@ai-sdk/provider-utils - npm Package Compare versions

Comparing version 5.0.14 to 5.0.15

src/safe-node-fetch.ts

+import type * as nodeDnsModule from 'node:dns';
+import type * as nodeModule from 'node:module';
+import type * as undiciModule from 'undici';
+import type { FetchFunction } from './fetch-function';
+import { validateDownloadAddress } from './validate-download-url';
+
+type NodeDns = typeof nodeDnsModule;
+type NodeModule = typeof nodeModule;
+type Undici = typeof undiciModule;
+
+type LookupAddress = {
+  address: string;
+  family: number;
+};
+
+type LookupOptions = {
+  all?: boolean;
+  family?: number;
+  hints?: number;
+  order?: 'ipv4first' | 'ipv6first' | 'verbatim';
+  verbatim?: boolean;
+};
+
+type Lookup = (
+  hostname: string,
+  options: LookupOptions & { all: true },
+  callback: (
+    error: NodeJS.ErrnoException | null,
+    addresses: LookupAddress[],
+  ) => void,
+) => void;
+
+type LookupAllCallback = (
+  error: NodeJS.ErrnoException | null,
+  addresses: LookupAddress[],
+) => void;
+
+type LookupOneCallback = (
+  error: NodeJS.ErrnoException | null,
+  address: string,
+  family: number,
+) => void;
+
+type SafeLookup = {
+  (
+    hostname: string,
+    options: LookupOptions & { all: true },
+    callback: LookupAllCallback,
+  ): void;
+  (
+    hostname: string,
+    options: LookupOptions & { all?: false },
+    callback: LookupOneCallback,
+  ): void;
+};
+
+/**
+ * Creates a DNS lookup hook that validates every returned address before
+ * returning the callback shape requested by the HTTP connector. Because
+ * resolution and validation happen inside the connector, the socket is pinned
+ * to the validated result and DNS rebinding cannot introduce a second lookup.
+ */
+export function createSafeLookup(lookup: Lookup): SafeLookup {
+  return ((
+    hostname: string,
+    options: LookupOptions,
+    callback: LookupAllCallback | LookupOneCallback,
+  ): void => {
+    lookup(hostname, { ...options, all: true }, (error, addresses) => {
+      if (error) {
+        (callback as (error: Error) => void)(error);
+        return;
+      }
+
+      try {
+        const [firstAddress] = addresses;
+
+        if (firstAddress == null) {
+          throw new Error(`Hostname ${hostname} did not resolve to an address`);
+        }
+
+        for (const { address, family } of addresses) {
+          validateDownloadAddress({ address, family, hostname });
+        }
+
+        if (options.all === true) {
+          (callback as LookupAllCallback)(null, addresses);
+        } else {
+          (callback as LookupOneCallback)(
+            null,
+            firstAddress.address,
+            firstAddress.family,
+          );
+        }
+      } catch (error) {
+        (callback as (error: Error) => void)(
+          error instanceof Error ? error : new Error(String(error)),
+        );
+      }
+    });
+  }) as SafeLookup;
+}
+
+let safeNodeFetchPromise: Promise<FetchFunction> | undefined;
+const initialGlobalFetch = globalThis.fetch;
