i18ntk 3.2.0 → 3.3.0

package/utils/translate/api.js

@@ -1,39 +1,11 @@
-const https = require('https');
 const { URL } = require('url');
+const { safeHttpGet, safeHttpPost, buildGoogleTranslateUrl } = require('./safe-network');
 
 const DEFAULT_CONCURRENCY = 3;
 const DEFAULT_RETRY_COUNT = 3;
 const DEFAULT_RETRY_DELAY = 1000;
 const MAX_BACKOFF_DELAY = 30000;
 
-function httpGet(urlString, timeout = 15000) {
-  return new Promise((resolve) => {
-    const url = new URL(urlString);
-    if (url.protocol !== 'https:') {
-      resolve({ ok: false, error: 'ProtocolError', message: 'Only HTTPS requests are supported' });
-      return;
-    }
-    const req = https.get(urlString, { headers: { 'User-Agent': 'i18ntk/3.2.0' } }, (res) => {
-      let data = '';
-      res.on('data', (chunk) => { data += chunk; });
-      res.on('end', () => {
-        try {
-          const parsed = JSON.parse(data);
-          resolve({ ok: true, data: parsed, status: res.statusCode });
-        } catch (e) {
-          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
-        }
-      });
-    });
-    req.setTimeout(timeout, () => {
-      req.destroy();
-      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
-    });
-    req.on('error', (e) => {
-      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
-    });
-  });
-}
 
 function extractTranslation(result) {
   if (result && Array.isArray(result) && result[0]) {
@@ -46,6 +18,154 @@ function extractTranslation(result) {
   return null;
 }
 
+function normalizeProvider(provider) {
+  const value = String(provider || process.env.I18NTK_TRANSLATE_PROVIDER || 'google').trim().toLowerCase();
+  if (value === 'deepl-free' || value === 'deepl-pro') return 'deepl';
+  if (value === 'libre' || value === 'libretranslate') return 'libretranslate';
+  if (value === 'google' || value === 'gtx') return 'google';
+  return value;
+}
+
+function normalizeDeepLLanguage(code) {
+  return String(code || '').replace('-', '_').toUpperCase();
+}
+
+function getDeepLApiUrl(options = {}) {
+  if (options.deeplApiUrl) return options.deeplApiUrl;
+  if (process.env.DEEPL_API_URL) return process.env.DEEPL_API_URL;
+  return 'https://api-free.deepl.com/v2/translate';
+}
+
+function isEnabled(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function getDeepLAllowedHosts(url, options = {}) {
+  const hosts = ['api-free.deepl.com', 'api.deepl.com'];
+  if (options.allowCustomTranslateHosts || isEnabled(process.env.I18NTK_ALLOW_CUSTOM_TRANSLATE_HOSTS)) {
+    hosts.push(new URL(url).hostname);
+  }
+  return [...new Set(hosts)];
+}
+
+function parseProviderUrl(url, provider) {
+  try {
+    return { ok: true, parsed: new URL(url) };
+  } catch (error) {
+    return {
+      ok: false,
+      error: 'InvalidProviderUrl',
+      message: `${provider} provider URL is invalid: ${error.message}`,
+    };
+  }
+}
+
+function extractDeepLTranslation(data) {
+  const value = data && Array.isArray(data.translations) && data.translations[0] && data.translations[0].text;
+  return typeof value === 'string' && value.trim() ? value : null;
+}
+
+function getLibreTranslateUrl(options = {}) {
+  if (options.libreTranslateUrl) return options.libreTranslateUrl;
+  if (process.env.LIBRETRANSLATE_URL) return process.env.LIBRETRANSLATE_URL;
+  return 'https://libretranslate.com/translate';
+}
+
+function getLibreTranslateAllowedHosts(url) {
+  return [...new Set(['libretranslate.com', new URL(url).hostname])];
+}
+
+function extractLibreTranslateTranslation(data) {
+  const value = data && data.translatedText;
+  return typeof value === 'string' && value.trim() ? value : null;
+}
+
+function buildProviderRequest(text, targetLang, options = {}) {
+  const provider = normalizeProvider(options.provider);
+  const sourceLang = options.sourceLang || 'en';
+
+  if (provider === 'google') {
+    return {
+      provider,
+      method: 'GET',
+      url: buildGoogleTranslateUrl(text, sourceLang, targetLang),
+      extract: extractTranslation,
+    };
+  }
+
+  if (provider === 'deepl') {
+    const apiKey = options.deeplApiKey || process.env.DEEPL_API_KEY;
+    if (!apiKey) {
+      return {
+        provider,
+        error: 'MissingApiKey',
+        message: 'DeepL provider requires DEEPL_API_KEY in the environment or deeplApiKey in options.',
+      };
+    }
+
+    const url = getDeepLApiUrl(options);
+    const parsedUrl = parseProviderUrl(url, 'DeepL');
+    if (!parsedUrl.ok) return { provider, error: parsedUrl.error, message: parsedUrl.message };
+
+    return {
+      provider,
+      method: 'POST',
+      url,
+      body: {
+        text: [text],
+        target_lang: normalizeDeepLLanguage(targetLang),
+        source_lang: normalizeDeepLLanguage(sourceLang),
+      },
+      requestOptions: {
+        provider,
+        allowedHosts: getDeepLAllowedHosts(url, options),
+        allowedPaths: ['/v2/translate'],
+        headers: {
+          Authorization: `DeepL-Auth-Key ${apiKey}`,
+        },
+      },
+      extract: extractDeepLTranslation,
+    };
+  }
+
+  if (provider === 'libretranslate') {
+    const apiKey = options.libreTranslateApiKey || process.env.LIBRETRANSLATE_API_KEY || '';
+    const url = getLibreTranslateUrl(options);
+    const parsedUrl = parseProviderUrl(url, 'LibreTranslate');
+    if (!parsedUrl.ok) return { provider, error: parsedUrl.error, message: parsedUrl.message };
+
+    const params = new URLSearchParams({
+      q: text,
+      source: sourceLang,
+      target: targetLang,
+      format: 'text',
+    });
+    if (apiKey) params.set('api_key', apiKey);
+
+    return {
+      provider,
+      method: 'POST',
+      url,
+      body: params.toString(),
+      requestOptions: {
+        provider,
+        allowedHosts: getLibreTranslateAllowedHosts(url),
+        allowedPaths: ['/translate'],
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+      },
+      extract: extractLibreTranslateTranslation,
+    };
+  }
+
+  return {
+    provider,
+    error: 'UnsupportedProvider',
+    message: `Unsupported translation provider "${provider}". Use google, deepl, or libretranslate.`,
+  };
+}
+
 function detectRateLimitError(result) {
   if (!result.ok && result.status === 429) return true;
   if (result.ok && result.status === 429) return true;
@@ -61,6 +181,8 @@ async function translateText(text, targetLang, options = {}) {
     retryDelay = DEFAULT_RETRY_DELAY,
     customFn,
     timeout = 15000,
+    httpGet = safeHttpGet,
+    httpPost = safeHttpPost,
   } = options;
 
