Deluan Quintão
652c27690b
* feat(httpclient): implement HttpClient service for outbound HTTP requests in plugins Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): enhance SSRF protection by validating host requests against private IPs Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): support DELETE requests with body in HttpClient service Signed-off-by: Deluan <deluan@navidrome.org> * feat(httpclient): refactor HTTP client initialization and enhance redirect handling Signed-off-by: Deluan <deluan@navidrome.org> * refactor(http): standardize naming conventions for HTTP types and methods Signed-off-by: Deluan <deluan@navidrome.org> * refactor example plugin to use host.HTTPSend for improved error management Signed-off-by: Deluan <deluan@navidrome.org> * fix(plugins): fix IPv6 SSRF bypass and wildcard host matching Fix two bugs in the plugin HTTP/WebSocket host validation: 1. extractHostname now strips IPv6 brackets when no port is present (e.g. "[::1]" → "::1"). Previously, net.SplitHostPort failed for bracketed IPv6 without a port, leaving brackets intact. This caused net.ParseIP to return nil, bypassing the private/loopback SSRF guard. 2. matchHostPattern now treats "*" as an allow-all pattern. Previously, a bare "*" only matched via exact equality, so plugins declaring requiredHosts: ["*"] (like webhook-rs) had all requests rejected. --------- Signed-off-by: Deluan <deluan@navidrome.org>
88 lines
2.4 KiB
Go
88 lines
2.4 KiB
Go
// Code generated by ndpgen. DO NOT EDIT.
|
|
//
|
|
// This file contains client wrappers for the HTTP host service.
|
|
// It is intended for use in Navidrome plugins built with TinyGo.
|
|
//
|
|
//go:build wasip1
|
|
|
|
package host
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
|
|
"github.com/navidrome/navidrome/plugins/pdk/go/pdk"
|
|
)
|
|
|
|
// HTTPRequest represents an outbound HTTP request from a plugin.
|
|
type HTTPRequest struct {
|
|
Method string `json:"method"`
|
|
URL string `json:"url"`
|
|
Headers map[string]string `json:"headers"`
|
|
Body []byte `json:"body"`
|
|
TimeoutMs int32 `json:"timeoutMs"`
|
|
}
|
|
|
|
// HTTPResponse represents the response from an outbound HTTP request.
|
|
type HTTPResponse struct {
|
|
StatusCode int32 `json:"statusCode"`
|
|
Headers map[string]string `json:"headers"`
|
|
Body []byte `json:"body"`
|
|
}
|
|
|
|
// http_send is the host function provided by Navidrome.
|
|
//
|
|
//go:wasmimport extism:host/user http_send
|
|
func http_send(uint64) uint64
|
|
|
|
type httpSendRequest struct {
|
|
Request HTTPRequest `json:"request"`
|
|
}
|
|
|
|
type httpSendResponse struct {
|
|
Result *HTTPResponse `json:"result,omitempty"`
|
|
Error string `json:"error,omitempty"`
|
|
}
|
|
|
|
// HTTPSend calls the http_send host function.
|
|
// Send executes an HTTP request and returns the response.
|
|
//
|
|
// Parameters:
|
|
// - request: The HTTP request to execute, including method, URL, headers, body, and timeout
|
|
//
|
|
// Returns the HTTP response with status code, headers, and body.
|
|
// Network errors, timeouts, and permission failures are returned as Go errors.
|
|
// Successful HTTP calls (including 4xx/5xx status codes) return a non-nil response with nil error.
|
|
func HTTPSend(request HTTPRequest) (*HTTPResponse, error) {
|
|
// Marshal request to JSON
|
|
req := httpSendRequest{
|
|
Request: request,
|
|
}
|
|
reqBytes, err := json.Marshal(req)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
reqMem := pdk.AllocateBytes(reqBytes)
|
|
defer reqMem.Free()
|
|
|
|
// Call the host function
|
|
responsePtr := http_send(reqMem.Offset())
|
|
|
|
// Read the response from memory
|
|
responseMem := pdk.FindMemory(responsePtr)
|
|
responseBytes := responseMem.ReadBytes()
|
|
|
|
// Parse the response
|
|
var response httpSendResponse
|
|
if err := json.Unmarshal(responseBytes, &response); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// Convert Error field to Go error
|
|
if response.Error != "" {
|
|
return nil, errors.New(response.Error)
|
|
}
|
|
|
|
return response.Result, nil
|
|
}
|