zapier-platform-core 15.7.3 → 15.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zapier-platform-core",
-  "version": "15.7.3",
+  "version": "15.8.0",
   "description": "The core SDK for CLI apps in the Zapier Developer Platform.",
   "repository": "zapier/zapier-platform",
   "homepage": "https://platform.zapier.com/",
@@ -52,7 +52,7 @@
     "node-fetch": "2.6.7",
     "oauth-sign": "0.9.0",
     "semver": "7.5.2",
-    "zapier-platform-schema": "15.7.3"
+    "zapier-platform-schema": "15.8.0"
   },
   "devDependencies": {
     "@types/node-fetch": "^2.6.11",
@@ -60,7 +60,8 @@
     "aws-sdk": "^2.1397.0",
     "dicer": "^0.3.1",
     "fs-extra": "^11.1.1",
-    "mock-fs": "^5.2.0"
+    "mock-fs": "^5.2.0",
+    "nock": "^13.5.4"
   },
   "optionalDependencies": {
     "@types/node": "^20.3.1"

package/src/http-middlewares/after/prepare-response.js

@@ -45,7 +45,9 @@ const prepareContentResponse = async (resp, request) => {
 
   // trim down the response signature a ton for simplicity
   const preppedResp = {
+    url: resp.url,
     status: resp.status,
+    redirected: resp.redirected,
     json: undefined,
     data: undefined,
     content,

package/src/http-middlewares/after/throw-for-disallowed-hostname-after-redirect.js

@@ -0,0 +1,36 @@
+'use strict';
+
+const { Error } = require('../../errors');
+
+const disallowedRedirectHosts = [
+  // Loopback addresses (IPv4)
+  'localhost',
+  '127.0.0.1',
+
+  // Loopback addresses (IPv6)
+  '::1',
+  '[::1]',
+];
+
+function isDisallowedAfterRedirect(url) {
+  try {
+    const { hostname } = new URL(url);
+    return disallowedRedirectHosts.includes(hostname);
+  } catch (e) {
+    // If URL parsing fails, consider it allowed
+    // (being permissive just in case it affects backwards compatibility)
+    return false;
+  }
+}
+
+const throwForDisallowedHostnameAfterRedirect = (resp) => {
+  // Looking at the response URL instead of the request URL
+  // because the response URL can change after a redirect
+  if (resp.redirected && isDisallowedAfterRedirect(resp.url)) {
+    throw new Error('Redirecting to disallowed hostname');
+  }
+
+  return resp;
+};
+
+module.exports = throwForDisallowedHostnameAfterRedirect;

package/src/tools/create-app-request-client.js

@@ -20,6 +20,7 @@ const { logResponse } = require('../http-middlewares/after/log-response');
 const prepareResponse = require('../http-middlewares/after/prepare-response');
 const throwForStaleAuth = require('../http-middlewares/after/throw-for-stale-auth');
 const throwForStatusMiddleware = require('../http-middlewares/after/throw-for-status');
+const throwForDisallowedHostnameAfterRedirect = require('../http-middlewares/after/throw-for-disallowed-hostname-after-redirect');
 
 const createAppRequestClient = (input, options) => {
   input = ensurePath(input, '_zapier.app');
@@ -64,6 +65,7 @@ const createAppRequestClient = (input, options) => {
 
   const httpAfters = [
     prepareResponse,
+    throwForDisallowedHostnameAfterRedirect,
     logResponse,
     ...(includeAutoRefresh ? [throwForStaleAuth] : []),
     ...ensureArray(app.afterResponse),