   if (!text || text.trim().length === 0) return { ok: true, translated: text };
@@ -74,14 +196,10 @@ async function translateText(text, targetLang, options = {}) {
     }
   }
 
-  const params = new URLSearchParams({
-    client: 'gtx',
-    sl: sourceLang,
-    tl: targetLang,
-    dt: 't',
-    q: text,
-  });
-  const url = `https://translate.googleapis.com/translate_a/single?${params.toString()}`;
+  const request = buildProviderRequest(text, targetLang, { ...options, sourceLang });
+  if (request.error) {
+    return { ok: false, translated: null, error: request.error, message: request.message };
+  }
 
   let lastError = null;
   for (let attempt = 0; attempt < retryCount; attempt++) {
@@ -90,10 +208,12 @@ async function translateText(text, targetLang, options = {}) {
       await new Promise((resolve) => setTimeout(resolve, delay));
     }
 
-    const result = await httpGet(url, timeout);
+    const result = request.method === 'POST'
+      ? await httpPost(request.url, request.body, { ...(request.requestOptions || {}), timeout })
+      : await httpGet(request.url, timeout);
 
     if (result.ok) {
-      const translated = extractTranslation(result.data);
+      const translated = request.extract(result.data);
       if (translated !== null && translated !== text) {
         return { ok: true, translated };
       }
@@ -101,7 +221,7 @@ async function translateText(text, targetLang, options = {}) {
         return { ok: true, translated: text };
       }
       if (result.status === 429 || (translated === null && result.status >= 400)) {
-        lastError = { error: 'RateLimited', message: 'Google Translate rate limit hit' };
+        lastError = { error: 'RateLimited', message: `${request.provider} rate limit hit` };
         continue;
       }
     }
@@ -165,8 +285,11 @@ async function translateBatch(batch, targetLang, options = {}) {
 }
 
 module.exports = {
-  httpGet,
   extractTranslation,
+  extractDeepLTranslation,
+  extractLibreTranslateTranslation,
+  buildProviderRequest,
+  normalizeProvider,
   detectRateLimitError,
   translateText,
   translateBatch,

