sbuilder-mcp 0.82.1 → 0.82.3

package/CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.3] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` with `url` pins the address check to the connection itself, so a DNS answer that changes between the check and the connect (DNS rebinding) can no longer reach a private or loopback host.
+- `sb_media_upload` with `url` sends a user-agent header when it fetches a file, so CDNs that answer 403 without one now serve the download.
+
+## [0.82.2] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` with `url` resolves the host's DNS and refuses the fetch if any address is private, loopback, link-local, cloud-metadata or otherwise special (IPv4 and IPv6, including `::ffff:127.0.0.1`, 6to4 and Teredo forms).
+- `sb_media_upload` with `url` follows redirects one step at a time, re-checking every hop against the same address rules and stopping after four.
+- `sb_media_upload` with `path` restricts `.pdf` files to the allowed directories by the real file name rather than the name given.
+
 ## [0.82.1] - 2026-10-10
 
 ### Fixed

package/CHANGELOG.vi.md

@@ -6,6 +6,19 @@ Mọi thay đổi đáng chú ý của dự án được ghi lại trong file n
 Định dạng dựa trên [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 và dự án tuân theo [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.82.3] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` với `url` ghim bước kiểm tra địa chỉ vào chính kết nối, nên câu trả lời DNS thay đổi giữa lúc kiểm tra và lúc kết nối (DNS rebinding) không còn dẫn tới host riêng hoặc loopback.
+- `sb_media_upload` với `url` gửi header user-agent khi tải file, nên các CDN trả 403 khi thiếu header này giờ cho tải bình thường.
+
+## [0.82.2] - 2026-10-10
+
+### Fixed
+- `sb_media_upload` với `url` phân giải DNS của host và từ chối tải nếu bất kỳ địa chỉ nào thuộc mạng riêng, loopback, link-local, metadata cloud hoặc dải đặc biệt khác (IPv4 và IPv6, gồm `::ffff:127.0.0.1`, 6to4 và Teredo).
+- `sb_media_upload` với `url` đi theo redirect từng bước, kiểm tra lại mỗi bước theo cùng quy tắc địa chỉ và dừng sau bốn lần.
+- `sb_media_upload` với `path` giới hạn file `.pdf` trong các thư mục được phép theo tên file thật chứ không theo tên được truyền vào.
+
 ## [0.82.1] - 2026-10-10
 
