nuxt-og-image 7.0.5 → 7.0.7

package/dist/chunks/tw4.mjs

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { resolveModulePath } from 'exsolve';
 import { dirname, join } from 'pathe';
-import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.C4hc520M.mjs';
+import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
 import 'node:fs';
 import 'node:module';
 import '@nuxt/kit';

package/dist/chunks/uno.mjs

@@ -1,8 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { defu } from 'defu';
 import { logger } from '../../dist/runtime/logger.js';
-import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.C4hc520M.mjs';
-export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.C4hc520M.mjs';
+import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
+export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
 import 'node:fs';
 import 'node:module';
 import 'node:url';

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": "^4.6.1 || ^5.0.0-0"
   },
   "configKey": "ogImage",
-  "version": "7.0.5",
+  "version": "7.0.7",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -7,7 +7,7 @@ import 'defu';
 import 'fnv1a-64';
 import 'nuxtseo-shared/kit';
 import 'pathe';
-export { n as default } from './shared/nuxt-og-image.C4hc520M.mjs';
+export { n as default } from './shared/nuxt-og-image.CS4ArVpM.mjs';
 import '../dist/runtime/logger.js';
 import '../dist/runtime/shared/publish.js';
 import 'node:crypto';

package/dist/runtime/server/og-image/core/plugins/imageSrc.js

@@ -6,7 +6,7 @@ import { fetchLocalAsset } from "../../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { logger } from "../../../util/logger.js";
 import { getOgImageOrigin } from "../../../util/origin.js";
-import { fetchWithRedirectValidation, isBlockedUrl, parseSameOriginPath } from "../../../util/ssrf.js";
+import { fetchWithRedirectValidation, isBlockedUrl, parseSameOriginPath, resolveSameOriginUrl } from "../../../util/ssrf.js";
 import { getImageDimensions } from "../../utils/image-detector.js";
 import { defineTransformer } from "../plugins.js";
 const RE_URL_LEADING = /^url\(['"]?/;
@@ -51,6 +51,8 @@ async function doResolveSrcToBuffer(src, kind, { e, publicStoragePath, runtimeCo
     logger.debug(`[og-image] ${kind} fetch failed (${url}): ${err?.message || err}`);
   };
   if (src.startsWith("/")) {
+    if (!resolveSameOriginUrl(src, getOgImageOrigin(e)))
+      return { blocked: true };
     let buffer2;
     if (import.meta.prerender || import.meta.dev) {
       const srcWithoutBase = src.replace(runtimeConfig.app.baseURL, "/");
@@ -136,7 +138,7 @@ export default defineTransformer([
         applyImageDimensions(node, result.buffer);
         return;
       }
-      if (isRelative) {
+      if (isRelative && import.meta.dev) {
         node.props.src = withBase(src, `${getOgImageOrigin(ctx.e)}`);
         return;
       }
@@ -161,7 +163,7 @@ export default defineTransformer([
         node.props.style.backgroundImage = `url(${toBufferSourceAsBase64(result.buffer)})`;
         return;
       }
-      if (!import.meta.dev && !src.startsWith("/"))
+      if (!import.meta.dev)
         delete node.props.style.backgroundImage;
     }
   }

package/dist/runtime/server/og-image/font-binary.d.ts

@@ -16,6 +16,7 @@ export type FontBinaryResult = {
 export declare function isWoff2Binary(source: BufferSource): boolean;
 /**
  * Parse loaded font bytes into a binary that every Takumi build accepts.
- * TTF, OTF, font collections and WOFF2 pass through; WOFF inflates to TTF or OTF.
+ * Check TTF, OTF and collection table bounds, plus WOFF2 header and file length.
+ * Accepted bytes pass through; WOFF inflates to TTF or OTF.
  */
 export declare function parseFontBinary(source: BufferSource): Promise<FontBinaryResult>;

