fix(edge): bound the import request body and block the dummy IPv6 prefix

import-source now reads its own request body with a 16 KB cap under the
same deadline, so a stalled upload gets a 408 instead of holding the
function open and then reporting a misleading source timeout. Adds
100:0:0:1::/64 to the blocked IPv6 ranges.

Replaces the importer source-string assertions with behavior tests for
the byte cap at its exact boundary and the one-day share expiry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Programcode

src/test/security-hardening.test.ts

@@ -69,11 +69,9 @@ describe('security hardening regressions', () => {
     expect(promo).toContain('userClient.rpc("redeem_promo_code_atomic", { p_code: code })');
   });
 
-  it('resolves DNS and bounds importer bodies before processing', () => {
-    expect(importer).toContain('validateResolvedPublicHost(currentUrl, signal)');
-    expect(importer).toContain('readBoundedText(response, deadline.signal)');
-    expect(read('supabase/functions/import-source/resource-limits.ts')).toContain('MAX_RESPONSE_BYTES');
-  });
+  // Importer DNS checks, body caps and the deadline are covered by behavior in
+  // import-source/url-validation.test.ts, import-source/deadline_test.ts and
+  // _shared/bounded-body.test.ts.
 
   it('uses allowlisted model/provider pairs and SSRF-safe citation verification', () => {
     expect(modelCatalog).toContain('id: "z-ai/glm-5.3-flash"');

supabase/functions/_shared/bounded-body.test.ts

@@ -0,0 +1,26 @@
+import { assertEquals, assertRejects } from "jsr:@std/assert@1.0.19";
+import { BodyTooLargeError, readBoundedBody } from "./bounded-body.ts";
+
+// A streamed body with no Content-Length, sent in 1000-byte chunks.
+function streamOf(bytes: number, headers: HeadersInit = {}) {
+  let sent = 0;
+  const body = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (sent >= bytes) return controller.close();
+      const size = Math.min(1000, bytes - sent);
+      sent += size;
+      controller.enqueue(new Uint8Array(size).fill(0x61));
+    },
+  });
+  return new Response(body, { headers });
+}
+
+Deno.test("readBoundedBody accepts a body of exactly the cap and rejects one byte more", async () => {
+  assertEquals((await readBoundedBody(streamOf(4096), 4096)).length, 4096);
+  await assertRejects(() => readBoundedBody(streamOf(4097), 4096), BodyTooLargeError);
+});
+
+Deno.test("readBoundedBody counts bytes received, not the declared Content-Length", async () => {
+  await assertRejects(() => readBoundedBody(streamOf(8000, { "content-length": "10" }), 4096), BodyTooLargeError);
+  await assertRejects(() => readBoundedBody(new Response("tiny", { headers: { "content-length": "4097" } }), 4096), BodyTooLargeError);
+});

supabase/functions/_shared/url-validation.ts

@@ -1,6 +1,9 @@
 // SSRF-safe URL validation for outbound fetches to user- or AI-supplied URLs.
 // Rejects every IPv4 and IPv6 range in the IANA special-purpose registries that
-// is not globally reachable, plus multicast, reserved and NAT64 space.
+// is not globally reachable, plus multicast, reserved and NAT64 space. Whole
+// blocks are rejected even where the registry marks a few anycast or ORCHID
+// addresses inside them as global (192.0.0.9, 2001:3::/32 and the like): none
+// of them serve web pages, so failing closed costs nothing.
 
 type Cidr = readonly [bytes: readonly number[], prefixLength: number];
 
@@ -32,6 +35,7 @@ const BLOCKED_IPV6: readonly Cidr[] = [
   [[0, 0x64, 0xff, 0x9b], 96], // NAT64 well-known prefix
   [[0, 0x64, 0xff, 0x9b, 0, 1], 48], // local-use NAT64
   [[0x01, 0x00], 64], // discard-only
+  [[0x01, 0x00, 0, 0, 0, 0, 0, 0x01], 64], // dummy prefix
   [[0x20, 0x01, 0x00, 0x00], 23], // IETF protocol assignments, including Teredo
   [[0x20, 0x01, 0x0d, 0xb8], 32], // documentation
   [[0x20, 0x02], 16], // 6to4

supabase/functions/import-source/deadline_test.ts

@@ -81,3 +81,53 @@ Deno.test("import-source stops reading a body that drips slower than the deadlin
 Deno.test("import-source stops waiting for a body that never arrives", async () => {
   await importAgainstSlowServer("stall");
 });
+
+Deno.test("import-source stops waiting for a request body that never finishes", async () => {
+  const time = new FakeTime();
+  const originalFetch = globalThis.fetch;
+  const sourceRequests: string[] = [];
+  globalThis.fetch = (async (input: Request | URL | string) => {
+    const url = new URL(input instanceof Request ? input.url : String(input));
+    if (url.pathname === "/auth/v1/user") return Response.json({ id: "user-1", aud: "authenticated" });
+    if (url.pathname.includes("/rest/v1/user_roles")) return Response.json({ role: "user" });
+    if (url.pathname.includes("/rest/v1/rpc/consume_daily_quota")) return Response.json([{ allowed: true, current_count: 1 }]);
+    if (url.pathname.includes("/rest/v1/ai_requests")) return new Response(null, { status: 201 });
+    sourceRequests.push(url.toString());
+    throw new Error(`Unexpected request: ${url}`);
+  }) as typeof fetch;
+
+  let requestCancelled = false;
+  const stalledUpload = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode('{"url": "https://exam'));
+    },
+    pull: () => new Promise<void>(() => {}),
+    cancel() {
+      requestCancelled = true;
+    },
+  });
+
+  try {
+    let settled: Response | undefined;
+    const pending = handleRequest(new Request("http://127.0.0.1/functions/v1/import-source", {
+      method: "POST",
+      headers: { Authorization: "Bearer test-user-token", "Content-Type": "application/json" },
+      body: stalledUpload,
+      duplex: "half",
+    } as RequestInit)).then((response) => (settled = response));
+
+    for (let elapsed = 0; elapsed < 11_000 && !settled; elapsed += 250) {
+      await time.tickAsync(250);
+    }
+    if (!settled) throw new Error("import-source was still reading the request body after 11 s");
+    await pending;
+
+    const body = await settled.json();
+    if (settled.status !== 408) throw new Error(`expected 408, got ${settled.status}: ${JSON.stringify(body)}`);
+    if (!requestCancelled) throw new Error("the request body was not cancelled at the deadline");
+    if (sourceRequests.length) throw new Error(`a source was fetched: ${sourceRequests}`);
+  } finally {
+    globalThis.fetch = originalFetch;
+    time.restore();
+  }
+});

