fix(proxy): block unsafe redirects and local targets (#840)

Author: harlan-zw

docs/content/docs/1.guides/2.first-party.md

@@ -358,7 +358,7 @@ export default defineNuxtConfig({
 Disable security when you need a deterministic SSR payload, such as one used to compute a stable response `etag`. Without it, proxy endpoints still work but remain open to quota abuse and arbitrary requests to their allowlisted upstreams.
 
 ::callout{type="warning"}
-The shared [image-proxy handler](https://github.com/nuxt/scripts/blob/main/packages/script/src/runtime/server/utils/image-proxy.ts) checks the initial URL's scheme and allowed hostname. Several embed image and asset routes then follow upstream redirects without checking each redirect target again. This is an implementation boundary, not evidence that a configured vendor host is exploitable: keep proxy security enabled and do not treat the initial-host allowlist as complete redirect-chain validation.
+Runtime proxy fetches validate the initial upstream URLand every redirect target before requesting it. Direct local, private, link-local, and reserved targets are rejected on every runtime; Node deployments also validate and pin DNS results before opening the socket. Image routes reject active content types such as HTML and SVG. The Instagram embed route restricts post and stylesheet hosts, then sanitizes the returned fragment before client rendering.
 ::
 
 #### Troubleshooting
@@ -381,7 +381,7 @@ Page tokens are valid for 1 hour by default. If a user leaves a tab open longer
 
 **Proxy token changes the response payload on every request**
 
-The module injects a per-request page token into the SSR payload, so the response hash differs each request. If you compute a stable `etag`, set `security: false` to disable proxy security entirely. Proxy endpoints then pass requests through without signature verification, so only do this if you accept the wider request and redirect-validation boundaries described above.
+The module injects a per-request page token into the SSR payload, so the response hash differs each request. If you compute a stable `etag`, set `security: false` to disable proxy security entirely. Proxy endpoints then pass requests through without signature verification, so only do this if you accept the wider request-authorization boundary described above.
 
 #### Static Generation and SPA Mode
 

packages/script/package.json

@@ -143,6 +143,7 @@
 "std-env": "catalog:",
 "ufo": "catalog:",
 "ultrahtml": "catalog:",
+"undici": "catalog:",
 "unplugin": "catalog:",
 "unstorage": "catalog:",
 "valibot": "catalog:"

packages/script/src/module.ts

@@ -16,6 +16,8 @@ import type {
 }from'./runtime/types'
 import{randomBytes}from'node:crypto'
 import{appendFileSync,existsSync,readdirSync,readFileSync,writeFileSync}from'node:fs'
+import{openasopenFile,stat,unlink}from'node:fs/promises'
+import{setTimeoutasdelay}from'node:timers/promises'
 import{
 addBuildPlugin,
 addComponentsDir,
@@ -42,6 +44,7 @@ import { generateInterceptPluginContents } from './plugins/intercept'
 import{NuxtScriptBundleTransformer}from'./plugins/transform'
 import{aliasProxyValue,buildDomainAliasMap,invertAliasMap,isSafeAliasSegment}from'./proxy-alias'
 import{buildProxyConfigsFromRegistry,generatePartytownResolveUrl,getPartytownForwards,registry,resolveCapabilities}from'./registry'
+import{isPublicNetworkHostname}from'./runtime/server/utils/network-host'
 import{registerTypeTemplates,templatePlugin,templateTriggerResolver}from'./templates'
 import{validateScriptsEnvVars}from'./validate-env'
 
@@ -121,8 +124,74 @@ const UPPER_RE = /([A-Z])/g
 consttoScreamingSnake=(s: string)=>s.replace(UPPER_RE,'_$1').toUpperCase()
 
 constPROXY_SECRET_ENV_KEY='NUXT_SCRIPTS_PROXY_SECRET'
-constPROXY_SECRET_ENV_LINE_RE=/^NUXT_SCRIPTS_PROXY_SECRET=/m
+constPROXY_SECRET_ENV_LINE_RE=/^NUXT_SCRIPTS_PROXY_SECRET=.*$/m
 constPROXY_SECRET_ENV_VALUE_RE=/^NUXT_SCRIPTS_PROXY_SECRET=(.+)$/m
+constPROXY_SECRET_LOCK_RETRY_MS=10
+constPROXY_SECRET_LOCK_TIMEOUT_MS=2000
+
+asyncfunctionwithProxySecretFileLock<T>(envPath: string,effect: ()=>T): Promise<T>{
+constlockPath=`${envPath}.nuxt-scripts.lock`
+constdeadline=Date.now()+PROXY_SECRET_LOCK_TIMEOUT_MS
+letlockHandle: Awaited<ReturnType<typeofopenFile>>|undefined
+
+while(!lockHandle){
+constacquisition=awaitopenFile(lockPath,'wx')
+.then(handle=>({_tag: 'Acquired'asconst, handle }))
+.catch((error: NodeJS.ErrnoException)=>{
+if(error.code==='EEXIST')
+return{_tag: 'Busy'asconst}
+throwerror
+})
+
+if(acquisition._tag==='Acquired'){
+lockHandle=acquisition.handle
+break
+}
+
+constexistingLock=awaitstat(lockPath)
+.then(lockStat=>({_tag: 'Found'asconst,mtimeMs: lockStat.mtimeMs}))
+.catch((error: NodeJS.ErrnoException)=>{
+if(error.code==='ENOENT')
+return{_tag: 'Missing'asconst}
+throwerror
+})
+if(existingLock._tag==='Found'&&Date.now()-existingLock.mtimeMs>=PROXY_SECRET_LOCK_TIMEOUT_MS){
+awaitunlink(lockPath).catch((error: NodeJS.ErrnoException)=>{
+if(error.code!=='ENOENT')
+throwerror
+})
+continue
+}
+if(Date.now()>=deadline)
+throwObject.assign(newError('Timed out waiting for proxy secret file lock'),{code: 'ETIMEDOUT'})
+awaitdelay(PROXY_SECRET_LOCK_RETRY_MS)
+}
+
+leteffectResult: {_tag: 'Success',value: T}|{_tag: 'Failure',error: unknown}
+try{
+effectResult={_tag: 'Success',value: effect()}
+}
+catch(error){
+effectResult={_tag: 'Failure', error }
+}
+
+constcloseResult=awaitlockHandle.close()
+.then(()=>({_tag: 'Success'asconst}))
+.catch((error: Error)=>({_tag: 'Failure'asconst, error }))
+constunlinkResult=awaitunlink(lockPath)
+.then(()=>({_tag: 'Success'asconst}))
+.catch((error: NodeJS.ErrnoException)=>error.code==='ENOENT'
+ ? {_tag: 'Success'asconst}
+ : {_tag: 'Failure'asconst, error })
+
+if(closeResult._tag==='Failure')
+logger.warn(`[security] Failed to close the proxy secret lock: ${closeResult.error.message}`)
+if(unlinkResult._tag==='Failure')
+logger.warn(`[security] Failed to remove the proxy secret lock: ${unlinkResult.error.message}`)
+if(effectResult._tag==='Failure')
+throweffectResult.error
+returneffectResult.value
+}
 
 exportinterfaceResolvedProxySecret{
 secret: string
@@ -141,12 +210,12 @@ export interface ResolvedProxySecret {
  * 3. Dev-only auto-generation: write to `.env` (or keep in memory as last resort)
  * 4. Empty string (prod without secret; caller decides whether this is fatal)
  */
-exportfunctionresolveProxySecret(
+exportasyncfunctionresolveProxySecret(
 rootDir: string,
 isDev: boolean,
 configSecret?: string,
 autoGenerate: boolean=true,
-): ResolvedProxySecret|undefined{
+): Promise<ResolvedProxySecret|undefined>{
 if(configSecret)
 return{secret: configSecret,ephemeral: false,source: 'config'}
 
@@ -165,25 +234,30 @@ export function resolveProxySecret(
 constline=`${PROXY_SECRET_ENV_KEY}=${secret}\n`
 
