nuxt-og-image 6.7.8 → 6.9.0

package/dist/runtime/server/util/ssrf.d.ts

@@ -10,6 +10,36 @@ export declare function expandIPv6(addr: string): number[] | null;
  * blocked outright.
  */
 export declare function isBlockedUrl(url: string): boolean;
+/** True when a resolved IP address is internal, reserved, or unparseable. */
+export declare function isBlockedAddress(address: string): boolean;
+declare const sameOriginPathBrand: unique symbol;
+/**
+ * A path that stays on the current origin when resolved against any base URL.
+ * Only `parseSameOriginPath` creates one, so a value of this type is safe to
+ * pass to a same-origin fetch or a headless browser navigation.
+ */
+export type SameOriginPath = string & {
+    readonly [sameOriginPathBrand]: true;
+};
+/**
+ * Parse an untrusted path (for example the `_path` URL option) into a
+ * same-origin path. Returns `undefined` for anything that could leave the
+ * origin: absolute URLs, other schemes, protocol-relative `//host`,
+ * backslash variants, control characters, and paths without a leading `/`
+ * (which a string concatenation with the origin turns into `origin@host`).
+ *
+ * GHSA-h5qf-97cw-2h86: an absolute `_path` navigated the browser renderer to
+ * an internal host and reflected the response into the image.
+ */
+export declare function parseSameOriginPath(input: unknown): SameOriginPath | undefined;
+/**
+ * Resolve `path` against `origin` and return the href, but only when the result
+ * stays on that origin. Returns null for a missing or unparseable origin, and for
+ * anything that resolves elsewhere. The WHATWG parser normalizes leading
+ * controls, tabs, and backslashes first, so " //127.0.0.1" resolves cross-origin
+ * and is rejected (GHSA-q8hw-4fvp-9rwv).
+ */
+export declare function resolveSameOriginUrl(path: string, origin: string | undefined): string | null;
 export interface SafeFetchOptions {
     timeout: number;
     headers?: Record<string, string>;
@@ -35,3 +65,4 @@ export interface SafeFetchOptions {
  * usual missing-asset behaviour.
  */
 export declare function fetchWithRedirectValidation(initialUrl: string, opts: SafeFetchOptions): Promise<ArrayBuffer | null>;
+export {};

