nuxt-og-image 6.5.3 → 6.7.0

package/dist/runtime/server/og-image/bindings/takumi/node-dev.js

@@ -17,7 +17,10 @@ parentPort.on('message', async ({ id, type, newFonts, nodes, options }) => {
     const fontWarnings = []
     for (const font of (newFonts || [])) {
       try {
-        await renderer.loadFont({
+        const registerFont = renderer.registerFont || renderer.loadFont
+        if (typeof registerFont !== 'function')
+          throw new Error('renderer does not expose loadFont/registerFont')
+        await registerFont.call(renderer, {
           name: font.name,
           data: font.data,
           weight: font.weight,
@@ -127,6 +130,9 @@ class RendererWorkerProxy {
     this.allFonts.push(font);
     this.pendingFonts.push(font);
   }
+  registerFont(font) {
+    this.loadFont(font);
+  }
   render(nodes, options) {
     ensureWorker();
     let fontsToSend;

package/dist/runtime/server/og-image/core/plugins/imageSrc.js

@@ -120,8 +120,8 @@ export default defineTransformer([
       let src = node.props.src;
       if (src.startsWith("data:"))
         return;
-      if (src.endsWith(".webp")) {
-        logger.warn("Using WebP images with Satori is not supported. Please consider switching image format or use the chromium renderer.", src);
+      if (ctx.renderer.name === "satori" && src.endsWith(".webp")) {
+        logger.warn("Using WebP images with Satori is not supported. Please consider switching image format or use the takumi or browser renderer.", src);
       }
       const isRelative = src.startsWith("/");
       if (!isRelative)

package/dist/runtime/server/og-image/fonts.d.ts

@@ -42,6 +42,10 @@ export declare function loadAllFonts(event: H3Event, options: LoadFontsOptions):
 /**
  * Load additional fonts specified via defineOgImage({ fonts: [...] }).
  * Only object format ({ name, weight, path }) with a path is supported.
+ *
+ * Field values arrive from the attacker-controlled `fonts` URL param, so each is
+ * parsed at this boundary (require string name/path, coerce weight) and the
+ * array is bounded before any font is fetched.
  */
 export declare function loadDefinedFonts(event: OgImageRenderEventContext, fontDefs: any[]): Promise<RuntimeFontConfig[]>;
 export interface LoadFontsForRendererOptions extends LoadFontsOptions {

package/dist/runtime/server/og-image/fonts.js

@@ -172,15 +172,31 @@ export async function loadAllFonts(event, options) {
   }
   return loaded;
 }
+const MAX_DEFINED_FONTS = 10;
+const MAX_FONT_PATH_LENGTH = 2048;
+function isDataUri(path) {
+  return path.trimStart().toLowerCase().startsWith("data:");
+}
+function normalizeFontWeight(weight) {
+  const n = typeof weight === "number" ? weight : typeof weight === "string" ? Number(weight) : Number.NaN;
+  if (!Number.isFinite(n))
+    return 400;
+  return Math.min(Math.max(Math.round(n), 1), 1e3);
+}
 export async function loadDefinedFonts(event, fontDefs) {
   const results = [];
-  for (const def of fontDefs) {
-    if (!def || typeof def !== "object" || !def.path)
+  const defs = Array.isArray(fontDefs) ? fontDefs : [];
+  if (import.meta.dev && defs.length > MAX_DEFINED_FONTS)
+    logger.warn(`defineOgImage fonts capped at ${MAX_DEFINED_FONTS}; ${defs.length - MAX_DEFINED_FONTS} ignored.`);
+  for (const def of defs.slice(0, MAX_DEFINED_FONTS)) {
+    if (!def || typeof def !== "object")
+      continue;
+    const name = typeof def.name === "string" ? def.name.trim() : "";
+    const path = typeof def.path === "string" ? def.path : "";
+    if (!name || !path || path.length > MAX_FONT_PATH_LENGTH && !isDataUri(path))
       continue;
-    const name = def.name;
-    const weight = def.weight || 400;
+    const weight = normalizeFontWeight(def.weight);
     const style = def.style === "italic" ? "italic" : "normal";
-    const path = def.path;
     const fontConfig = { family: name, weight, style, src: path, localPath: path };
     const data = await resolve(event.e, fontConfig).catch(() => null);
     if (data) {

package/dist/runtime/server/og-image/satori/instances.d.ts

@@ -1,5 +1,4 @@
 import type _satori from 'satori';
-import type _sharp from 'sharp';
 export declare function getResvg(): Promise<any>;
 export declare function getSatori(): Promise<typeof _satori>;
-export declare function getSharp(): Promise<typeof _sharp>;
+export declare function getSharp(): Promise<import("sharp").SharpConstructor>;

