nuxt-og-image 7.0.6 → 7.0.7

package/dist/chunks/tw4.mjs

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { resolveModulePath } from 'exsolve';
 import { dirname, join } from 'pathe';
-import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.C4hc520M.mjs';
+import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
 import 'node:fs';
 import 'node:module';
 import '@nuxt/kit';

package/dist/chunks/uno.mjs

@@ -1,8 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { defu } from 'defu';
 import { logger } from '../../dist/runtime/logger.js';
-import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.C4hc520M.mjs';
-export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.C4hc520M.mjs';
+import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
+export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.CS4ArVpM.mjs';
 import 'node:fs';
 import 'node:module';
 import 'node:url';

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": "^4.6.1 || ^5.0.0-0"
   },
   "configKey": "ogImage",
-  "version": "7.0.6",
+  "version": "7.0.7",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -7,7 +7,7 @@ import 'defu';
 import 'fnv1a-64';
 import 'nuxtseo-shared/kit';
 import 'pathe';
-export { n as default } from './shared/nuxt-og-image.C4hc520M.mjs';
+export { n as default } from './shared/nuxt-og-image.CS4ArVpM.mjs';
 import '../dist/runtime/logger.js';
 import '../dist/runtime/shared/publish.js';
 import 'node:crypto';

package/dist/runtime/server/og-image/core/plugins/imageSrc.js

@@ -6,7 +6,7 @@ import { fetchLocalAsset } from "../../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { logger } from "../../../util/logger.js";
 import { getOgImageOrigin } from "../../../util/origin.js";
-import { fetchWithRedirectValidation, isBlockedUrl, parseSameOriginPath } from "../../../util/ssrf.js";
+import { fetchWithRedirectValidation, isBlockedUrl, parseSameOriginPath, resolveSameOriginUrl } from "../../../util/ssrf.js";
 import { getImageDimensions } from "../../utils/image-detector.js";
 import { defineTransformer } from "../plugins.js";
 const RE_URL_LEADING = /^url\(['"]?/;
@@ -51,6 +51,8 @@ async function doResolveSrcToBuffer(src, kind, { e, publicStoragePath, runtimeCo
     logger.debug(`[og-image] ${kind} fetch failed (${url}): ${err?.message || err}`);
   };
   if (src.startsWith("/")) {
+    if (!resolveSameOriginUrl(src, getOgImageOrigin(e)))
+      return { blocked: true };
     let buffer2;
     if (import.meta.prerender || import.meta.dev) {
       const srcWithoutBase = src.replace(runtimeConfig.app.baseURL, "/");
@@ -136,7 +138,7 @@ export default defineTransformer([
         applyImageDimensions(node, result.buffer);
         return;
       }
-      if (isRelative) {
+      if (isRelative && import.meta.dev) {
         node.props.src = withBase(src, `${getOgImageOrigin(ctx.e)}`);
         return;
       }
@@ -161,7 +163,7 @@ export default defineTransformer([
         node.props.style.backgroundImage = `url(${toBufferSourceAsBase64(result.buffer)})`;
         return;
       }
-      if (!import.meta.dev && !src.startsWith("/"))
+      if (!import.meta.dev)
         delete node.props.style.backgroundImage;
     }
   }

package/dist/runtime/server/util/cloudflareAssets.js

@@ -10,7 +10,7 @@ export async function tryCloudflareAssetsFetch(event, path, signal) {
     return;
   const origin = getRequestURL(event).origin;
   const url = new URL(path, origin).href;
-  const res = await assets.fetch(url, signal ? { signal } : void 0).catch(() => {
+  const res = await assets.fetch(url, { signal, redirect: "manual" }).catch(() => {
     return null;
   });
   if (!res || !res.ok)

package/dist/runtime/server/util/fetchLocalAsset.d.ts

@@ -15,7 +15,7 @@ export interface FetchLocalAssetOptions {
  * Resolve a same-origin asset path to bytes, trying (in order):
  *   1. Cloudflare Workers ASSETS binding
  *   2. Nitro localFetch through the event-aware bridge, which resolves dynamic routes too
- *   3. External `$fetch` to the Nitro origin (opt-in)
+ *   3. External fetch with redirect validation (opt-in)
  *
  * All steps share a single `AbortSignal.timeout(fetchTimeout)` so a broken
  * URL can't burn N× the configured budget.