package/dist/runtime/server/og-image/font-binary.js

@@ -28,6 +28,61 @@ function readSignature(data) {
     return void 0;
   return new DataView(data.buffer, data.byteOffset, data.byteLength).getUint32(0);
 }
+function sfntError(data, offset = 0) {
+  if (offset + 12 > data.byteLength)
+    return "the SFNT header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const signature = view.getUint32(offset);
+  if (signature !== SIGNATURES.truetype && signature !== SIGNATURES.appleTrueType && signature !== SIGNATURES.openType)
+    return "the SFNT signature is invalid";
+  const numTables = view.getUint16(offset + 4);
+  if (numTables === 0)
+    return "the SFNT file has no tables";
+  if (offset + 12 + numTables * SFNT_TABLE_RECORD_SIZE > data.byteLength)
+    return "the SFNT table directory is truncated";
+  for (let index = 0; index < numTables; index++) {
+    const record = offset + 12 + index * SFNT_TABLE_RECORD_SIZE;
+    if (view.getUint32(record + 8) + view.getUint32(record + 12) > data.byteLength)
+      return "an SFNT table runs past the end of the file";
+  }
+}
+function collectionError(data) {
+  if (data.byteLength < 12)
+    return "the font collection header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const version = view.getUint32(4);
+  if (version !== 65536 && version !== 131072)
+    return "the font collection version is invalid";
+  const numFonts = view.getUint32(8);
+  if (numFonts === 0)
+    return "the font collection has no fonts";
+  const headerSize = 12 + numFonts * 4 + (version === 131072 ? 12 : 0);
+  if (headerSize > data.byteLength)
+    return "the font collection directory is truncated";
+  for (let index = 0; index < numFonts; index++) {
+    const offset = view.getUint32(12 + index * 4);
+    if (offset < headerSize)
+      return "a font collection offset overlaps its header";
+    const error = sfntError(data, offset);
+    if (error)
+      return error;
+  }
+}
+function woff2Error(data) {
+  if (data.byteLength < 48)
+    return "the WOFF2 header is truncated";
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  if (view.getUint32(8) !== data.byteLength)
+    return "the WOFF2 length does not match the file";
+  if (view.getUint16(12) === 0)
+    return "the WOFF2 file has no tables";
+  const compressedSize = view.getUint32(20);
+  if (compressedSize === 0 || compressedSize > data.byteLength - 48)
+    return "the WOFF2 compressed data is missing or truncated";
+}
+function checked(data, error) {
+  return error ? { _tag: "Err", reason: error } : { _tag: "Ok", data };
+}
 async function inflate(data, size) {
   const output = new Uint8Array(size);
   const reader = new Blob([data]).stream().pipeThrough(new DecompressionStream("deflate")).getReader();
@@ -112,12 +167,14 @@ export async function parseFontBinary(source) {
     case SIGNATURES.truetype:
     case SIGNATURES.appleTrueType:
     case SIGNATURES.openType:
+      return checked(data, sfntError(data));
     case SIGNATURES.collection:
+      return checked(data, collectionError(data));
     case SIGNATURES.woff2:
-      return { _tag: "Ok", data };
+      return checked(data, woff2Error(data));
     case SIGNATURES.woff:
       return decodeWoff(data).then(
-        (sfnt) => ({ _tag: "Ok", data: sfnt }),
+        (sfnt) => checked(sfnt, sfntError(sfnt)),
         (error) => ({ _tag: "Err", reason: `it is a WOFF file that could not be decoded: ${error.message}` })
       );
     default:

package/dist/runtime/server/util/cloudflareAssets.js

@@ -10,7 +10,7 @@ export async function tryCloudflareAssetsFetch(event, path, signal) {
     return;
   const origin = getRequestURL(event).origin;
   const url = new URL(path, origin).href;
-  const res = await assets.fetch(url, signal ? { signal } : void 0).catch(() => {
+  const res = await assets.fetch(url, { signal, redirect: "manual" }).catch(() => {
     return null;
   });
   if (!res || !res.ok)

package/dist/runtime/server/util/fetchLocalAsset.d.ts

@@ -15,7 +15,7 @@ export interface FetchLocalAssetOptions {
  * Resolve a same-origin asset path to bytes, trying (in order):
  *   1. Cloudflare Workers ASSETS binding
  *   2. Nitro localFetch through the event-aware bridge, which resolves dynamic routes too
- *   3. External `$fetch` to the Nitro origin (opt-in)
+ *   3. External fetch with redirect validation (opt-in)
  *
  * All steps share a single `AbortSignal.timeout(fetchTimeout)` so a broken
  * URL can't burn N× the configured budget.