package/dist/runtime/server/og-image/takumi/renderer.js

@@ -1,5 +1,6 @@
 import { defu } from "defu";
 import { withBase } from "ufo";
+import compatibility from "#og-image/compatibility";
 import { logger } from "../../../logger.js";
 import { fetchLocalAsset } from "../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
@@ -98,25 +99,52 @@ function dedupeFontsByBinary(fonts) {
   }
   return result;
 }
-async function loadFontsIntoRenderer(state, fonts) {
-  for (const entry of dedupeFontsByBinary(fonts)) {
+function toUint8Array(data) {
+  if (data instanceof Uint8Array)
+    return data;
+  if (data instanceof ArrayBuffer)
+    return new Uint8Array(data);
+  return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+}
+function createFontDescriptor(entry, includeKey = false) {
+  return {
+    ...includeKey ? { key: entry.binaryKey } : {},
+    name: entry.family,
+    data: toUint8Array(entry.data),
+    ...entry.weight !== void 0 ? { weight: entry.weight } : {},
+    ...entry.style ? { style: entry.style } : {}
+  };
+}
+function addLoadedFamilies(state, entry, registeredFamilies) {
+  if (Array.isArray(registeredFamilies) && registeredFamilies.length) {
+    for (const family of registeredFamilies) {
+      const name = family?.name;
+      if (typeof name === "string")
+        state.loadedFamilies.add(name);
+    }
+  } else {
+    state.loadedFamilies.add(entry.family);
+  }
+}
+async function loadFontsIntoRenderer(state, entries) {
+  for (const entry of entries) {
     if (state.loadedFontKeys.has(entry.binaryKey))
       continue;
-    const fontData = entry.data instanceof ArrayBuffer ? new Uint8Array(entry.data) : Uint8Array.from(entry.data);
     try {
-      await state.renderer.loadFont({
-        name: entry.family,
-        data: fontData,
-        ...entry.weight !== void 0 ? { weight: entry.weight } : {},
-        style: entry.style
-      });
-      state.loadedFamilies.add(entry.family);
+      const registeredFamilies = await state.renderer.loadFont(createFontDescriptor(entry));
+      addLoadedFamilies(state, entry, registeredFamilies);
     } catch (err) {
-      logger.warn(`Failed to load font "${entry.family}" into takumi renderer: ${err.message}`);
+      logger.warn(`Failed to load font "${entry.family}" with takumi renderer: ${err.message}`);
     }
     state.loadedFontKeys.add(entry.binaryKey);
   }
 }
+function normalizeImageSources(images) {
+  return (images || []).map((image) => ({
+    src: image.src,
+    data: image.data instanceof Uint8Array ? image.data : new Uint8Array(image.data)
+  }));
+}
 function lookupFontFamily(family, loadedFamilies) {
   if (loadedFamilies.has(family))
     return family;
@@ -155,10 +183,12 @@ function rewriteFontFamilies(node, loadedFamilies, subsetChains) {
 }
 async function createImage(event, format) {
   const { options, timings } = event;
+  const isTakumiV2 = compatibility.takumiVersion === 2;
   const { fontFamilyOverride, defaultFont } = getDefaultFontFamily(options);
   const nodes = await createTakumiNodes(event);
   const codepoints = extractCodepoints(nodes);
   const fonts = await timings.measure("font-load", () => loadFontsForRenderer(event, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), preferStatic: true, component: options.component, fontFamilyOverride: fontFamilyOverride || defaultFont, codepoints }));
+  const fontEntries = dedupeFontsByBinary(fonts);
   const hookTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
   await withTimeout(
     event._nitro.hooks.callHook("nuxt-og-image:takumi:nodes", nodes, event),
@@ -170,7 +200,12 @@ async function createImage(event, format) {
   const extractResourceUrls = await timings.measure("takumi-extract-init", () => getExtractResourceUrls());
   const resourceUrls = await extractResourceUrls(nodes);
   const baseURL = event.runtimeConfig.app.baseURL;
-  const fetchedResources = [];
+  const { images: optionImages, fetchedResources: optionFetchedResources, persistentImages, ...takumiOptions } = options.takumi || {};
+  const images = [
+    ...normalizeImageSources(optionImages),
+    ...normalizeImageSources(optionFetchedResources),
+    ...normalizeImageSources(persistentImages)
+  ];
   if (resourceUrls.length) {
     const fetchTimeout = getFetchTimeout(event.runtimeConfig);
     const headers = { "x-nuxt-og-image": "1" };
@@ -200,17 +235,17 @@ async function createImage(event, format) {
         }) ?? void 0;
       }
       if (data)
-        fetchedResources.push({ src, data: new Uint8Array(data) });
+        images.push({ src, data: new Uint8Array(data) });
     })));
   }
   const maxDpr = event.runtimeConfig.security?.maxDpr || 2;
   const maxDim = event.runtimeConfig.security?.maxDimension || 2048;
   const dpr = Math.min(Math.max(1, options.takumi?.devicePixelRatio ?? 1), maxDpr);
-  const renderOptions = defu(options.takumi, {
+  const renderOptions = defu(takumiOptions, {
     width: Math.min(Number(options.width) * dpr, maxDim),
     height: Math.min(Number(options.height) * dpr, maxDim),
     format,
-    fetchedResources,
+    ...isTakumiV2 ? { images } : { fetchedResources: images },
     devicePixelRatio: dpr
   });
   const lockTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
@@ -218,19 +253,26 @@ async function createImage(event, format) {
   return await withTakumiLock(state, lockTimeout, () => {
     endLockWait();
     return timings.measure("render-takumi", async () => {
-      await loadFontsIntoRenderer(state, fonts);
+      let loadedFamilies = state.loadedFamilies;
+      if (isTakumiV2) {
+        loadedFamilies = new Set(fontEntries.map((entry) => entry.family));
+        renderOptions.fonts = fontEntries.map((entry) => createFontDescriptor(entry, true));
+        renderOptions.fontFamilies = [...loadedFamilies];
+      } else {
+        await loadFontsIntoRenderer(state, fontEntries);
+      }
       const rootStyle = nodes.style ?? {};
       if (fontFamilyOverride) {
         const chain = subsetChains.get(fontFamilyOverride);
         if (chain) {
           rootStyle.fontFamily = chain.map((f) => `"${f}"`).join(", ");
-        } else if (state.loadedFamilies.has(fontFamilyOverride)) {
+        } else if (loadedFamilies.has(fontFamilyOverride)) {
           rootStyle.fontFamily = fontFamilyOverride;
         }
       }
       nodes.style = rootStyle;
-      rewriteFontFamilies(nodes, state.loadedFamilies, subsetChains);
-      return state.renderer.render(nodes, renderOptions);
+      rewriteFontFamilies(nodes, loadedFamilies, subsetChains);
+      return await state.renderer.render(nodes, renderOptions);
     });
   }, endLockWait);
 }

package/dist/runtime/server/util/ssrf.d.ts

@@ -14,11 +14,21 @@ export interface SafeFetchOptions {
     timeout: number;
     headers?: Record<string, string>;
     signal?: AbortSignal;
+    /**
+     * A host (hostname + optional port) that is exempt from `isBlockedUrl`. Used
+     * for same-origin asset fetches whose own origin may legitimately be loopback
+     * (dev) or otherwise "private" — the initial host is trusted, but any redirect
+     * that leaves it is still re-validated, closing the open-redirect SSRF where
+     * the app's own origin 30x's to an internal target.
+     */
+    trustedHost?: string;
 }
 /**
  * Fetch a URL with manual redirect handling. Each hop (including the initial
  * URL) is run through `isBlockedUrl` before the request is dispatched, so an
  * allowed origin returning a 30x to an internal IP cannot complete the SSRF.
+ * A hop whose host matches `opts.trustedHost` skips the block check (see
+ * SafeFetchOptions.trustedHost).
  *
  * Returns `null` on any failure (block, network error, non-2xx, redirect
  * limit). The caller treats null as a soft failure and falls back to the

package/dist/runtime/server/util/ssrf.js

@@ -151,7 +151,15 @@ export async function fetchWithRedirectValidation(initialUrl, opts) {
   try {
     let url = initialUrl;
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
-      if (isBlockedUrl(url))
+      let isTrusted = false;
+      if (opts.trustedHost) {
+        try {
+          isTrusted = new URL(url).host === opts.trustedHost;
+        } catch {
+          return null;
+        }
+      }
+      if (!isTrusted && isBlockedUrl(url))
         return null;
       const res = await fetch(url, {
         redirect: "manual",

package/dist/runtime/types.d.ts

@@ -153,6 +153,15 @@ export interface OgImageOptions {
     sharp?: SharpOptions & JpegOptions;
     takumi?: {
         format?: 'png' | 'jpeg' | 'webp';
+        images?: Array<{
+            src: string;
+            data: ArrayBuffer | Uint8Array;
+        }>;
+        fetchedResources?: Array<{
+            src: string;
+            data: ArrayBuffer | Uint8Array;
+        }>;
+        /** @deprecated Use `images` instead. */
         persistentImages?: Array<{
             src: string;
             data: ArrayBuffer;
@@ -229,6 +238,10 @@ export interface RuntimeCompatibilitySchema {
     emoji?: 'local' | 'fetch';
     wasm?: any;
 }
+export interface RuntimeCompatibilityMeta {
+    takumiVersion?: 1 | 2;
+}
+export type RuntimeCompatibilityPayload = Partial<Omit<RuntimeCompatibilitySchema, 'wasm'>> & RuntimeCompatibilityMeta;
 export type CompatibilityFlags = Partial<Omit<RuntimeCompatibilitySchema, 'wasm'>>;
 export interface CompatibilityFlagEnvOverrides {
     dev?: CompatibilityFlags;