Description

splitMediaFromOutput now extracts media URLs not only from explicit MEDIA: directives, but also from Markdown image syntax (![alt](destination)). The extracted destination is treated as media if it matches ^https?:// and passes isValidMedia(), which unconditionally returns true for any http(s) URL.

This introduces a new path for untrusted text to cause downstream components to treat arbitrary attacker-controlled URLs as media:

• Input: untrusted agent/tool output text containing ![x](http://...) / ![x](https://...)
• Normalization/cleaning: unwrapQuoted / cleanCandidate / normalizeMediaSource
• Approval: isRemoteMarkdownImageMedia() which only checks scheme + isValidMedia()
• Output: URL is appended to mediaUrls and emitted as a {type: "media"} segment

If downstream logic fetches, proxies, or otherwise dereferences mediaUrls (common for rendering, previewing, uploading, or safety scanning), an attacker can trigger SSRF to internal services (e.g., http://127.0.0.1, http://169.254.169.254, RFC1918 ranges) simply by embedding a Markdown image.

Vulnerable code:

const target = normalizeMediaSource(
  cleanCandidate(unwrapQuoted(match.destination) ?? match.destination),
);
if (isRemoteMarkdownImageMedia(target)) {
  params.media.push(target);
  lineSegments.push({ type: "media", url: target });
}

function isRemoteMarkdownImageMedia(candidate: string): boolean {
  return /^https?:\/\//i.test(candidate) && isValidMedia(candidate);
}

function isValidMedia(candidate: string) {
  ...
  if (/^https?:\/\//i.test(candidate)) {
    return true;
  }
  ...
}

Recommendation

Treat remote media URLs as untrusted and apply SSRF mitigations before accepting them as media.

Suggested hardening:

1. Parse and validate URLs using new URL() (reject invalid URLs, reject credentials).
2. Block private/loopback/link-local IP ranges and common internal hostnames.
3. Optionally enforce an allowlist of permitted domains for remote media.
4. Consider requiring an explicit MEDIA: directive for remote fetches, and treat Markdown images as display-only unless explicitly enabled.

Example:

import dns from "node:dns/promises";
import net from "node:net";

function isPublicIp(ip: string): boolean {
  ​// block loopback, link-local, RFC1918, etc. (implement fully)
  return !(
    ip.startsWith("127.") ||
    ip.startsWith("10.") ||
    ip.startsWith("192.168.") ||
    ip.startsWith("169.254.")
  );
}

async function isSafeRemoteMedia(urlStr: string): Promise<boolean> {
  let url: URL;
  try { url = new URL(urlStr); } catch { return false; }
  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
  if (url.username || url.password) return false;

  ​// Resolve and verify IPs (beware DNS rebinding; do checks at connect-time too)
  const addrs = await dns.lookup(url.hostname, { all: true });
  if (addrs.some(a => net.isIP(a.address) && !isPublicIp(a.address))) return false;

  return true;
}

Apply isSafeRemoteMedia() (or equivalent) inside isRemoteMarkdownImageMedia before pushing the URL to mediaUrls.

Description

splitMediaFromOutput() now attempts to extract remote media URLs from Markdown image syntax for every non-MEDIA: line when the overall output matches /!\[[^\]]*]\(/.

The per-line parser can be forced into high CPU usage with adversarially crafted text:

• findMarkdownImageMatches() loops up to MAX_MARKDOWN_IMAGE_ATTEMPTS_PER_LINE (80) and for each candidate calls findMatchingBracket(), which may scan to the end of the line when brackets are unbalanced or deeply nested.
• On failures, searchIndex only advances by index + 2, allowing many overlapping ![ candidates and repeated near-full-line scans.
• There is no cap on total number of lines or total message size processed by splitMediaFromOutput(). An attacker can supply many lines near MAX_MARKDOWN_IMAGE_LINE_LENGTH (20k) containing repeated ![ sequences that trigger the expensive path, producing large cumulative CPU time.

This is a classic resource-exhaustion vector (algorithmic complexity) and may be reachable if raw contains untrusted user/model output in request/response handling paths.

Vulnerable code (hot loop + full-line scans):

while (matches.length < MAX_MARKDOWN_IMAGE_MATCHES_PER_LINE && attempts < MAX_MARKDOWN_IMAGE_ATTEMPTS_PER_LINE) {
  const index = line.indexOf("![", searchIndex);
  attempts += 1;
  const altEnd = findMatchingBracket(line, index + 2, "[", "]");
  ...
  searchIndex = index + 2;
}

Recommendation

Mitigate worst-case CPU and memory usage by adding global and more linear-time limits:

1. Add a cap on total input size / number of lines processed by splitMediaFromOutput() (or short-circuit Markdown image extraction when the input is very large).
2. Avoid repeated rescans by making the matcher single-pass (advance searchIndex more aggressively on failure, e.g. to altEnd + 1 when altEnd exists, or to the next ![ after the closing ] when possible).
3. Consider lowering the per-line attempt limit or stopping after a maximum number of total markdown-image parse operations per message.

Example defensive cap:

const MAX_OUTPUT_CHARS = 200_000;
const MAX_LINES = 2_000;
const safeRaw = trimmedRaw.slice(0, MAX_OUTPUT_CHARS);
const lines = safeRaw.split("\n").slice(0, MAX_LINES);