mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 20:32:20 +03:00
c9fc36ca14
Centralize remote image downloads behind a shared helper that validates outbound URLs, enforces redirect and size limits, and applies request timeouts before bytes are read. Wire the helper into image generation and vision bridge flows so remote image inputs and result URLs follow the same fetch policy and block redirects to private hosts. Update key management routes to use structured logging and document the WebSocket bridge secret in the example environment file.
52 lines
1.4 KiB
TypeScript
52 lines
1.4 KiB
TypeScript
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
|
|
import { fetchRemoteImage } from "@/shared/network/remoteImageFetch";
|
|
|
|
test("fetchRemoteImage reads public image bytes", async () => {
|
|
const result = await fetchRemoteImage("https://cdn.example.com/image.png", {
|
|
fetchImpl: async () =>
|
|
new Response(new Uint8Array([1, 2, 3]), {
|
|
status: 200,
|
|
headers: { "content-type": "image/png" },
|
|
}),
|
|
guard: "public-only",
|
|
});
|
|
|
|
assert.equal(result.buffer.toString("base64"), "AQID");
|
|
assert.equal(result.contentType, "image/png");
|
|
});
|
|
|
|
test("fetchRemoteImage blocks private image hosts before fetch", async () => {
|
|
let called = false;
|
|
|
|
await assert.rejects(
|
|
() =>
|
|
fetchRemoteImage("http://127.0.0.1:20128/private.png", {
|
|
fetchImpl: async () => {
|
|
called = true;
|
|
return new Response("unexpected");
|
|
},
|
|
guard: "public-only",
|
|
}),
|
|
/Blocked private or local provider URL/
|
|
);
|
|
|
|
assert.equal(called, false);
|
|
});
|
|
|
|
test("fetchRemoteImage blocks redirects to private image hosts", async () => {
|
|
await assert.rejects(
|
|
() =>
|
|
fetchRemoteImage("https://cdn.example.com/redirect.png", {
|
|
fetchImpl: async () =>
|
|
new Response(null, {
|
|
status: 302,
|
|
headers: { location: "http://169.254.169.254/latest/meta-data" },
|
|
}),
|
|
guard: "public-only",
|
|
}),
|
|
/Blocked private or local provider URL/
|
|
);
|
|
});
|