pdfmake - npm Package Compare versions

Comparing version 0.3.0-beta.16 to 0.3.0-beta.17

CHANGELOG.md

 # Changelog
 
+## 0.3.0-beta.17 - 2025-04-29
+
+- Fixed DoS via repeatedly redirect URL in file embedding
+
 ## 0.3.0-beta.16 - 2025-04-26
@@ -4,0 +8,0 @@

js/URLResolver.js

@@ -8,3 +8,9 @@ "use strict";
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const fetchUrl = (url, headers = {}) => {
+const MAX_REDIRECTS = 30;
+const fetchUrl = (url, headers = {}, redirectCount = 0) => {
+  if (redirectCount >= MAX_REDIRECTS) {
+    return new Promise((_, reject) => {
+      reject(new Error(`Too many redirects (limit: ${MAX_REDIRECTS})`));
+    });
+  }
   return new Promise((resolve, reject) => {
@@ -20,3 +26,3 @@ const parsedUrl = new URL(url);
         res.resume();
-        fetchUrl(res.headers.location).then(buffer => {
+        fetchUrl(res.headers.location, {}, redirectCount + 1).then(buffer => {
           resolve(buffer);
@@ -23,0 +29,0 @@ }, result => {

package.json

 {
   "name": "pdfmake",
-  "version": "0.3.0-beta.16",
+  "version": "0.3.0-beta.17",
   "description": "Client/server side PDF printing in pure JavaScript",
@@ -5,0 +5,0 @@ "main": "js/index.js",

src/URLResolver.js

 import http from 'http';
 import https from 'https';
 
-const fetchUrl = (url, headers = {}) => {
+const MAX_REDIRECTS = 30;
+
+const fetchUrl = (url, headers = {}, redirectCount = 0) => {
+	if (redirectCount >= MAX_REDIRECTS) {
+		return new Promise((_, reject) => {
+			reject(new Error(`Too many redirects (limit: ${MAX_REDIRECTS})`));
+		});
+	}
 	return new Promise((resolve, reject) => {
@@ -15,4 +22,4 @@ const parsedUrl = new URL(url);
 				res.resume();
-				
-				fetchUrl(res.headers.location).then(buffer => {
+
+				fetchUrl(res.headers.location, {}, redirectCount + 1).then(buffer => {
 					resolve(buffer);
@@ -19,0 +26,0 @@ }, result => {

No alert changes

Improved metrics

Total package byte prevSize

13896840

0.01%

Lines of code

91761

0.01%

No dependency changes