Update CHANGELOG

Author: ingalls

CHANGELOG.md

@@ -12,6 +12,10 @@
 
 ### Pending Fixed
 
+### v1.7.0 - 2026-07-09
+
+- :tada: Add a default 20s request `timeout` to `fetch`, applied across all redirect hops and combinable with a caller-supplied `signal`
+
 ### v1.6.0 - 2026-07-04
 
 - :rocket: Add Type Coercion to TypedResponse to allow for more flexible response handling

lib/fetch.ts

@@ -8,6 +8,9 @@ import { isSafeUrl } from './safeurl.js';
 
 const cache = new WeakMap<TSchema, ReturnType<typeof TypeCompiler.Compile>>();
 
+/** Default request timeout (ms) applied when the caller does not override it. */
+export const DEFAULT_TIMEOUT_MS = 20_000;
+
 export interface FetchInit extends RequestInit {
     /** Set to false to disable SSRF-safe URL validation. Defaults to true. */
     safeUrl?: boolean;
@@ -19,6 +22,14 @@ export interface FetchInit extends RequestInit {
      * endpoints such as the CloudTAK API when it runs inside a VPC.
      */
     safeUrlAllow?: string[];
+    /**
+     * Abort the request after this many milliseconds.  The timeout covers the
+     * whole operation, including any redirect hops.  Defaults to
+     * {@link DEFAULT_TIMEOUT_MS} (20s).  Set to `0` (or a negative value) to
+     * disable the timeout.  When the caller also supplies a `signal`, both it
+     * and the timeout are honoured — whichever aborts first wins.
+     */
+    timeout?: number;
 }
 
 export class TypedResponse extends Response {
@@ -81,7 +92,18 @@ export default async function (
     input: RequestInfo,
     init?: FetchInit,
 ): Promise<TypedResponse> {
-    const { safeUrl = true, safeUrlAllow: allow, ...fetchInit } = init ?? {};
+    const { safeUrl = true, safeUrlAllow: allow, timeout = DEFAULT_TIMEOUT_MS, ...fetchInit } = init ?? {};
+
+    // Attach a timeout AbortSignal covering the whole operation (all redirect
+    // hops share the same deadline). If the caller passed their own signal,
+    // combine the two so either can abort the request.
+    if (timeout > 0) {
+        const timeoutSignal = AbortSignal.timeout(timeout);
+        const callerSignal = fetchInit.signal ?? undefined;
+        fetchInit.signal = callerSignal
+            ? AbortSignal.any([callerSignal, timeoutSignal])
+            : timeoutSignal;
+    }
 
     if (safeUrl) {
         // Reject custom dispatchers: they can route requests to arbitrary internal

package.json

@@ -1,7 +1,7 @@
 {
     "name": "@tak-ps/node-safeurl",
     "type": "module",
-    "version": "1.6.0",
+    "version": "1.7.0",
     "description": "SSRF-safe URL validation library for Node.js",
     "author": "Nick Ingalls <nick@ingalls.ca>",
     "types": "./dist/index.d.ts",

test/fetch.test.ts

@@ -77,6 +77,57 @@ test('safeFetch — allows custom dispatcher when safeUrl is disabled', async ()
     await agent.close();
 });
 
+test('safeFetch — aborts a slow request after the timeout', async () => {
+    const { MockAgent } = await import('undici');
+    const agent = new MockAgent();
+    agent.disableNetConnect();
+    const client = agent.get('http://example.com');
+    client.intercept({ path: '/', method: 'GET' }).reply(200, '{}').delay(1000);
+
+    await assert.rejects(
+        () => safeFetch('http://example.com/', { safeUrl: false, dispatcher: agent, timeout: 50 }),
+        (err: Error) => {
+            assert.strictEqual(err.name, 'TimeoutError');
+            return true;
+        },
+    );
+    await agent.close();
+});
+
+test('safeFetch — timeout: 0 disables the timeout', async () => {
+    const { MockAgent } = await import('undici');
+    const agent = new MockAgent();
+    agent.disableNetConnect();
+    const client = agent.get('http://example.com');
+    client.intercept({ path: '/', method: 'GET' }).reply(200, '{}').delay(50);
+
+    const res = await safeFetch('http://example.com/', { safeUrl: false, dispatcher: agent, timeout: 0 });
+    assert.strictEqual(res.status, 200);
+    await agent.close();
+});
+
+test('safeFetch — caller signal still aborts alongside the timeout', async () => {
+    const { MockAgent } = await import('undici');
+    const agent = new MockAgent();
+    agent.disableNetConnect();
+    const client = agent.get('http://example.com');
+    client.intercept({ path: '/', method: 'GET' }).reply(200, '{}').delay(1000);
+
+    const controller = new AbortController();
+    const p = safeFetch('http://example.com/', {
+        safeUrl: false,
+        dispatcher: agent,
+        signal: controller.signal,
+    });
+    controller.abort();
+
+    await assert.rejects(p, (err: Error) => {
+        assert.strictEqual(err.name, 'AbortError');
+        return true;
+    });
+    await agent.close();
+});
+
 test('TypedResponse — preserves wrapped response url', () => {
     const raw = new Response('{}', { status: 200 });
     const typed = new TypedResponse(raw);