pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-25 16:42:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): stabilize relay SSRF-guard binding for minified builds (#6149) (#6224)

Browse Source
This commit is contained in:
Diego Rodrigues de Sa e Souza
2026-07-04 22:24:47 -03:00
committed by GitHub
parent 1e59d14143
commit 2d5bd41261
4 changed files with 157 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/app/api/settings/proxy/deno-deploy/route.ts
View File

@@ -74,8 +74,11 @@ export function resolveRelayTarget(
// SAME source used by the server and by the unit tests — embedded here via
// Function#toString so the worker enforces byte-for-byte the audited policy.
// Mirrors the Vercel-relay guard so a future audit can diff the two.
// The guard is bound to a LITERAL const name (not a bare declaration) so the
// hardcoded call site below resolves even when the SWC-minified standalone build
// mangles the source function's own name in `.toString()` output (#6149).
function buildRelayWorker(relayAuth: string): string {
return `${resolveRelayTarget.toString()}
return `const resolveRelayTarget = ${resolveRelayTarget.toString()};
function isPrivateHostname(h) {
if (!h) return true;

7
src/app/api/settings/proxy/vercel-deploy/route.ts
View File

@@ -20,10 +20,13 @@ function buildRelayFunction(relayAuth: string): string {
// Node-side helpers from the Edge runtime); it blocks RFC1918, loopback,
// link-local, IPv6 ULA, and embedded credentials on the x-relay-target host.
// `resolveRelayTarget` (shared with the Deno worker) closes the x-relay-path
// host-confusion hole and is embedded verbatim via Function#toString.
// host-confusion hole and is embedded verbatim via Function#toString. It is
// bound to a LITERAL const name (not a bare declaration) so the hardcoded
// call site below resolves even when the SWC-minified standalone build mangles
// the source function's own name in `.toString()` output (#6149).
return `export const config = { runtime: "edge" };
${resolveRelayTarget.toString()}
const resolveRelayTarget = ${resolveRelayTarget.toString()};
function isPrivateHostname(h) {
if (!h) return true;