 ### Fixed

package/dist/transport/media.js

@@ -2,6 +2,10 @@ import { identityHeaders } from './identity.js';
 import { readFile } from 'node:fs/promises';
 import { guardLocal } from './localfile.js';
 import { basename, extname } from 'node:path';
+import { lookup } from 'node:dns/promises';
+import { BlockList, isIP } from 'node:net';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
 import { ApiError } from './http.js';
 import { siteToken } from '../tools/credentialpick.js';
 /**
@@ -58,6 +62,7 @@ const TYPE_BY_EXT = {
     '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
     '.csv': 'text/csv',
 };
+const PDF_EXT = new Set(['.pdf']);
 /** What a local `path` may be: the media types this server names, nothing else. */
 const MEDIA_EXT = new Set(Object.keys(TYPE_BY_EXT).filter((e) => !['.xlsx', '.xls', '.csv'].includes(e)).concat('.pdf'));
 export function typeForName(name) {
@@ -129,6 +134,101 @@ async function fromUrl(ctx, siteId, url, source) {
     }
     return uploaded(parsed);
 }
+/**
+ * WHEN THE PLATFORM CANNOT FETCH A URL ITSELF, THIS MACHINE DOES — and an agent can
+ * be talked into naming any URL. A private address here reaches the user's own
+ * network (cloud metadata at 169.254.169.254, a dev server on localhost) and the
+ * bytes are re-uploaded to a public CDN. So every address the host resolves to is
+ * checked — a hostname regex is beaten by `[::ffff:127.0.0.1]` or a DNS name that
+ * points inward — and a redirect is followed by hand, each hop checked again.
+ *
+ * The check is PINNED to the connection: the real fetch goes through node:http(s)
+ * with a `lookup` that checks the very address it hands to the socket, so a DNS
+ * answer that changes between "check" and "connect" (rebinding) still meets the
+ * check. Only an injected `ctx.fetchImpl` (tests) skips that path.
+ */
+// No ::ffff:0:0/96 rule: Node's BlockList already applies the IPv4 rules to an
+// IPv4-mapped address, and that rule would match EVERY IPv4 address (measured).
+const PRIVATE = new BlockList();
+for (const [net, bits] of [
+    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16],
+    ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['224.0.0.0', 3],
+])
+    PRIVATE.addSubnet(net, bits, 'ipv4');
+for (const [net, bits] of [
+    // ::/96 (IPv4-compatible), 6to4, Teredo and old site-local carry or reach an IPv4 inside.
+    ['::', 96], ['2002::', 16], ['2001::', 32], ['fec0::', 10], ['64:ff9b::', 96], ['fc00::', 7], ['fe80::', 10], ['ff00::', 8],
+])
+    PRIVATE.addSubnet(net, bits, 'ipv6');
+async function assertPublic(ctx, raw) {
+    const u = new URL(raw);
+    const host = u.hostname.replace(/^\[|\]$/g, '');
+    const refuse = () => new Error('sbuilder: a media url must be a public http(s) address.');
+    if (!/^https?:$/.test(u.protocol))
+        throw refuse();
+    const addrs = isIP(host)
+        ? [host]
+        : await (ctx.lookupHost ?? (async (h) => (await lookup(h, { all: true })).map((a) => a.address)))(host).catch(() => {
+            throw new Error(`sbuilder: could not resolve ${host}.`);
+        });
+    for (const a of addrs) {
+        if (isPrivate(a))
+            throw refuse();
+    }
+}
+const isPrivate = (a) => PRIVATE.check(a, isIP(a) === 6 ? 'ipv6' : 'ipv4');
+/** A `lookup` for node:net that refuses to hand a private address to the socket. */
+export function pinnedLookup(resolve = (h) => lookup(h, { all: true })) {
+    return (host, opts, cb) => {
+        resolve(host).then((addrs) => {
+            if (!addrs.length || addrs.some((a) => isPrivate(a.address))) {
+                cb(new Error('sbuilder: a media url must be a public http(s) address.'));
+            }
+            else if (opts.all)
+                cb(null, addrs);
+            else
+                cb(null, addrs[0].address, addrs[0].family);
+        }, (e) => cb(e));
+    };
+}
+const NULL_BODY = new Set([101, 204, 205, 304]);
+function pinnedFetch(url) {
+    const u = new URL(url);
+    const send = u.protocol === 'https:' ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        // The headers global fetch sends: many CDNs answer 403 to a request with no agent.
+        const headers = { 'user-agent': 'sbuilder-mcp', accept: '*/*' };
+        const req = send(u, { method: 'GET', headers, lookup: pinnedLookup() }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('error', reject);
+            res.on('end', () => {
+                const headers = new Headers();
+                for (const [k, v] of Object.entries(res.headers)) {
+                    if (v !== undefined)
+                        headers.set(k, Array.isArray(v) ? v.join(', ') : v);
+                }
+                const status = res.statusCode ?? 502;
+                resolve(new Response(NULL_BODY.has(status) ? null : Buffer.concat(chunks), { status, headers }));
+            });
+        });
+        req.setTimeout(30_000, () => req.destroy(new Error('sbuilder: the media url timed out.')));
+        req.on('error', reject);
+        req.end();
+    });
+}
+export async function fetchPublic(ctx, doFetch, url) {
+    let at = url;
+    for (let hop = 0; hop < 4; hop++) {
+        await assertPublic(ctx, at);
+        const res = ctx.fetchImpl ? await doFetch(at, { redirect: 'manual' }) : await pinnedFetch(at);
+        const next = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+        if (!next)
+            return res;
+        at = new URL(next, at).toString();
+    }
+    throw new Error('sbuilder: too many redirects fetching the media url.');
+}
 export async function uploadMedia(ctx, siteId, source) {
     const doFetch = ctx.fetchImpl ?? fetch;
     // THE SERVER'S OWN DOOR FIRST, when the source is a URL.
@@ -153,22 +253,15 @@ export async function uploadMedia(ctx, siteId, source) {
         // URL. `name` still becomes the library's display name (the form field below).
         // A PDF is where the sensitive documents live (a tax return, a passport scan),
         // so it comes only from the working or temp directory; images from anywhere.
-        const real = await guardLocal(source.path, MEDIA_EXT, { confine: extname(source.path).toLowerCase() === '.pdf' });
+        let real = await guardLocal(source.path, MEDIA_EXT);
+        // Decided on the REAL name: a `pic.png` symlink to a PDF is a PDF.
+        if (extname(real).toLowerCase() === '.pdf')
+            real = await guardLocal(real, PDF_EXT, { confine: true });
         bytes = await readFile(real);
         filename = basename(real);
     }
     else if (source.url) {
-        // THIS fetch runs on the USER's machine (the server's own door was missing), so a
-        // private address here reaches their network — cloud metadata, a dev server —
-        // and re-uploads it to a public URL. Public http(s) only.
-        // ponytail: hostname check, not resolved-IP; DNS rebinding needs a resolve-and-check.
-        const u = new URL(source.url);
-        if (!/^https?:$/.test(u.protocol) ||
-            /^(localhost|127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.|0\.0\.0\.0|\[?::1\]?$|\[?f[cd][0-9a-f]{2}:|\[?fe80:)/i.test(u.hostname) ||
-            u.hostname.endsWith('.local') || u.hostname.endsWith('.internal')) {
-            throw new Error('sbuilder: a media url must be a public http(s) address.');
-        }
-        const res = await doFetch(source.url);
+        const res = await fetchPublic(ctx, doFetch, source.url);
         if (!res.ok) {
             throw new ApiError(res.status, 'source_unreachable', `could not fetch ${source.url}`);
         }
@@ -179,7 +272,7 @@ export async function uploadMedia(ctx, siteId, source) {
         // CDN link), name it rather than uploading something called "".
         // The type comes from the response or the URL's own name, never from `name`
         // (still sent as the display name below).
-        filename = u.pathname.split('/').pop() || 'image';
+        filename = new URL(source.url).pathname.split('/').pop() || 'image';
     }
     else {
         throw new Error('sbuilder: give sb_media_upload either a local path or a url');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sbuilder-mcp",
-  "version": "0.82.1",
+  "version": "0.82.3",
   "description": "MCP server that designs and operates a Store Builder site — pages, data, theme and publish — through the platform's own API and live-edit protocol.",
   "mcpName": "io.github.vuluu2k/sbuilder-mcp",
   "type": "module",