dsh-mobile 0.6.13 → 0.6.14

package/lib/index.d.mts

@@ -1949,7 +1949,7 @@ interface OriginConfigurationStatus {
 }
 /** Require a public HTTPS origin; custom external ports are supported. */
 export declare function validateOriginPublicOrigin(value: unknown): string;
-/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+/** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 export declare function validateOriginListenHost(value: unknown): string;
 export declare function validateOriginListenPort(value: unknown): number;
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */

package/lib/index.mjs

@@ -11754,12 +11754,16 @@ const MIN_ORIGIN_LISTEN_PORT = 1024;
 const RESERVED_LAN_GATEWAY_PORT$1 = 3443;
 /** DSH's own WebServer port; the plugin cannot function while it is taken. */
 const RESERVED_DSH_WEB_PORT = 3080;
-const PRIVATE_NETWORKS = [
-	"10.0.0.0/8",
-	"172.16.0.0/12",
-	"192.168.0.0/16"
-].map(parseCidr);
-const TRUSTED_NETWORKS = [...PRIVATE_NETWORKS, parseCidr("127.0.0.0/8")];
+const TRUSTED_NETWORKS = [
+	...[
+		"10.0.0.0/8",
+		"172.16.0.0/12",
+		"192.168.0.0/16",
+		"fc00::/7"
+	].map(parseCidr),
+	parseCidr("127.0.0.0/8"),
+	parseCidr("::1/128")
+];
 /** Require a public HTTPS origin; custom external ports are supported. */
 function validateOriginPublicOrigin(value) {
 	if (typeof value !== "string" || value.length > 512 || /[\s\u0000-\u001f\u007f\\@?#]/u.test(value)) throw new Error("origin_public_origin_invalid");
@@ -11781,10 +11785,15 @@ function validateOriginPublicOrigin(value) {
 	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
 	return url.origin;
 }
-/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+/** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 function validateOriginListenHost(value) {
-	if (typeof value !== "string" || isIP(value) !== 4 || !isLoopbackAddress(value) && !addressAllowed(value, PRIVATE_NETWORKS)) throw new Error("origin_listen_host_invalid");
-	return value;
+	const addressFamily = isIP(value);
+	if (typeof value !== "string" || value.includes("%") || addressFamily === 0 || !addressAllowed(value, TRUSTED_NETWORKS.filter((range) => range.bits === (addressFamily === 6 ? 128 : 32)))) throw new Error("origin_listen_host_invalid");
+	return addressFamily === 6 ? new URL("http://[" + value + "]").hostname.slice(1, -1) : value;
+}
+/** Format a validated backend listener, including the brackets required by IPv6 URLs. */
+function formatOriginBackendOrigin(listenHost, listenPort) {
+	return "http://" + (isIP(listenHost) === 6 ? "[" + listenHost + "]" : listenHost) + ":" + String(listenPort);
 }
 function validateOriginListenPort(value) {
 	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
@@ -11793,14 +11802,15 @@ function validateOriginListenPort(value) {
 }
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
 function validateOriginAllowedCidrs(value, listenHost) {
-	const input = value === void 0 && isLoopbackAddress(listenHost) ? ["127.0.0.0/8"] : value;
+	const addressFamily = isIP(listenHost);
+	const input = value === void 0 && isLoopbackAddress(listenHost) ? [addressFamily === 6 ? "::1/128" : "127.0.0.0/8"] : value;
 	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
 	const cidrs = [];
 	for (const entry of input) {
-		if (typeof entry !== "string" || entry.length > 64 || isIP(entry.split("/")[0] ?? "") !== 4) throw new Error("origin_allowed_cidrs_invalid");
+		if (typeof entry !== "string" || entry.length > 64 || entry.includes("%") || isIP(entry.split("/")[0] ?? "") !== addressFamily) throw new Error("origin_allowed_cidrs_invalid");
 		try {
 			const cidr = parseCidr(entry);
-			if (cidr.bits !== 32 || !TRUSTED_NETWORKS.some((range) => cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
+			if (cidr.bits !== (addressFamily === 6 ? 128 : 32) || !TRUSTED_NETWORKS.some((range) => cidr.bits === range.bits && cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
 			cidrs.push(cidr.source);
 		} catch {
 			throw new Error("origin_allowed_cidrs_invalid");
@@ -11878,7 +11888,7 @@ var OriginConfigStore = class {
 				listenHost: settings.listenHost,
 				listenPort: settings.listenPort,
 				allowedCidrs: settings.allowedCidrs,
-				backendOrigin: "http://" + settings.listenHost + ":" + String(settings.listenPort)
+				backendOrigin: formatOriginBackendOrigin(settings.listenHost, settings.listenPort)
 			},
 			storagePath: this.stateRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
@@ -12038,7 +12048,7 @@ var OriginController = class {
 			enabled: true,
 			state: "ready",
 			origin: settings.publicOrigin,
-			backendOrigin: "http://" + settings.listenHost + ":" + String(gateway.address().port)
+			backendOrigin: formatOriginBackendOrigin(settings.listenHost, gateway.address().port)
 		});
 	}
 	async stop() {