package/dist/runtime/server/util/ssrf.js

@@ -1,4 +1,6 @@
+import { guardedFetch } from "#og-image/bindings/fetch";
 const RE_IPV6_BRACKETS = /^\[|\]$/g;
+const RE_TRAILING_DOTS = /\.+$/;
 const RE_DIGIT_ONLY = /^\d+$/;
 const RE_INT_IP = /^(?:0x[\da-f]+|\d+)$/i;
 const RE_HEX_GROUP = /^[0-9a-f]{1,4}$/i;
@@ -18,6 +20,12 @@ function isPrivateIPv4(a, b) {
     return true;
   if (a === 0)
     return true;
+  if (a === 100 && b >= 64 && b <= 127)
+    return true;
+  if (a === 198 && (b === 18 || b === 19))
+    return true;
+  if (a >= 224)
+    return true;
   return false;
 }
 export function expandIPv6(addr) {
@@ -88,6 +96,10 @@ function isPrivateIPv6(groups) {
   }
   if (g0 === 100 && g1 === 65435 && g2 === 1)
     return true;
+  if (g0 === 256 && g1 === 0 && g2 === 0 && g3 === 0)
+    return true;
+  if (g0 === 8193 && g1 === 0)
+    return true;
   if ((g0 & 65024) === 64512)
     return true;
   if ((g0 & 65472) === 65152)
@@ -114,7 +126,7 @@ export function isBlockedUrl(url) {
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
     return true;
   const hostname = parsed.hostname.toLowerCase();
-  const bare = hostname.replace(RE_IPV6_BRACKETS, "");
+  const bare = hostname.replace(RE_IPV6_BRACKETS, "").replace(RE_TRAILING_DOTS, "");
   if (bare === "localhost" || bare.endsWith(".localhost"))
     return true;
   const dottedParts = bare.split(".");
@@ -137,6 +149,50 @@ export function isBlockedUrl(url) {
   }
   return false;
 }
+export function isBlockedAddress(address) {
+  return isBlockedUrl(`http://${address.includes(":") ? `[${address}]` : address}/`);
+}
+const PROBE_ORIGIN = "http://og-image.invalid";
+function hasUnsafePathChar(input) {
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code <= 31 || code === 127 || code === 92)
+      return true;
+  }
+  return false;
+}
+export function parseSameOriginPath(input) {
+  if (typeof input !== "string" || input[0] !== "/" || input[1] === "/")
+    return void 0;
+  if (hasUnsafePathChar(input))
+    return void 0;
+  let resolved;
+  try {
+    resolved = new URL(input, PROBE_ORIGIN);
+  } catch {
+    return void 0;
+  }
+  if (resolved.origin !== PROBE_ORIGIN)
+    return void 0;
+  return input;
+}
+export function resolveSameOriginUrl(path, origin) {
+  if (!origin)
+    return null;
+  let base;
+  try {
+    base = new URL(origin).origin;
+  } catch {
+    return null;
+  }
+  let target;
+  try {
+    target = new URL(path, base);
+  } catch {
+    return null;
+  }
+  return target.origin === base ? target.href : null;
+}
 export async function fetchWithRedirectValidation(initialUrl, opts) {
   const controller = new AbortController();
   const externalAbort = opts.signal;
@@ -161,20 +217,23 @@ export async function fetchWithRedirectValidation(initialUrl, opts) {
       }
       if (!isTrusted && isBlockedUrl(url))
         return null;
-      const res = await fetch(url, {
-        redirect: "manual",
+      const res = await guardedFetch(url, {
         signal: controller.signal,
-        headers: opts.headers
+        headers: opts.headers,
+        isBlockedAddress: isTrusted ? void 0 : isBlockedAddress
       });
       if (res.status >= 300 && res.status < 400) {
+        await res.body?.cancel();
         const loc = res.headers.get("location");
         if (!loc)
           return null;
         url = new URL(loc, url).toString();
         continue;
       }
-      if (!res.ok)
+      if (!res.ok) {
+        await res.body?.cancel();
         return null;
+      }
       return await res.arrayBuffer();
     }
     return null;

package/dist/runtime/server/utils.d.ts

@@ -4,5 +4,5 @@ export interface GetOgImagePathResult {
     path: string;
     hash?: string;
 }
-export declare function getOgImagePath(_pagePath: string, _options?: Partial<OgImageOptionsInternal>): GetOgImagePathResult;
+export declare function getOgImagePath(event: H3Event, _pagePath: string, _options?: Partial<OgImageOptionsInternal>): GetOgImagePathResult;
 export declare function useOgImageRuntimeConfig(e?: H3Event): OgImageRuntimeConfig;

package/dist/runtime/server/utils.js

@@ -3,9 +3,9 @@ import { useRuntimeConfig } from "#nuxtseo/nitro";
 import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { buildOgImageUrl } from "../shared.js";
 import { getCloudflareEnv } from "./util/cloudflare.js";
-export function getOgImagePath(_pagePath, _options) {
-  const baseURL = useRuntimeConfig().app.baseURL;
-  const { defaults, security } = useOgImageRuntimeConfig();
+export function getOgImagePath(event, _pagePath, _options) {
+  const baseURL = useRuntimeConfig(event).app.baseURL;
+  const { defaults, security } = useOgImageRuntimeConfig(event);
   const extension = _options?.extension || defaults.extension;
   const isStatic = import.meta.prerender && !(security?.secret && security?.strict);
   const options = { ..._options, _path: _pagePath };

