jshttp

package
v0.39.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 17, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

View Source
const Name = "http"

Name is the library identifier and the global binding installed into the runtime.

Variables

View Source
var (
	// ErrInvalidRequest is thrown into the script for a malformed call, e.g.
	// an unknown redirect mode.
	ErrInvalidRequest = errors.New("jshttp: invalid request")
	// ErrSchemeNotAllowed is thrown into the script for URL schemes other
	// than http and https.
	ErrSchemeNotAllowed = errors.New("jshttp: scheme not allowed")
	// ErrHostNotAllowed is thrown into the script when the target host is
	// outside the allowlist configured with WithAllowedHosts.
	ErrHostNotAllowed = errors.New("jshttp: host not allowed")
	// ErrAddressNotAllowed is thrown into the script when WithPublicNetworkOnly
	// is set and the target resolves to a loopback, private, link-local, or
	// unspecified address.
	ErrAddressNotAllowed = errors.New("jshttp: address not allowed")
	// ErrBodyTooLarge is thrown into the script when the response body
	// exceeds the limit configured with WithMaxBodySize.
	ErrBodyTooLarge = errors.New("jshttp: response body too large")
	// ErrRedirectBlocked is thrown into the script when a redirect arrives
	// under redirect mode "error".
	ErrRedirectBlocked = errors.New("jshttp: redirect blocked")
	// ErrTooManyRedirects is thrown into the script when a redirect chain
	// exceeds the redirect limit.
	ErrTooManyRedirects = errors.New("jshttp: too many redirects")
)

Functions

func New

func New(opts ...Option) js.Lib

New builds the http library. Without options every reachable target is allowed and no resource limits apply; see Option for the opt-in restrictions.

Types

type Option

type Option func(*libConfig)

Option customizes the http library.

func WithAllowedHosts

func WithAllowedHosts(hosts ...string) Option

WithAllowedHosts restricts requests (including every redirect hop) to the given hostnames, matched case-insensitively and without ports.

func WithClient

func WithClient(client *http.Client) Option

WithClient supplies a custom http.Client, replacing the built-in client entirely. URL-level checks (scheme, host allowlist, literal public-only addresses) still apply to every request, but the dial-time address guard and the per-request redirect modes ride on the built-in client only — a custom client brings its own transport and redirect policy.

func WithMaxBodySize

func WithMaxBodySize(n int64) Option

WithMaxBodySize caps the response body size in bytes; larger responses fail the request instead of being silently truncated. Without this option the body size is unbounded.

func WithPublicNetworkOnly

func WithPublicNetworkOnly() Option

WithPublicNetworkOnly enables the SSRF guard: requests to loopback, private (RFC 1918 / ULA), link-local (including the cloud metadata endpoint), multicast, and unspecified addresses are rejected. The guard validates the resolved address at dial time, so DNS rebinding cannot evade it.

func WithTimeout

func WithTimeout(d time.Duration) Option

WithTimeout restricts every request to d. It is both the default and the upper bound: a script-supplied timeout may only shorten it. Without this option requests are bounded only by the runtime's execution context.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL