Spaces:
Running
Running
| import puppeteer from 'puppeteer'; | |
| import { BROWSER_LAUNCH_ARGS } from '../config.js'; | |
| let browser; | |
| // One shared Chromium instance, relaunched if it disconnects | |
| export async function getBrowser() { | |
| if (!browser || !browser.connected) { | |
| if (browser) await browser.close().catch(() => {}); | |
| console.log('Launching new browser instance...'); | |
| browser = await puppeteer.launch({ | |
| headless: 'new', | |
| executablePath: process.env.PUPPETEER_EXECUTABLE_PATH || undefined, | |
| args: BROWSER_LAUNCH_ARGS | |
| }); | |
| } | |
| return browser; | |
| } | |
| // Helper to block SSRF, metadata endpoints, and local file access | |
| export async function setupPageSecurity(page) { | |
| await page.setRequestInterception(true); | |
| page.on('request', (req) => { | |
| const urlStr = req.url(); | |
| try { | |
| const parsedUrl = new URL(urlStr); | |
| const protocol = parsedUrl.protocol.toLowerCase(); | |
| const hostname = parsedUrl.hostname.toLowerCase(); | |
| // Block file://, ftp://, and other non-web protocols | |
| if (protocol !== 'http:' && protocol !== 'https:' && protocol !== 'data:' && protocol !== 'blob:') { | |
| return req.abort(); | |
| } | |
| // Block cloud metadata services and local network access | |
| const blockedHosts = ['169.254.169.254', 'metadata.google.internal', 'localhost', '127.0.0.1', '0.0.0.0', '::1']; | |
| if (blockedHosts.includes(hostname) || hostname.startsWith('10.') || hostname.startsWith('192.168.') || hostname.startsWith('172.16.')) { | |
| console.warn(`[Security Block] Blocked SSRF attempt to: ${urlStr}`); | |
| return req.abort(); | |
| } | |
| req.continue(); | |
| } catch { | |
| // If URL is invalid or unparseable and not data/blob, abort | |
| if (!urlStr.startsWith('data:') && !urlStr.startsWith('blob:')) { | |
| return req.abort(); | |
| } | |
| req.continue(); | |
| } | |
| }); | |
| } | |
| // ── Startup smoke test: verify Chromium can actually launch ── | |
| export async function verifyChromiumLaunch() { | |
| try { | |
| console.log('[Startup] Testing Chromium launch...'); | |
| console.log('[Startup] PUPPETEER_EXECUTABLE_PATH =', process.env.PUPPETEER_EXECUTABLE_PATH || '(not set, using bundled)'); | |
| console.log('[Startup] PUPPETEER_CACHE_DIR =', process.env.PUPPETEER_CACHE_DIR || '(not set)'); | |
| const testBrowser = await puppeteer.launch({ | |
| headless: 'new', | |
| executablePath: process.env.PUPPETEER_EXECUTABLE_PATH || undefined, | |
| args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu'] | |
| }); | |
| const version = await testBrowser.version(); | |
| console.log(`[Startup] ✅ Chromium launched successfully: ${version}`); | |
| await testBrowser.close(); | |
| } catch (err) { | |
| console.error('[Startup] ❌ Chromium launch FAILED:', err.message); | |
| console.error('[Startup] Full error:', err); | |
| } | |
| } | |