nemoris 0.1.0 → 0.1.2

package/src/runtime/ssrf.js

@@ -1,102 +1,102 @@
-import { annotateError } from "./network.js";
-import {
-  inspectOutboundUrl as inspectSharedOutboundUrl,
-} from "../security/ssrf-check.js";
-export { isBlockedIpAddress } from "../security/ssrf-check.js";
-
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-
-export async function inspectOutboundUrl(rawUrl, {
-  allowedProtocols = ["http:", "https:"],
-  invalidUrlMessage = "Invalid URL.",
-  invalidProtocolMessage = "Only http:// and https:// URLs are allowed.",
-  privateAddressMessage = "Target resolves to a private/reserved IP address.",
-  loopbackOnlyMessage = "Target must resolve to a loopback address.",
-  addressPolicy,
-  allowLoopbackAddresses = false,
-  lookupImpl,
-} = {}) {
-  return inspectSharedOutboundUrl(rawUrl, {
-    lookupImpl,
-    allowedProtocols,
-    invalidUrlMessage,
-    invalidProtocolMessage,
-    privateAddressMessage,
-    loopbackOnlyMessage,
-    addressPolicy,
-    allowLoopbackAddresses,
-  });
-}
-
-export async function assertSafeOutboundUrl(rawUrl, options = {}) {
-  const result = await inspectOutboundUrl(rawUrl, options);
-  if (!result.ok) {
-    throw annotateError(new Error(result.reason), { surface: options.surface || "runtime" });
-  }
-  return result.parsedUrl;
-}
-
-function normalizeRedirectOptions(options = {}) {
-  return {
-    ...options,
-    redirect: "manual",
-  };
-}
-
-function rewriteRedirectOptions(options, status) {
-  const nextOptions = { ...options };
-  const method = String(nextOptions.method || "GET").toUpperCase();
-  if (status === 303 || ((status === 301 || status === 302) && method === "POST")) {
-    nextOptions.method = "GET";
-    delete nextOptions.body;
-  }
-  return nextOptions;
-}
-
-export async function fetchWithOutboundPolicy(rawUrl, options = {}, {
-  fetchImpl = globalThis.fetch,
-  maxRedirects = 5,
-  surface = "runtime",
-  invalidUrlMessage,
-  invalidProtocolMessage,
-  privateAddressMessage,
-  loopbackOnlyMessage,
-  addressPolicy,
-  allowLoopbackAddresses = false,
-  lookupImpl,
-} = {}) {
-  let currentUrl = rawUrl;
-  let currentOptions = normalizeRedirectOptions(options);
-
-  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
-    const parsedUrl = await assertSafeOutboundUrl(currentUrl, {
-      lookupImpl,
-      surface,
-      invalidUrlMessage,
-      invalidProtocolMessage,
-      privateAddressMessage,
-      loopbackOnlyMessage,
-      addressPolicy,
-      allowLoopbackAddresses,
-    });
-
-    const response = await fetchImpl(parsedUrl.toString(), currentOptions);
-    if (!REDIRECT_STATUSES.has(response.status)) {
-      return response;
-    }
-
-    const location = response.headers?.get?.("location");
-    if (!location) {
-      return response;
-    }
-
-    if (redirectCount >= maxRedirects) {
-      throw annotateError(new Error(`Too many redirects for ${parsedUrl.toString()}`), { surface });
-    }
-
-    currentUrl = new URL(location, parsedUrl).toString();
-    currentOptions = normalizeRedirectOptions(rewriteRedirectOptions(currentOptions, response.status));
-  }
-
-  throw annotateError(new Error("Too many redirects."), { surface });
-}
+import { annotateError } from "./network.js";
+import {
+  inspectOutboundUrl as inspectSharedOutboundUrl,
+} from "../security/ssrf-check.js";
+export { isBlockedIpAddress } from "../security/ssrf-check.js";
+
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+export async function inspectOutboundUrl(rawUrl, {
+  allowedProtocols = ["http:", "https:"],
+  invalidUrlMessage = "Invalid URL.",
+  invalidProtocolMessage = "Only http:// and https:// URLs are allowed.",
+  privateAddressMessage = "Target resolves to a private/reserved IP address.",
+  loopbackOnlyMessage = "Target must resolve to a loopback address.",
+  addressPolicy,
+  allowLoopbackAddresses = false,
+  lookupImpl,
+} = {}) {
+  return inspectSharedOutboundUrl(rawUrl, {
+    lookupImpl,
+    allowedProtocols,
+    invalidUrlMessage,
+    invalidProtocolMessage,
+    privateAddressMessage,
+    loopbackOnlyMessage,
+    addressPolicy,
+    allowLoopbackAddresses,
+  });
+}
+
+export async function assertSafeOutboundUrl(rawUrl, options = {}) {
+  const result = await inspectOutboundUrl(rawUrl, options);
+  if (!result.ok) {
+    throw annotateError(new Error(result.reason), { surface: options.surface || "runtime" });
+  }
+  return result.parsedUrl;
+}
+
+function normalizeRedirectOptions(options = {}) {
+  return {
+    ...options,
+    redirect: "manual",
+  };
+}
+
+function rewriteRedirectOptions(options, status) {
+  const nextOptions = { ...options };
+  const method = String(nextOptions.method || "GET").toUpperCase();
+  if (status === 303 || ((status === 301 || status === 302) && method === "POST")) {
+    nextOptions.method = "GET";
+    delete nextOptions.body;
+  }
+  return nextOptions;
+}
+
+export async function fetchWithOutboundPolicy(rawUrl, options = {}, {
+  fetchImpl = globalThis.fetch,
+  maxRedirects = 5,
+  surface = "runtime",
+  invalidUrlMessage,
+  invalidProtocolMessage,
+  privateAddressMessage,
+  loopbackOnlyMessage,
+  addressPolicy,
+  allowLoopbackAddresses = false,
+  lookupImpl,
+} = {}) {
+  let currentUrl = rawUrl;
+  let currentOptions = normalizeRedirectOptions(options);
+
+  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
+    const parsedUrl = await assertSafeOutboundUrl(currentUrl, {
+      lookupImpl,
+      surface,
+      invalidUrlMessage,
+      invalidProtocolMessage,
+      privateAddressMessage,
+      loopbackOnlyMessage,
+      addressPolicy,
+      allowLoopbackAddresses,
+    });
+
+    const response = await fetchImpl(parsedUrl.toString(), currentOptions);
+    if (!REDIRECT_STATUSES.has(response.status)) {
+      return response;
+    }
+
+    const location = response.headers?.get?.("location");
+    if (!location) {
+      return response;
+    }
+
+    if (redirectCount >= maxRedirects) {
+      throw annotateError(new Error(`Too many redirects for ${parsedUrl.toString()}`), { surface });
+    }
+
+    currentUrl = new URL(location, parsedUrl).toString();
+    currentOptions = normalizeRedirectOptions(rewriteRedirectOptions(currentOptions, response.status));
+  }
+
+  throw annotateError(new Error("Too many redirects."), { surface });
+}