0) return true;                              // fec0::/10 site-local
-    if ((g[0] & 0xff00) === 0xff00) return true;                              // multicast
-    if (g[0] === 0x2001 && g[1] === 0x0db8) return true;                      // documentation
-    if (g[0] === 0x2002) return v4Blocked(`${g[1] >> 8}.${g[1] & 255}.${g[2] >> 8}.${g[2] & 255}`); // 6to4
-    if (g[0] === 0x2001 && g[1] === 0) return true;                           // Teredo
-    return false;
-}
-
-/** Canonical text for an address, so the two spellings of one IPv6 address compare equal. */
-function canon(ip) {
-    const s = String(ip || '').toLowerCase().split('%')[0];
-    if (net.isIP(s) !== 6) return s;
-    const g = v6Groups(s);
-    if (g && g.slice(0, 5).every(x => x === 0) && g[5] === 0xffff) return `${g[6] >> 8}.${g[6] & 255}.${g[7] >> 8}.${g[7] & 255}`;
-    return g ? g.map(x => x.toString(16)).join(':') : s;
-}
-
-/**
- * This machine's own addresses - every interface, public ones included, plus
- * the unspecified ones. A server must never fetch from itself, whatever its
- * public address resolves as.
- */
-export function ownAddresses(interfaces = os.networkInterfaces()) {
-    const out = new Set(['0.0.0.0', canon('::')]);
-    for (const list of Object.values(interfaces || {})) {
-        for (const a of list || []) if (a?.address) out.add(canon(a.address));
-    }
-    return out;
-}
-
-/**
- * Resolve a host and check every address.
- *
- * @returns {Promise<{address: string, family: number}>} the address to connect to
- */
-export async function resolvePublic(hostname, {allowPrivate = false, lookup = dns.promises.lookup, own = ownAddresses()} = {}) {
-    const host = String(hostname || '').replace(/^\[|\]$/g, '');
-    let addrs;
-    if (net.isIP(host)) addrs = [{address: host, family: net.isIP(host)}];
-    else {
-        try { addrs = await lookup(host, {all: true, verbatim: true}); } catch (err) { throw new FetchRefused(`${host} could not be found (${err.code || err.message}).`); }
-    }
-    if (!addrs?.length) throw new FetchRefused(`${host} could not be found.`);
-    if (!allowPrivate) {
-        const bad = addrs.find(a => isBlockedAddress(a.address));
-        if (bad) throw new FetchRefused(`${host} points at a private or reserved address (${bad.address}) - refused.`);
-        const self = addrs.find(a => own.has(canon(a.address)));
-        if (self) throw new FetchRefused(`${host} points at this server itself (${self.address}) - refused.`);
-    }
-    return addrs[0];
-}
-
 /** May this URL be fetched at all (before any DNS)? Returns the URL, or throws. */
 export function checkUrl(raw, {hosts = [], allowPrivate = false} = {}) {
     let u;
@@ -209,56 +84,12 @@ export async function fetchMedia(url, opts = {}) {
     throw new FetchRefused('Too many redirects.');
 }
 
-function request(u, {address, family, deadline, maxBytes, signal}) {
-    return new Promise((resolve, reject) => {
-        const lib = u.protocol === 'https:' ? https : http;
-        let done = false;
-        const finish = (fn, v) => { if (!done) { done = true; clearTimeout(timer); fn(v); } };
-        const req = lib.request({
-            protocol: u.protocol,
-            hostname: u.hostname,
-            port: u.port || undefined,
-            path: `${u.pathname}${u.search}`,
-            method: 'GET',
-            headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'},
-            // Connect to the address that was checked - not to a fresh lookup.
-            lookup: (_host, options, cb) => {
-                if (options?.all) cb(null, [{address, family}]);
-                else cb(null, address, family);
-            },
-            agent: false,
-            signal
-        }, (res) => {
-            const status = res.statusCode || 0;
-            if (status >= 300 && status < 400 && res.headers.location) {
-                res.resume();
-                return finish(resolve, {redirect: String(res.headers.location)});
-            }
-            if (status !== 200) {
-                res.resume();
-                return finish(reject, Object.assign(new Error(`The old site answered ${status}.`), {code: 'EHTTP', status}));
-            }
-            const declared = Number(res.headers['content-length']);
-            if (Number.isFinite(declared) && declared > maxBytes) {
-                res.destroy();
-                return finish(reject, new FetchRefused(`The file is ${Math.round(declared / 1048576)} MB - over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-            }
-            const chunks = [];
-            let size = 0;
-            res.on('data', (c) => {
-                size += c.length;
-                if (size > maxBytes) {
-                    res.destroy();
-                    finish(reject, new FetchRefused(`The file is over the ${Math.round(maxBytes / 1048576)} MB limit.`));
-                    return;
-                }
-                chunks.push(c);
-            });
-            res.on('end', () => finish(resolve, {buffer: Buffer.concat(chunks), contentType: String(res.headers['content-type'] || '')}));
-            res.on('error', (err) => finish(reject, err));
-        });
-        const timer = setTimeout(() => { req.destroy(); finish(reject, Object.assign(new Error('The download took too long.'), {code: 'ETIMEDOUT'})); }, Math.max(1, deadline - Date.now()));
-        req.on('error', (err) => finish(reject, err));
-        req.end();
+async function request(u, {address, family, deadline, maxBytes, signal}) {
+    const res = await pinnedRequest(u, {
+        address, family, deadline, maxBytes, signal,
+        headers: {'user-agent': 'DommaCMS-WordPress-Import/1', accept: '*/*'}
     });
+    if (res.redirect) return {redirect: res.redirect};
+    if (res.status !== 200) throw Object.assign(new Error(`The old site answered ${res.status}.`), {code: 'EHTTP', status: res.status});
+    return {buffer: res.buffer, contentType: String(res.headers['content-type'] || '')};
 }