fix(stage-tamagotchi): restrict openai-compatible fetch bridge

Author: jim139129

apps/stage-tamagotchi/src/main/services/airi/openai-compatible-fetch.ts

@@ -1,19 +1,96 @@
 import type { createContext as createMainEventaContext } from '@moeru/eventa/adapters/electron/main'
 
+import { isIP } from 'node:net'
+
 import { defineStreamInvokeHandler } from '@moeru/eventa'
 import { openAICompatibleFetch } from '@proj-airi/stage-shared'
 
+function normalizeRequestMethod(method: string | undefined): string {
+  return (method ?? 'GET').toUpperCase()
+}
+
+function normalizePathname(pathname: string): string {
+  return pathname.replace(/\/+$/, '')
+}
+
+function isAllowedOpenAICompatiblePath(url: URL, method: string): boolean {
+  const pathname = normalizePathname(url.pathname)
+  if ((method === 'GET' || method === 'HEAD') && pathname.endsWith('/models'))
+    return true
+
+  return method === 'POST' && pathname.endsWith('/chat/completions')
+}
+
+function normalizeHostname(hostname: string): string {
+  return hostname.toLowerCase().replace(/^\[(.*)\]$/, '$1')
+}
+
+function isBlockedHostname(hostname: string): boolean {
+  return hostname === 'localhost'
+    || hostname.endsWith('.localhost')
+    || hostname.endsWith('.local')
+    || hostname === 'host.docker.internal'
+}
+
+function isBlockedIPv4Address(address: string): boolean {
+  const parts = address.split('.').map(part => Number.parseInt(part, 10))
+  if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255))
+    return true
+
+  const [first, second] = parts
+  return first === 0
+    || first === 10
+    || first === 127
+    || first >= 224
+    || (first === 100 && second >= 64 && second <= 127)
+    || (first === 169 && second === 254)
+    || (first === 172 && second >= 16 && second <= 31)
+    || (first === 192 && second === 168)
+    || (first === 198 && (second === 18 || second === 19))
+}
+
+function isBlockedIPAddress(address: string): boolean {
+  const ipVersion = isIP(address)
+  if (ipVersion === 4)
+    return isBlockedIPv4Address(address)
+  if (ipVersion !== 6)
+    return true
+
+  const normalized = address.toLowerCase()
+  if (normalized.startsWith('::ffff:'))
+    return isBlockedIPv4Address(normalized.slice('::ffff:'.length))
+
+  return normalized === '::'
+    || normalized === '::1'
+    || normalized.startsWith('fc')
+    || normalized.startsWith('fd')
+    || normalized.startsWith('fe80:')
+}
+
+function assertAllowedBridgeTarget(url: URL, method: string) {
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error('OpenAI-compatible fetch only supports http and https URLs.')
+  }
+  if (!isAllowedOpenAICompatiblePath(url, method)) {
+    throw new Error('OpenAI-compatible fetch bridge only supports model listing and chat completions requests.')
+  }
+
+  const hostname = normalizeHostname(url.hostname)
+  if (isBlockedHostname(hostname) || (isIP(hostname) !== 0 && isBlockedIPAddress(hostname))) {
+    throw new Error('OpenAI-compatible fetch bridge does not allow local or private network targets.')
+  }
+}
+
 export function setupOpenAICompatibleFetchBridge(params: {
   context: ReturnType<typeof createMainEventaContext>['context']
 }) {
   defineStreamInvokeHandler(params.context, openAICompatibleFetch, async function* (payload, options) {
     const url = new URL(payload.url)
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-      throw new Error('OpenAI-compatible fetch only supports http and https URLs.')
-    }
+    const method = normalizeRequestMethod(payload.method)
+    assertAllowedBridgeTarget(url, method)
 
     const response = await fetch(url, {
-      method: payload.method,
+      method,
       headers: payload.headers,
       body: payload.body,
       signal: options?.abortController?.signal,