 try{
-if(existsSync(envPath)){
-constcontents=readFileSync(envPath,'utf-8')
-// Safety: don't append if another process already wrote one between the read above
-// and this branch. The regex check is cheap and idempotent.
-if(PROXY_SECRET_ENV_LINE_RE.test(contents)){
-// Another instance already wrote it. Re-read and return that value.
-constmatch=contents.match(PROXY_SECRET_ENV_VALUE_RE)
-if(match?.[1])
-return{secret: match[1].trim(),ephemeral: false,source: 'dotenv-generated'}
+constpersistedSecret=awaitwithProxySecretFileLock(envPath,()=>{
+if(existsSync(envPath)){
+constcontents=readFileSync(envPath,'utf-8')
+constexistingSecret=contents.match(PROXY_SECRET_ENV_VALUE_RE)?.[1]?.trim()
+if(existingSecret)
+returnexistingSecret
+if(PROXY_SECRET_ENV_LINE_RE.test(contents)){
+// An empty declaration suppresses dotenv fallback on future starts.
+// Replace it in place so the generated secret remains stable.
+writeFileSync(envPath,contents.replace(PROXY_SECRET_ENV_LINE_RE,`${PROXY_SECRET_ENV_KEY}=${secret}`))
+}
+else{
+appendFileSync(envPath,contents.endsWith('\n') ? line : `\n${line}`)
+}
 }
-appendFileSync(envPath,contents.endsWith('\n') ? line : `\n${line}`)
-}
-else{
-writeFileSync(envPath,`# Generated by @nuxt/scripts\n${line}`)
-}
+else{
+writeFileSync(envPath,`# Generated by @nuxt/scripts\n${line}`)
+}
+returnsecret
+})
 // Also populate process.env so that anything reading it later in the same
 // dev process (e.g. child workers) sees the value without a restart.
-process.env[PROXY_SECRET_ENV_KEY]=secret
-return{ secret,ephemeral: false,source: 'dotenv-generated'}
+process.env[PROXY_SECRET_ENV_KEY]=persistedSecret
+return{secret: persistedSecret,ephemeral: false,source: 'dotenv-generated'}
 }
 catch{
 // Writing .env failed (read-only FS, permission denied). Fall back to
@@ -251,7 +325,10 @@ function resolveConfiguredProxyDomain(value: unknown): string | undefined {
 return
 
 try{
-returnnewURL(trimmed,'https://nuxt-scripts.local').hostname||undefined
+consturl=newURL(trimmed,'https://nuxt-scripts.local')
+if(url.protocol!=='http:'&&url.protocol!=='https:')
+return
+returnisPublicNetworkHostname(url.hostname) ? url.hostname : undefined
 }
 catch{
 // Invalid user-provided proxy domains cannot be normalized.
@@ -1126,7 +1203,7 @@ export default defineNuxtModule<ModuleOptions>({
 // Resolve the HMAC signing secret only when at least one handler needs it
 // and a server runtime can actually verify signatures.
 elseif(anyHandlerRequiresSigning){
-constproxySecretResolved=resolveProxySecret(
+constproxySecretResolved=awaitresolveProxySecret(
 nuxt.options.rootDir,
 !!nuxt.options.dev,
 config.security?.secret,

packages/script/src/plugins/intercept.ts

@@ -20,7 +20,7 @@ export default defineNuxtPlugin({
  enforce: 'pre',
  setup() {
  const proxyPrefix = ${JSON.stringify(proxyPrefix)};
- const domainAliases = ${JSON.stringify(options?.domainAliases??{})};
+ const domainAliases = Object.assign(Object.create(null), ${JSON.stringify(options?.domainAliases??{})});
  const origBeacon = typeof navigator !== 'undefined' && navigator.sendBeacon
  ? navigator.sendBeacon.bind(navigator)
  : () => false;
@@ -29,11 +29,11 @@ export default defineNuxtPlugin({
  function proxyUrl(url) {
  try {
  const parsed = new URL(url, location.origin);
- if (parsed.origin !== location.origin) {
+ if ((parsed.protocol === 'http:' || parsed.protocol === 'https:') && parsed.origin !== location.origin) {
  const seg = domainAliases[parsed.host] || parsed.host;
  return location.origin + proxyPrefix + '/' + seg + parsed.pathname + parsed.search;
  }
- } catch {}
+ } catch { /* Invalid URL inputs retain native behavior. */ }
  return url;
  }
 

packages/script/src/proxy-alias.ts

@@ -18,7 +18,7 @@ const SAFE_ALIAS_SEGMENT_RE = /^[\w.-]+$/
 
 /** Whether an explicit alias is a single URL-safe path segment. */
 exportfunctionisSafeAliasSegment(alias: string): boolean{
-returnSAFE_ALIAS_SEGMENT_RE.test(alias)
+returnalias!=='.'&&alias!=='..'&&SAFE_ALIAS_SEGMENT_RE.test(alias)
 }
 
 /**
@@ -42,21 +42,18 @@ export function aliasForDomain(domain: string, alias: ProxyAliasConfig): string
 
 /** Build a `domain → alias` map for the given proxied domains. */
 exportfunctionbuildDomainAliasMap(domains: Iterable<string>,alias: ProxyAliasConfig): Record<string,string>{
-constmap: Record<string,string>={}
+constentries: Array<[string,string]>=[]
 for(constdomainofdomains){
 constvalue=aliasForDomain(domain,alias)
 if(value)
-map[domain]=value
+entries.push([domain,value])
 }
-returnmap
+returnObject.fromEntries(entries)
 }
 