package/utils/translate/safe-network.js

@@ -0,0 +1,280 @@
+const https = require('https');
+const { URL } = require('url');
+const { logger } = require('../logger');
+
+const MAX_RESPONSE_SIZE = 100 * 1024;
+const ALLOWED_HOSTS = ['translate.googleapis.com', 'api-free.deepl.com', 'api.deepl.com', 'libretranslate.com'];
+const ALLOWED_PATHS = ['/translate_a/single', '/v2/translate', '/translate'];
+const USER_AGENT = 'i18ntk/3.3.0';
+
+function isEnabled(value) {
+  return ['1', 'true', 'yes', 'on'].includes(String(value || '').trim().toLowerCase());
+}
+
+function isPrivateIPv4(hostname) {
+  const parts = String(hostname || '').split('.');
+  if (parts.length !== 4) return false;
+
+  const bytes = parts.map((part) => {
+    if (!/^\d+$/.test(part)) return null;
+    const value = Number(part);
+    return value >= 0 && value <= 255 ? value : null;
+  });
+  if (bytes.some((part) => part === null)) return false;
+
+  const [a, b] = bytes;
+  return a === 10
+    || a === 127
+    || (a === 172 && b >= 16 && b <= 31)
+    || (a === 192 && b === 168)
+    || (a === 169 && b === 254)
+    || a === 0;
+}
+
+function isPrivateHost(hostname) {
+  const normalized = String(hostname || '').trim().toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+  return normalized === 'localhost'
+    || normalized.endsWith('.localhost')
+    || normalized === '::1'
+    || normalized.startsWith('fe80:')
+    || normalized.startsWith('fc')
+    || normalized.startsWith('fd')
+    || isPrivateIPv4(normalized);
+}
+
+function redactUrlForLog(urlString) {
+  try {
+    const parsed = new URL(urlString);
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString();
+  } catch (e) {
+    return '[invalid-url]';
+  }
+}
+
+function validateUrl(urlString, options = {}) {
+  if (!urlString || typeof urlString !== 'string') {
+    return { valid: false, error: 'InvalidUrl', message: 'URL must be a non-empty string' };
+  }
+
+  try {
+    const parsed = new URL(urlString);
+
+    if (parsed.protocol !== 'https:') {
+      return { valid: false, error: 'ProtocolError', message: 'Only HTTPS protocol is supported' };
+    }
+
+    const allowPrivateHosts = options.allowPrivateHosts || isEnabled(process.env.I18NTK_ALLOW_PRIVATE_TRANSLATE_URLS);
+    if (!allowPrivateHosts && isPrivateHost(parsed.hostname)) {
+      return {
+        valid: false,
+        error: 'PrivateHostNotAllowed',
+        message: `Host "${parsed.hostname}" is private or local. Set I18NTK_ALLOW_PRIVATE_TRANSLATE_URLS=1 only for trusted local testing.`,
+      };
+    }
+
+    const allowedHosts = options.allowedHosts || ALLOWED_HOSTS;
+    const allowedPaths = options.allowedPaths || ALLOWED_PATHS;
+
+    if (!allowedHosts.includes(parsed.hostname)) {
+      return { valid: false, error: 'HostNotAllowed', message: `Host "${parsed.hostname}" is not in the allowed list` };
+    }
+
+    if (!allowedPaths.includes(parsed.pathname)) {
+      return { valid: false, error: 'PathNotAllowed', message: `Path "${parsed.pathname}" is not in the allowed list` };
+    }
+
+    const suspiciousParams = ['redirect', 'callback', 'jsonp', 'script', 'src', 'eval', 'exec', 'url'];
+    for (const key of parsed.searchParams.keys()) {
+      const lower = key.toLowerCase();
+      if (suspiciousParams.some((s) => lower.includes(s))) {
+        return { valid: false, error: 'SuspiciousParam', message: `Query parameter "${key}" is not allowed` };
+      }
+      const value = parsed.searchParams.get(key);
+      if (value && (value.includes('<script') || value.includes('javascript:') || value.includes('data:'))) {
+        return { valid: false, error: 'SuspiciousParamValue', message: `Query parameter "${key}" contains potentially dangerous content` };
+      }
+    }
+
+    return { valid: true, url: parsed };
+  } catch (e) {
+    return { valid: false, error: 'UrlParseError', message: `Failed to parse URL: ${e.message}` };
+  }
+}
+
+function safeHttpGet(urlString, timeout = 15000) {
+  return new Promise((resolve) => {
+    const validation = validateUrl(urlString);
+    if (!validation.valid) {
+      logger.security('warn', 'Network request blocked by safe-network', {
+        url: redactUrlForLog(urlString),
+        reason: validation.error,
+        detail: validation.message,
+      });
+      resolve({ ok: false, error: validation.error, message: validation.message });
+      return;
+    }
+
+    const req = https.get(urlString, { headers: { 'User-Agent': USER_AGENT } }, (res) => {
+      let data = '';
+      let sizeExceeded = false;
+
+      res.on('data', (chunk) => {
+        if (data.length + chunk.length > MAX_RESPONSE_SIZE) {
+          if (!sizeExceeded) {
+            sizeExceeded = true;