+const initialGlobalFetchIsNodeDefault = isNodeDefaultFetch(initialGlobalFetch);
+
+export function isNodeRuntime(): boolean {
+  const runtimeProcess = globalThis.process as
+    | {
+        release?: { name?: string };
+        versions?: { bun?: string };
+      }
+    | undefined;
+
+  return (
+    runtimeProcess?.release?.name === 'node' &&
+    runtimeProcess.versions?.bun == null
+  );
+}
+
+export async function getDefaultDownloadFetch(): Promise<FetchFunction> {
+  if (
+    !isNodeRuntime() ||
+    !initialGlobalFetchIsNodeDefault ||
+    globalThis.fetch !== initialGlobalFetch
+  ) {
+    return globalThis.fetch;
+  }
+
+  return (safeNodeFetchPromise ??= Promise.resolve().then(createSafeNodeFetch));
+}
+
+function isNodeDefaultFetch(fetch: FetchFunction): boolean {
+  const source = Function.prototype.toString.call(fetch);
+  return (
+    source.includes('internal/deps/undici') ||
+    source.includes('lazy loading of undici')
+  );
+}
+
+function createSafeNodeFetch(): FetchFunction {
+  // Load Node-only modules indirectly so browser bundlers do not pull undici
+  // and Node built-ins into the browser-facing provider-utils entry point.
+  const { createRequire } = loadBuiltinModule<NodeModule>('node:module');
+  const { lookup } = loadBuiltinModule<NodeDns>('node:dns');
+  const { Agent, fetch } = createRequire(getCurrentModulePath())(
+    'undici',
+  ) as Undici;
+
+  const dispatcher = new Agent({
+    connect: {
+      lookup: createSafeLookup(lookup as Lookup) as never,
+    },
+  });
+
+  return ((input, init) =>
+    fetch(
+      input as Parameters<typeof fetch>[0],
+      {
+        ...init,
+        dispatcher,
+      } as Parameters<typeof fetch>[1],
+    ) as unknown as Promise<Response>) satisfies FetchFunction;
+}
+
+function loadBuiltinModule<T>(id: string): T {
+  const processWithBuiltins = globalThis.process as
+    | {
+        getBuiltinModule?: (id: string) => unknown;
+      }
+    | undefined;
+  const builtinModule = processWithBuiltins?.getBuiltinModule?.(id);
+
+  if (builtinModule == null) {
+    throw new Error(`Node.js built-in module ${id} is unavailable`);
+  }
+
+  return builtinModule as T;
+}
+
+function getCurrentModulePath(): string {
+  // `import.meta.url` breaks when provider-utils is rebundled as CommonJS.
+  // The caller frame points at this package when loaded directly and at the
+  // consuming bundle when inlined, giving createRequire the correct base path.
+  const originalPrepareStackTrace = Error.prepareStackTrace;
+
+  try {
+    Error.prepareStackTrace = (_error, callSites) => callSites as never;
+
+    const error = new Error('Capture current module path');
+    Error.captureStackTrace(error, getCurrentModulePath);
+    const [caller] = error.stack as unknown as NodeJS.CallSite[];
+    const fileName = caller?.getFileName();
+
+    if (fileName == null) {
+      throw new Error('Unable to determine the current module path');
+    }
+
+    return fileName;
+  } finally {
+    Error.prepareStackTrace = originalPrepareStackTrace;
+  }
+}