package/dist/runtime/server/util/fetchLocalAsset.js

@@ -1,8 +1,13 @@
-import { $fetch } from "ofetch";
 import { fetchWithEvent } from "#nuxtseo/nitro";
 import { tryCloudflareAssetsFetch } from "./cloudflareAssets.js";
 import { getOgImageOrigin } from "./origin.js";
+import { fetchWithRedirectValidation, resolveSameOriginUrl } from "./ssrf.js";
 export async function fetchLocalAsset(event, path, options) {
+  const absolute = resolveSameOriginUrl(path, getOgImageOrigin(event));
+  if (!path.startsWith("/") || !absolute)
+    return;
+  const url = new URL(absolute);
+  path = `${url.pathname}${url.search}`;
   const { fetchTimeout, headers, includeExternalFallback = false, onStepFailure } = options;
   const deadline = AbortSignal.timeout(fetchTimeout);
   let expired = false;
@@ -21,23 +26,24 @@ export async function fetchLocalAsset(event, path, options) {
     return result;
   result = await race(fetchWithEvent(event, path, {
     responseType: "arrayBuffer",
+    redirect: "manual",
     signal: deadline,
     timeout: fetchTimeout,
-    headers
+    headers,
+    onResponse({ response }) {
+      if (!response.ok)
+        throw new Error(response.statusText || String(response.status));
+    }
   }).catch((err) => {
     onStepFailure?.(path, err);
     return void 0;
   }));
   if (result || expired || !includeExternalFallback)
     return result;
-  const absolute = `${getOgImageOrigin(event)}${path}`;
-  return await race($fetch(absolute, {
-    responseType: "arrayBuffer",
+  return await race(fetchWithRedirectValidation(absolute, {
     signal: deadline,
     timeout: fetchTimeout,
-    headers
-  }).catch((err) => {
-    onStepFailure?.(absolute, err);
-    return void 0;
-  }));
+    headers,
+    trustedHost: url.host
+  }).then((buffer) => buffer ?? void 0));
 }

package/dist/shared/{nuxt-og-image.C4hc520M.mjs → nuxt-og-image.CS4ArVpM.mjs}

@@ -5212,12 +5212,18 @@ _ogImagePrerenderPaths?: Map<string, string>`
 /// <reference path="./og-image-bindings.d.ts" />
 import type { OgImageIconsData, OgImageOptions, OgImageRenderEventContext, OgImageRuntimeConfig, VNode } from '${typesPath}'
 
+declare module '@nuxt/schema' {
+  interface AppRouteRulesExtensions {
+    ogImage?: false | OgImageOptions & Record<string, any>
+  }
+}
+
 ${nitroAugmentations}
 
 export {}
 `;
     }
-  }, { nitro: true, nuxt: true });
+  }, { nitro: true, node: true, nuxt: true });
 }
 
 const RE_INLINE_CONFIG = /const\s+inlineConfig\s*=\s*(\{[\s\S]*?\n\})/;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-og-image",
   "type": "module",
-  "version": "7.0.5",
+  "version": "7.0.7",
   "description": "Enlightened OG Image generation for Nuxt.",
   "author": {
     "website": "https://harlanzw.com",
@@ -130,7 +130,7 @@
     "magicast": "^0.5.5",
     "mocked-exports": "^0.1.1",
     "nuxt-site-config": "^5.0.0",
-    "nuxtseo-shared": "^6.0.0",
+    "nuxtseo-shared": "^6.0.3",
     "nypm": "^0.6.10",
     "object-identity": "^0.2.3",
     "ofetch": "^1.5.1",