+            req.destroy();
+            logger.security('warn', 'Network response size limit exceeded', {
+              url: redactUrlForLog(urlString),
+              limit: MAX_RESPONSE_SIZE,
+            });
+            resolve({ ok: false, error: 'ResponseTooLarge', message: `Response exceeds ${MAX_RESPONSE_SIZE} bytes limit` });
+          }
+          return;
+        }
+        data += chunk;
+      });
+
+      res.on('end', () => {
+        if (sizeExceeded) return;
+        try {
+          const parsed = JSON.parse(data);
+          logger.security('info', 'Network request completed', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: true, data: parsed, status: res.statusCode });
+        } catch (e) {
+          logger.security('warn', 'Network response parse error', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
+        }
+      });
+    });
+
+    req.setTimeout(timeout, () => {
+      req.destroy();
+      logger.security('warn', 'Network request timed out', { timeoutMs: timeout });
+      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
+    });
+
+    req.on('error', (e) => {
+      logger.security('warn', 'Network request error', {
+        code: e.code,
+        message: e.message,
+      });
+      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
+    });
+  });
+}
+
+function safeHttpPost(urlString, body, options = {}) {
+  const timeout = options.timeout || 15000;
+
+  return new Promise((resolve) => {
+    const validation = validateUrl(urlString, {
+      allowedHosts: options.allowedHosts,
+      allowedPaths: options.allowedPaths,
+      allowPrivateHosts: options.allowPrivateHosts,
+    });
+    if (!validation.valid) {
+      logger.security('warn', 'Network request blocked by safe-network', {
+        url: redactUrlForLog(urlString),
+        reason: validation.error,
+        detail: validation.message,
+      });
+      resolve({ ok: false, error: validation.error, message: validation.message });
+      return;
+    }
+
+    const payload = typeof body === 'string' ? body : JSON.stringify(body || {});
+    const headers = {
+      'User-Agent': USER_AGENT,
+      'Content-Type': options.contentType || 'application/json',
+      'Content-Length': Buffer.byteLength(payload),
+      ...(options.headers || {}),
+    };
+
+    const req = https.request(validation.url, { method: 'POST', headers }, (res) => {
+      let data = '';
+      let sizeExceeded = false;
+
+      res.on('data', (chunk) => {
+        if (data.length + chunk.length > MAX_RESPONSE_SIZE) {
+          if (!sizeExceeded) {
+            sizeExceeded = true;
+            req.destroy();
+            logger.security('warn', 'Network response size limit exceeded', {
+              url: redactUrlForLog(urlString),
+              limit: MAX_RESPONSE_SIZE,
+            });
+            resolve({ ok: false, error: 'ResponseTooLarge', message: `Response exceeds ${MAX_RESPONSE_SIZE} bytes limit` });
+          }
+          return;
+        }
+        data += chunk;
+      });
+
+      res.on('end', () => {
+        if (sizeExceeded) return;
+        try {
+          const parsed = JSON.parse(data || '{}');
+          logger.security('info', 'Network request completed', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: res.statusCode >= 200 && res.statusCode < 300, data: parsed, status: res.statusCode });
+        } catch (e) {
+          logger.security('warn', 'Network response parse error', {
+            status: res.statusCode,
+            responseLength: data.length,
+          });
+          resolve({ ok: false, error: 'ParseError', raw: data.substring(0, 500), status: res.statusCode });
+        }
+      });
+    });
+
+    req.setTimeout(timeout, () => {
+      req.destroy();
+      logger.security('warn', 'Network request timed out', { timeoutMs: timeout });
+      resolve({ ok: false, error: 'TimeoutError', message: 'Request timed out' });
+    });
+
+    req.on('error', (e) => {
+      logger.security('warn', 'Network request error', {
+        code: e.code,
+        message: e.message,
+      });
+      resolve({ ok: false, error: e.code || 'NetworkError', message: e.message });
+    });
+
+    req.write(payload);
+    req.end();
+  });
+}
+
+function buildGoogleTranslateUrl(text, sourceLang, targetLang) {
+  const params = new URLSearchParams({
+    client: 'gtx',
+    sl: sourceLang,
+    tl: targetLang,
+    dt: 't',
+    q: text,
+  });
+  return `https://translate.googleapis.com/translate_a/single?${params.toString()}`;
+}
+
+module.exports = {
+  safeHttpGet,
+  safeHttpPost,
+  buildGoogleTranslateUrl,
+  validateUrl,
+  isPrivateHost,
+  redactUrlForLog,
+  MAX_RESPONSE_SIZE,
+  ALLOWED_HOSTS,
+  ALLOWED_PATHS,
+};