package.json

 {
   "name": "@ai-sdk/provider-utils",
-  "version": "5.0.14",
+  "version": "5.0.15",
   "type": "module",
@@ -38,2 +38,3 @@ "license": "Apache-2.0",
     "eventsource-parser": "^3.0.8",
+    "undici": "^7.28.0",
     "@ai-sdk/provider": "4.0.4"
@@ -40,0 +41,0 @@ },

src/fetch-with-validated-redirects.ts

@@ -6,2 +6,3 @@ import { cancelResponseBody } from './cancel-response-body';
 import { isSameOrigin } from './is-same-origin';
+import { getDefaultDownloadFetch } from './safe-node-fetch';
 import { sanitizeRequestHeaders } from './sanitize-request-headers';
@@ -52,9 +53,7 @@ import { validateDownloadUrl } from './validate-download-url';
  *
- * Not solved here: this does string/literal checks only and does not resolve
- * DNS, so a hostname that *resolves* to a private address, and DNS rebinding
- * (the resolved IP flipping between validation and connect), are not blocked.
- * Server deployments fetching untrusted URLs should constrain egress at the
- * network layer or inject a Node `fetch` that pins the resolved IP at connect
- * time — those need DNS/socket APIs not available on all target runtimes
- * (edge, browser, Bun), so they are intentionally not built in.
+ * On Node.js, the default fetch resolves every hostname through a validating
+ * lookup hook and passes those exact addresses to the connector, preventing
+ * hostname-to-private-IP and DNS-rebinding bypasses. An injected fetch is
+ * responsible for equivalent connect-time validation. Other runtimes should
+ * constrain egress at the network layer when handling untrusted URLs.
  *
@@ -69,3 +68,3 @@ * @throws DownloadError if a hop is unsafe, the redirect limit is exceeded, or
   maxRedirects = MAX_DOWNLOAD_REDIRECTS,
-  fetch = globalThis.fetch,
+  fetch: customFetch,
   trustedOrigin,
@@ -105,9 +104,13 @@ }: {
     // would reject legitimate self-hosted / localhost deployments.
-    if (
-      trustedOrigin === undefined ||
-      !isSameOrigin(currentUrl, trustedOrigin)
-    ) {
+    const isTrustedHop =
+      trustedOrigin !== undefined && isSameOrigin(currentUrl, trustedOrigin);
+
+    if (!isTrustedHop) {
       validateDownloadUrl(currentUrl);
     }
 
+    const fetch =
+      customFetch ??
+      (isTrustedHop ? globalThis.fetch : await getDefaultDownloadFetch());
+
     const response = await fetch(currentUrl, perHopInit('manual'));
@@ -114,0 +117,0 @@

src/get-from-api.ts

@@ -22,3 +22,3 @@ import { APICallError } from '@ai-sdk/provider';
   abortSignal,
-  fetch = getOriginalFetch(),
+  fetch,
   validateUrl,
@@ -69,2 +69,4 @@ credentialedOrigin,
   try {
+    const requestFetch = fetch ?? getOriginalFetch();
+
     // Withhold caller headers when the URL is not same-origin with the origin
@@ -91,3 +93,3 @@ // allowed to receive credentials; the user-agent suffix is still applied.
         })
-      : await fetch(url, {
+      : await requestFetch(url, {
           method: 'GET',
@@ -94,0 +96,0 @@ headers: requestHeaders,

src/validate-download-url.ts

@@ -7,5 +7,4 @@ import { DownloadError } from './download-error';
  *
- * Note: this performs string/literal-IP checks only. It does not resolve DNS, so a
- * hostname that resolves to a private address is not blocked here (see callers, which
- * should additionally constrain egress at the network layer when handling untrusted URLs).
+ * Note: this function performs string/literal-IP checks only. The Node.js
+ * download fetch additionally validates and pins DNS results at connect time.
  *
@@ -87,2 +86,30 @@ * @param url - The URL string to validate.
 
+/**
+ * Validates an address returned by DNS before it is used to open a socket.
+ * This is intentionally not exported from the package entry point.
+ */
+export function validateDownloadAddress({
+  address,
+  family,
+  hostname,
+}: {
+  address: string;
+  family: number;
+  hostname: string;
+}): void {
+  const isUnsafe =
+    family === 4
+      ? !isIPv4(address) || isPrivateIPv4(address)
+      : family === 6
+        ? isPrivateIPv6(address)
+        : true;
+
+  if (isUnsafe) {
+    throw new DownloadError({
+      url: hostname,
+      message: `Hostname ${hostname} resolved to disallowed IP address ${address}`,
+    });
+  }
+}
+
 function isIPv4(hostname: string): boolean {
@@ -89,0 +116,0 @@ const parts = hostname.split('.');

No alert changes

Improved metrics

Total package byte prevSize

876460

2.25%

Number of package files

160

0.63%

Lines of code

14804

2.14%

Worsened metrics

Dependency count

6

20%

Number of medium supply chain risk alerts

66

40.43%

Dependency changes

• + Added

  undici@^7.28.0

• + Added

  undici@7.29.0
  (transitive)