fix(parse-url): block SSRF via private/internal URLs

/api/parse-url accepted any URL the user submitted, fetched it via @extractus/article-extractor, and returned the body as Markdown. With ALLOW_PRIVATE_URLS unset (the default after #600) the SSRF guard short-circuited entirely, so an unauthenticated POST could probe container ports, read AWS IMDS / GCP metadata, and reach same-VPC internal services. - parse-url now always rejects private URLs regardless of ALLOW_PRIVATE_URLS. The flag's only legitimate use case is local LLM provider baseUrl overrides (validate-model, chat); article extraction has no business fetching internal hosts. Local LLM setups (Ollama, LM Studio, etc.) are unaffected. - Strip a trailing dot from the hostname before equality checks so the FQDN form "localhost." (which still resolves to 127.0.0.1) is caught by the existing string match. Known follow-ups (not addressed here): - DNS rebinding: hostnames are matched as strings; a public domain resolving to 127.0.0.1 (e.g. localtest.me) is not caught. - HTTP redirects: @extractus/article-extractor uses cross-fetch with default redirect: "follow" and exposes no hook, so a public URL 302-ing to an internal host still leaks.
chore: bump version to 0.4.16 (#843 )
2026-10-05 01:07:56 +08:00 · 2026-05-21 23:50:30 +09:00 · 2026-05-21 09:28:55 +09:00 · 2026-05-21 09:05:06 +09:00 · 2026-05-21 09:01:42 +09:00 · 2026-05-21 09:01:03 +09:00
5 changed files with 1526 additions and 976 deletions
@@ -1,7 +1,7 @@
 import { extract } from "@extractus/article-extractor"
 import { NextResponse } from "next/server"
 import TurndownService from "turndown"
-import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
+import { isPrivateUrl } from "@/lib/ssrf-protection"

 const MAX_CONTENT_LENGTH = 150000 // Match PDF limit
 const EXTRACT_TIMEOUT_MS = 15000
@@ -28,8 +28,10 @@ export async function POST(req: Request) {
            )
        }

-        // SSRF protection
-        if (!allowPrivateUrls && isPrivateUrl(url)) {
+        // SSRF protection: parse-url has no use case for fetching internal
+        // hosts, so private URLs are always rejected. ALLOW_PRIVATE_URLS only
+        // governs LLM provider baseUrl overrides (validate-model, chat).
+        if (isPrivateUrl(url)) {
            return NextResponse.json(
                { error: "Cannot access private/internal URLs" },
                { status: 400 },
@@ -9,7 +9,9 @@
 export function isPrivateUrl(urlString: string): boolean {
    try {
        const url = new URL(urlString)
-        const hostname = url.hostname.toLowerCase()
+        // Strip a trailing dot so FQDN forms like "localhost." (which still
+        // resolve to 127.0.0.1) cannot bypass the equality checks below.
+        const hostname = url.hostname.toLowerCase().replace(/\.$/, "")