supabase/functions/import-source/index.ts

@@ -1,7 +1,7 @@
 import { createClient, type User } from "https://esm.sh/@supabase/supabase-js@2";
 import { isPrivateIpv4, isPrivateIpv6, validatePublicHttpUrl, validateResolvedPublicHost } from "./url-validation.ts";
 import { readBoundedText } from "./resource-limits.ts";
-import { untilAborted } from "../_shared/bounded-body.ts";
+import { BodyTooLargeError, readBoundedBody, untilAborted } from "../_shared/bounded-body.ts";
 import { HttpError, jsonError, requireUser } from "../_shared/auth.ts";
 import { getCorsHeaders } from "../_shared/cors.ts";
 
@@ -10,9 +10,10 @@ export { isPrivateIpv4, isPrivateIpv6, validatePublicHttpUrl };
 
 
 const MAX_CONTENT_CHARS = 50_000;
-// Total time for DNS, redirects and the whole body, not just the headers.
+// Total time for the request body, DNS, redirects and the whole source body.
 const FETCH_TIMEOUT_MS = 10_000;
 const MAX_REDIRECTS = 5;
+const MAX_REQUEST_BYTES = 16_384;
 const DAILY_IMPORT_LIMIT = 50;
 
 
@@ -274,7 +275,19 @@ export async function handleRequest(req: Request): Promise<Response> {
   const deadline = new AbortController();
   const deadlineTimer = setTimeout(() => deadline.abort(new SourceTimeoutError()), FETCH_TIMEOUT_MS);
   try {
-    const body = await req.json().catch(() => null);
+    let body: { url?: unknown } | null = null;
+    try {
+      body = JSON.parse(await readBoundedBody(req, MAX_REQUEST_BYTES, deadline.signal));
+    } catch (error) {
+      if (deadline.signal.aborted) {
+        await logImport(user.id, "error", "request_timeout", Date.now() - startedAt);
+        return jsonResponse({ error: "The request took too long to arrive." }, 408, corsHeaders);
+      }
+      if (error instanceof BodyTooLargeError) {
+        await logImport(user.id, "error", "bad_request", Date.now() - startedAt);
+        return jsonResponse({ error: "Request body is too large." }, 413, corsHeaders);
+      }
+    }
     if (!body || typeof body !== "object") {
       await logImport(user.id, "error", "bad_request", Date.now() - startedAt);
       return jsonResponse({ error: "Invalid JSON body." }, 400, corsHeaders);

supabase/functions/import-source/url-validation.test.ts

@@ -83,6 +83,7 @@ Deno.test("isPrivateIpv6 rejects every IANA special-purpose range that is not gl
     "64:ff9b::c000:201", "64:ff9b::808:808", // NAT64 well-known prefix 64:ff9b::/96
     "64:ff9b:1::1", // local-use NAT64 64:ff9b:1::/48
     "100::1", // discard-only 100::/64
+    "100:0:0:1::1", // dummy prefix 100:0:0:1::/64
     "2001::1", "2001:1ff::1", // IETF protocol assignments 2001::/23 (Teredo included)
     "2001:db8::1", // documentation 2001:db8::/32
     "2002:c0a8:101::1", // 6to4 2002::/16

supabase/functions/share/limits_test.ts

@@ -75,12 +75,14 @@ Deno.test("share rejects expiries that are not 1 to 90 whole days", async () =>
   }
 });
 
-Deno.test("share honours an expiry at the 90-day limit", async () => {
-  const before = Date.now();
-  const result = await sendShare(shareBody({ expiresInDays: 90 }));
-  assertEquals(result.status, 200);
-  assertEquals(result.calls.inserts.length, 1);
-  assertExpiresInDays(result.calls.inserts[0].expires_at, 90, before);
+Deno.test("share honours expiries at both ends of the 1 to 90 day range", async () => {
+  for (const days of [1, 90]) {
+    const before = Date.now();
+    const result = await sendShare(shareBody({ expiresInDays: days }));
+    assertEquals(result.status, 200, `expiresInDays=${days}`);
+    assertEquals(result.calls.inserts.length, 1);
+    assertExpiresInDays(result.calls.inserts[0].expires_at, days, before);
+  }
 });
 
 Deno.test("share expires a link without an expiry after 30 days and reserves the share quota", async () => {