umedia 0.2.1 → 0.2.2

package/lib/download.js

@@ -5,7 +5,7 @@ import { pipeline } from "node:stream/promises";
 import path from "node:path";
 import { zipSync } from "fflate";
 import { UMediaError, Codes } from "./errors.js";
-import { UA, cleanName, rid } from "./util.js";
+import { UA, cleanName, rid, validateUrl } from "./util.js";
 import { pickFormat } from "./quality.js";
 import * as registry from "./registry.js";
 import * as ytdlp from "./providers/ytdlp.js";
@@ -38,6 +38,9 @@ export async function download({ url, quality = "best", type = "video", dir = ".
   const requestId = rid();
   const t0 = Date.now();
 
+  // SSRF hygiene FIRST — user-supplied URLs must never reach private/internal hosts
+  validateUrl(url);
+
   let resolved, engine;
   if (MEDIA_EXT.test(String(url).split("#")[0])) {
     const ext = (String(url).match(MEDIA_EXT) || [])[1].toLowerCase();
@@ -79,6 +82,7 @@ export async function download({ url, quality = "best", type = "video", dir = ".
         throw new UMediaError(Codes.PROVIDER_UNAVAILABLE,
           "no direct media URL available on this network (bot-gated) — install yt-dlp for hard networks");
       }
+      validateUrl(chosenUrl); // never fetch private/internal targets, even from a provider response
       if (!selectedQuality) { selectedQuality = pick.selectedQuality; fallback = pick.fallback; }
 
       const ext = (chosenUrl.split("?")[0].match(/\.(mp4|webm|m4a|mp3|jpg|jpeg|png|gif|webp)$/) || [])[1]
@@ -132,6 +136,7 @@ export async function download({ url, quality = "best", type = "video", dir = ".
 /** yt-dlp escape hatch for downloads on hard networks / 1800+ sites. */
 export async function downloadWithYtdlp({ url, quality = "best", dir = "./umedia-downloads", onProgress } = {}) {
   const requestId = rid();
+  validateUrl(url);
   if (!ytdlp.binary()) throw new UMediaError(Codes.PROVIDER_UNAVAILABLE, "yt-dlp not installed — `pip install yt-dlp`");
   await mkdir(dir, { recursive: true });
   const { spawn } = await import("node:child_process");

package/lib/registry.js

@@ -6,6 +6,7 @@ import * as ig from "./providers/instagram.js";
 import * as ytdlp from "./providers/ytdlp.js";
 import * as itunes from "./providers/itunes.js";
 import { Codes, UMediaError } from "./errors.js";
+import { validateUrl } from "./util.js";
 
 const NATIVE = [yt, tiktok, reddit, xprov, ig];
 
@@ -20,6 +21,9 @@ const DIRECT_MEDIA = /\.(mp4|webm|m4a|mp3|aac|wav|jpg|jpeg|png|gif|webp|mov|mkv)
 
 /** Resolve a URL: native adapter first, optional yt-dlp fallback. attempts[] is the honest trail. */
 export async function resolve(url) {
+  // SSRF hygiene FIRST — never dispatch or fetch private/internal targets (bots pass user URLs!)
+  validateUrl(url);
+
   // direct media URL (an image/video/audio file) -> single-item result, no platform needed
   const direct = String(url).split("#")[0].match(DIRECT_MEDIA);
   if (direct) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "umedia",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Standalone media engine — search, resolve and download media from YouTube, TikTok, Instagram, Reddit, X, iTunes (and 1800+ sites via the yt-dlp tier) entirely on your machine. No hosted API, no keys, no server bills. Honest quality labels, complete galleries, typed errors.",
   "type": "module",
   "main": "./index.js",
@@ -12,7 +12,7 @@
     }
   },
   "bin": {
-    "umedia": "./bin/umedia.js"
+    "umedia": "bin/umedia.js"
   },
   "files": [
     "index.js",