package/dist/runtime/server/util/fetchLocalAsset.js

@@ -1,8 +1,13 @@
-import { $fetch } from "ofetch";
 import { fetchWithEvent } from "#nuxtseo/nitro";
 import { tryCloudflareAssetsFetch } from "./cloudflareAssets.js";
 import { getOgImageOrigin } from "./origin.js";
+import { fetchWithRedirectValidation, resolveSameOriginUrl } from "./ssrf.js";
 export async function fetchLocalAsset(event, path, options) {
+  const absolute = resolveSameOriginUrl(path, getOgImageOrigin(event));
+  if (!path.startsWith("/") || !absolute)
+    return;
+  const url = new URL(absolute);
+  path = `${url.pathname}${url.search}`;
   const { fetchTimeout, headers, includeExternalFallback = false, onStepFailure } = options;
   const deadline = AbortSignal.timeout(fetchTimeout);
   let expired = false;
@@ -21,23 +26,24 @@ export async function fetchLocalAsset(event, path, options) {
     return result;
   result = await race(fetchWithEvent(event, path, {
     responseType: "arrayBuffer",
+    redirect: "manual",
     signal: deadline,
     timeout: fetchTimeout,
-    headers
+    headers,
+    onResponse({ response }) {
+      if (!response.ok)
+        throw new Error(response.statusText || String(response.status));
+    }
   }).catch((err) => {
     onStepFailure?.(path, err);
     return void 0;
   }));
   if (result || expired || !includeExternalFallback)
     return result;
-  const absolute = `${getOgImageOrigin(event)}${path}`;
-  return await race($fetch(absolute, {
-    responseType: "arrayBuffer",
+  return await race(fetchWithRedirectValidation(absolute, {
     signal: deadline,
     timeout: fetchTimeout,
-    headers
-  }).catch((err) => {
-    onStepFailure?.(absolute, err);
-    return void 0;
-  }));
+    headers,
+    trustedHost: url.host
+  }).then((buffer) => buffer ?? void 0));
 }

package/dist/shared/{nuxt-og-image.C4hc520M.mjs → nuxt-og-image.CS4ArVpM.mjs}

@@ -5212,12 +5212,18 @@ _ogImagePrerenderPaths?: Map<string, string>`
 /// <reference path="./og-image-bindings.d.ts" />
 import type { OgImageIconsData, OgImageOptions, OgImageRenderEventContext, OgImageRuntimeConfig, VNode } from '${typesPath}'
 
+declare module '@nuxt/schema' {
+  interface AppRouteRulesExtensions {
+    ogImage?: false | OgImageOptions & Record<string, any>
+  }
+}
+
 ${nitroAugmentations}
 
 export {}
 `;
     }
-  }, { nitro: true, nuxt: true });
+  }, { nitro: true, node: true, nuxt: true });
 }
 
 const RE_INLINE_CONFIG = /const\s+inlineConfig\s*=\s*(\{[\s\S]*?\n\})/;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-og-image",
   "type": "module",
-  "version": "7.0.6",
+  "version": "7.0.7",
   "description": "Enlightened OG Image generation for Nuxt.",
   "author": {
     "website": "https://harlanzw.com",
@@ -130,7 +130,7 @@
     "magicast": "^0.5.5",
     "mocked-exports": "^0.1.1",
     "nuxt-site-config": "^5.0.0",
-    "nuxtseo-shared": "^6.0.0",
+    "nuxtseo-shared": "^6.0.3",
     "nypm": "^0.6.10",
     "object-identity": "^0.2.3",
     "ofetch": "^1.5.1",