 /** Invert a `domain → alias` map into the `alias → domain` map the proxy handler resolves with. */
 exportfunctioninvertAliasMap(map: Record<string,string>): Record<string,string>{
-constout: Record<string,string>={}
-for(const[domain,alias]ofObject.entries(map))
-out[alias]=domain
-returnout
+returnObject.fromEntries(Object.entries(map).map(([domain,alias])=>[alias,domain]))
 }
 
 /**

packages/script/src/registry.ts

@@ -901,8 +901,8 @@ export async function registry(resolve?: (path: string) => Promise<string>): Pro
  */
 exportfunctiongeneratePartytownResolveUrl(proxyPrefix: string,domainAliases: Record<string,string>={}): string{
 return`function(url, location, type) {
- if (url.origin !== location.origin) {
- var aliases = ${JSON.stringify(domainAliases)};
+ if ((url.protocol === 'http:' || url.protocol === 'https:') && url.origin !== location.origin) {
+ var aliases = Object.assign(Object.create(null), ${JSON.stringify(domainAliases)});
  var seg = aliases[url.host] || url.host;
  return new URL(${JSON.stringify(proxyPrefix)} + '/' + seg + url.pathname + url.search, location.origin);
  }

packages/script/src/runtime/server/bluesky-embed.ts

@@ -1,6 +1,6 @@
 import{createError,defineEventHandler,getQuery,setHeader}from'#nuxt-scripts/h3'
 import{useRuntimeConfig}from'#nuxt-scripts/nitro'
-import{createCachedJsonFetch}from'./utils/cached-upstream'
+import{createCachedJsonFetch,isSafeHttpsUrl}from'./utils/cached-upstream'
 import{rewriteBlueskyPostImages}from'./utils/embed-rewriters'
 import{withSigning}from'./utils/withSigning'
 
@@ -25,6 +25,7 @@ interface PostThreadResponse {
 
 constBSKY_POST_URL_RE=/^https:\/\/bsky\.app\/profile\/([^/]+)\/post\/([^/?]+)$/
 constEMBED_BSKY_SUFFIX_RE=/\/embed\/bluesky$/
+constallowBlueskyApiUrl=(url: URL)=>isSafeHttpsUrl(url)&&url.hostname==='public.api.bsky.app'
 
 // Handle → DID resolution is stable for the lifetime of the handle (renames
 // are rare); cache for 24h so repeated embeds of the same author skip the
@@ -33,6 +34,10 @@ const cachedProfileFetch = createCachedJsonFetch<{ did: string }>(
 'nuxt-scripts-bsky-profile',
 86400,
 url=>url,
+{
+allowUrl: allowBlueskyApiUrl,
+contentTypePrefixes: ['application/json'],
+},
 )
 
 // Post threads are semi-fresh (like counts, reply counts change); 10min keeps
@@ -41,6 +46,10 @@ const cachedPostFetch = createCachedJsonFetch<PostThreadResponse>(
 'nuxt-scripts-bsky-post',
 600,
 url=>url,
+{
+allowUrl: allowBlueskyApiUrl,
+contentTypePrefixes: ['application/json'],
+},
 )
 
 exportdefaultwithSigning(defineEventHandler(async(event)=>{

packages/script/src/runtime/server/google-maps-geocode-proxy.ts

@@ -1,7 +1,8 @@
 import{withQuery}from'ufo'
 import{createError,defineEventHandler,getQuery,setHeader}from'#nuxt-scripts/h3'
 import{useRuntimeConfig}from'#nuxt-scripts/nitro'
-import{createCachedJsonFetch}from'./utils/cached-upstream'
+import{createCachedJsonFetch,isSafeHttpsUrl}from'./utils/cached-upstream'
+import{stripProxyAuthQuery}from'./utils/proxy-query'
 import{withSigning}from'./utils/withSigning'
 
 // Addresses rarely change; a 30-day cache avoids billable geocode lookups for
@@ -11,6 +12,10 @@ const cachedGeocodeFetch = createCachedJsonFetch<any>(
 'nuxt-scripts-geocode',
 2592000,
 url=>url,
+{
+allowUrl: url=>isSafeHttpsUrl(url)&&url.hostname==='maps.googleapis.com',
+contentTypePrefixes: ['application/json'],
+},
 )
 
 exportdefaultwithSigning(defineEventHandler(async(event)=>{
@@ -25,7 +30,7 @@ export default withSigning(defineEventHandler(async (event) => {
 })
 }
 
-constquery=getQuery(event)
+constquery=stripProxyAuthQuery(getQuery(event))
 const{key: _clientKey, ...safeQuery}=query
 
 constgeocodeUrl=withQuery('https://maps.googleapis.com/maps/api/geocode/json',{