        // Block localhost
        if (
@@ -1,6 +1,6 @@
 {
    "name": "next-ai-draw-io",
-    "version": "0.4.15",
+    "version": "0.4.16",
    "license": "Apache-2.0",
    "private": true,
    "main": "dist-electron/main/index.js",
@@ -49,9 +49,9 @@
        "@langfuse/tracing": "^4.4.9",
        "@next/third-parties": "^16.0.6",
        "@opennextjs/cloudflare": "^1.17.1",
-        "@openrouter/ai-sdk-provider": "^1.5.4",
+        "@openrouter/ai-sdk-provider": "^2.0.0",
        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/exporter-trace-otlp-http": "^0.214.0",
+        "@opentelemetry/exporter-trace-otlp-http": "^0.216.0",
        "@opentelemetry/sdk-trace-node": "^2.2.0",
        "@radix-ui/react-alert-dialog": "^1.1.15",
        "@radix-ui/react-collapsible": "^1.1.12",
@@ -77,7 +77,7 @@
        "nanoid": "^5.0.0",
        "negotiator": "^1.0.0",
        "next": "^16.0.7",
-        "ollama-ai-provider-v2": "^2.0.0",
+        "ollama-ai-provider-v2": "^3.0.0",
        "pako": "^2.1.0",
        "prism-react-renderer": "^2.4.1",
        "react": "^19.1.2",
@@ -108,7 +108,7 @@
    },
    "devDependencies": {
        "@anthropic-ai/tokenizer": "^0.0.4",
-        "@biomejs/biome": "2.4.10",
+        "@biomejs/biome": "2.4.13",
        "@playwright/test": "^1.57.0",
        "@tailwindcss/postcss": "^4",
        "@tailwindcss/typography": "^0.5.19",
@@ -127,7 +127,7 @@
        "cross-env": "^10.1.0",
        "electron": "^39.2.7",
        "electron-builder": "^26.0.12",
-        "esbuild": "^0.27.2",
+        "esbuild": "^0.28.0",
        "eslint": "9.39.4",
        "eslint-config-next": "16.1.6",
        "husky": "^9.1.7",
@@ -521,9 +521,9 @@
            }
        },
        "node_modules/@types/node": {
-            "version": "24.12.0",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
-            "integrity": "sha512-GYDxsZi3ChgmckRT9HPU0WEhKLP08ev/Yfcq2AstjrDASOYCSXeyjDsHg4v5t4jOj7cyDX3vmprafKlWIG9MXQ==",
+            "version": "24.12.2",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
+            "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
            "dev": true,
            "license": "MIT",
            "dependencies": {
@@ -2062,9 +2062,9 @@
            }
        },
        "node_modules/zod": {
-            "version": "4.3.6",
-            "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
-            "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
+            "version": "4.4.1",
+            "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.1.tgz",
+            "integrity": "sha512-a6ENMBBGZBsnlSebQ/eKCguSBeGKSf4O7BPnqVPmYGtpBYI7VSqoVqw+QcB7kPRjbqPwhYTpFbVj/RqNz/CT0Q==",
            "license": "MIT",
            "funding": {
                "url": "https://github.com/sponsors/colinhacks"
Author	SHA1	Message	Date
dayuan.jiang	9656fc0cfe	fix(parse-url): block SSRF via private/internal URLs /api/parse-url accepted any URL the user submitted, fetched it via @extractus/article-extractor, and returned the body as Markdown. With ALLOW_PRIVATE_URLS unset (the default after #600) the SSRF guard short-circuited entirely, so an unauthenticated POST could probe container ports, read AWS IMDS / GCP metadata, and reach same-VPC internal services. - parse-url now always rejects private URLs regardless of ALLOW_PRIVATE_URLS. The flag's only legitimate use case is local LLM provider baseUrl overrides (validate-model, chat); article extraction has no business fetching internal hosts. Local LLM setups (Ollama, LM Studio, etc.) are unaffected. - Strip a trailing dot from the hostname before equality checks so the FQDN form "localhost." (which still resolves to 127.0.0.1) is caught by the existing string match. Known follow-ups (not addressed here): - DNS rebinding: hostnames are matched as strings; a public domain resolving to 127.0.0.1 (e.g. localtest.me) is not caught. - HTTP redirects: @extractus/article-extractor uses cross-fetch with default redirect: "follow" and exposes no hook, so a public URL 302-ing to an internal host still leaks.	2026-05-21 23:50:30 +09:00
Dayuan Jiang	1115b2d2cd	chore: bump version to 0.4.16 (#843 )	2026-05-21 09:28:55 +09:00
renovate[bot]	08afb6dd34	chore(deps): update dependency next to v16.2.6 [security] (#842 ) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>	2026-05-21 09:05:06 +09:00
renovate[bot]andgithub-actions[bot]	c703159e00	fix(deps): update core framework packages (major) (#724 ) * fix(deps): update core framework packages * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 09:01:42 +09:00
renovate[bot]andgithub-actions[bot]	ee75408136	chore(deps): update dependency electron to v39.8.5 [security] (#789 ) * chore(deps): update dependency electron to v39.8.5 [security] * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 09:01:03 +09:00
renovate[bot]andgithub-actions[bot]	2ed1a64ae3	fix(deps): update minor and patch dependencies (#829 ) * fix(deps): update minor and patch dependencies * style: auto-format with Biome --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-21 08:59:18 +09:00
Dayuan Jiang	2f2d75961d	chore: remove dead code from previous #815 fix attempts (#841 ) PR #840 fixed issue #815 in the Electron main process via will-prevent-unload + preventDefault. The renderer-side workarounds introduced by previous fix attempts (#642, #648) are no longer needed and never had effect for their stated purpose. Removed: - configuration={ confirmExit: false } in DrawIoEmbed confirmExit is not a recognized draw.io config key (zero matches in jgraph/drawio source). This was always dead code. - modified=0 / keepmodified=0 URL parameters Per drawio source (app.min.js:14898), these only suppress the post-save modified-flag clearing — they do not prevent edits from setting editor.modified=true. They were ineffective for blocking beforeunload prompts and actually prevented draw.io from clearing its modified flag after save. - canPersist / canPersistChecked state and isIndexedDBUsable() probe Their only purpose was gating the dead config above. Removing them also removes a startup delay before the iframe renders. - handleDrawioAutoSave wrapper After PR #780 stripped its body, it was a pure passthrough useCallback. Now passes handleDiagramAutoSave directly to onAutoSave. - withDB / isClosingError / resetDBPromise / onversionchange / onclose / terminated handlers in lib/session-storage.ts and lib/template-storage.ts PR #648 added these to recover from 'IDBDatabase: connection is closing' errors that PR #642's first land caused via db.close() on the shared singleton. That bug was already fixed in `c5de1a1` (re-land of #642), three minutes before PR #648 commits started. The retry handlers defend against multi-tab / version-change scenarios that cannot occur in this single-instance Electron app (requestSingleInstanceLock). template-storage.ts copied the same pattern when introduced by #773. Verified: - npx tsc --noEmit passes - Manual test in dev mode: session save/load works, template create works, diagram-only persistence works.	2026-05-21 08:37:14 +09:00