package/dist/runtime/shared.d.ts

@@ -2,7 +2,16 @@ import type { ResolvableMeta } from '@unhead/vue';
 import type { OgImageOptions, OgImagePrebuilt } from './types.js';
 export { extractSocialPreviewTags, toBase64Image } from './pure.js';
 export { buildOgImageUrl, decodeOgImageParams, encodeOgImageParams, extractEncodedSegment, hashOgImageOptions, parseOgImageUrl, signEncodedParams, verifyOgImageSignature } from './shared/urlEncoding.js';
-export declare function generateMeta(url: OgImagePrebuilt['url'] | string, resolvedOptions: OgImageOptions | OgImagePrebuilt): ResolvableMeta[];
+export interface GenerateMetaOptions {
+    /**
+     * Emit Twitter card meta tags (`twitter:card`, `twitter:image`, etc) alongside
+     * the Open Graph image tags.
+     *
+     * @default true
+     */
+    includeTwitter?: boolean;
+}
+export declare function generateMeta(url: OgImagePrebuilt['url'] | string, resolvedOptions: OgImageOptions | OgImagePrebuilt, metaOptions?: GenerateMetaOptions): ResolvableMeta[];
 export declare function isInternalRoute(path: string): boolean;
 export declare function separateProps(options: OgImageOptions | undefined, ignoreKeys?: string[]): OgImageOptions;
 /**

package/dist/runtime/shared.js

@@ -3,10 +3,10 @@ import { toValue } from "vue";
 export { extractSocialPreviewTags, toBase64Image } from "./pure.js";
 export { buildOgImageUrl, decodeOgImageParams, encodeOgImageParams, extractEncodedSegment, hashOgImageOptions, parseOgImageUrl, signEncodedParams, verifyOgImageSignature } from "./shared/urlEncoding.js";
 const RE_KEBAB_CASE = /-([a-z])/g;
-export function generateMeta(url, resolvedOptions) {
+export function generateMeta(url, resolvedOptions, metaOptions = {}) {
   const key = resolvedOptions.key || "og";
   const isTwitterOnly = key === "twitter";
-  const includeTwitter = key === "og" || key === "twitter";
+  const includeTwitter = (key === "og" || key === "twitter") && metaOptions.includeTwitter !== false;
   const meta = [];
   if (includeTwitter) {
     meta.push({ name: "twitter:card", content: "summary_large_image" });

package/dist/runtime/types.d.ts

@@ -4,12 +4,13 @@ import type { SatoriOptions } from 'satori';
 import type { JpegOptions, SharpOptions } from 'sharp';
 import type { MaybeRefOrGetter, Ref } from 'vue';
 import type { H3Error, H3Event } from '#nuxtseo/h3';
+import type { SameOriginPath } from './server/util/ssrf.js';
 import type { Timings } from './server/util/timings.js';
 export interface OgImageRenderEventContext {
     e: H3Event;
     extension: 'png' | 'jpeg' | 'jpg' | 'webp' | 'svg' | 'html' | 'json';
     key: string;
-    basePath: string;
+    basePath: SameOriginPath;
     renderer: Renderer;
     options: OgImageOptionsInternal;
     isDevToolsContextRequest: boolean;
@@ -37,6 +38,8 @@ export interface OgImageRuntimeConfig {
     publicStoragePath: string;
     defaults: Omit<OgImageOptions, 'component' | 'renderer' | 'props' | 'url' | 'html' | 'key' | 'cacheKey' | '_query' | '_hash' | 'socialPreview'>;
     debug: boolean;
+    /** Whether twitter:* meta tags are emitted alongside og:image tags */
+    includeTwitter: boolean;
     baseCacheKey: string;
     hasNuxtIcon: boolean;
     hasNuxtContent?: boolean;
@@ -239,6 +242,7 @@ export interface RuntimeCompatibilitySchema {
     takumi: 'node' | 'node-dev' | 'wasm' | false;
     sharp: 'node' | false;
     emoji?: 'local' | 'fetch';
+    fetch?: 'node' | 'web';
     wasm?: any;
 }
 export interface RuntimeCompatibilityMeta {