AI-written code prefetched remote images using a single hostname validation before re-resolving DNS, allowing SSRF via DNS rebinding to internal resources.

+ * Returns null if fetch fails.+ *+ * @param {string} imageUrl - HTTP(S) URL of the image+ * @param {object} options - { signal, timeoutMs }+ * @returns {Promise<{url: string, mimeType: string}|null>}+ */+export async function fetchImageAsBase64(imageUrl, options = {}) {+  const { signal, timeoutMs = 10000 } = options;+  if (!imageUrl || (!imageUrl.startsWith("http://") && !imageUrl.startsWith("https://"))) {+    return null;+  }++  const controller = new AbortController();+  const timeout = signal ? null : setTimeout(() => controller.abort(), timeoutMs);+  const fetchSignal = signal || controller.signal;++  try {+    const response = await fetch(imageUrl, { signal: fetchSignal });+    if (!response.ok) return null;++    const mimeType = response.headers.get("Content-Type") || "image/jpeg";+    const arrayBuffer = await response.arrayBuffer();+    const base64 = Buffer.from(arrayBuffer).toString("base64");+    return { url: `data:${mimeType};base64,${base64}`, mimeType };+  } catch {+    return null;+  } finally {+    if (timeout) clearTimeout(timeout);+  }+}

@@ -93,7 +94,36 @@ export class CodexExecutor extends BaseExecutor {   }    /**-   * Transform request before sending - inject default instructions if missing+   * Prefetch remote image URLs and inline them as base64 data URIs.+   * Runs before execute() because Codex backend cannot fetch remote images.+   * Mutates body.input in place.+   */+  async prefetchImages(body) {+    if (!Array.isArray(body?.input)) return;+    for (const item of body.input) {+      if (!Array.isArray(item.content)) continue;+      const pending = item.content.map(async (c) => {+        if (c.type !== "image_url") return c;+        const url = typeof c.image_url === "string" ? c.image_url : c.image_url?.url;+        const detail = c.image_url?.detail || "auto";+        if (!url) return c;+        if (url.startsWith("data:")) return { type: "input_image", image_url: url, detail };+        const fetched = await fetchImageAsBase64(url, { timeoutMs: 15000 });+        return { type: "input_image", image_url: fetched?.url || url, detail };+      });+      item.content = await Promise.all(pending);+    }+  }++  async execute(args) {+    // Fetch remote images before the synchronous transform/execute pipeline+    await this.prefetchImages(args.body);+    return super.execute(args);+  }++  /**+   * Transform request before sending - inject default instructions if missing.+   * Image fetching is handled separately in prefetchImages() so this stays sync.    */   transformRequest(model, body, stream, credentials) {     this._isCompact = !!body._compact;@@ -109,21 +139,6 @@ export class CodexExecutor extends BaseExecutor {       body.input = [{ type: "message", role: "user", content: [{ type: "input_text", text: "..." }] }];     } -    // Normalize image content: image_url → input_image (Responses API format)-    if (Array.isArray(body.input)) {-      for (const item of body.input) {-        if (Array.isArray(item.content)) {-          item.content = item.content.map(c => {-            if (c.type === "image_url") {-              const url = typeof c.image_url === "string" ? c.image_url : c.image_url?.url;-              return { type: "input_image", image_url: url, detail: c.image_url?.detail || "auto" };-            }-            return c;-          });-        }-      }-    }-     // Ensure streaming is enabled (Codex API requires it)     body.stream = true; 

+ *+ * Covers bug #575:+ *  - prefetchImages must await async image fetches+ *  - execute() must run prefetchImages before super.execute so the body+ *    sent to upstream contains base64 data, not remote URLs+ */++import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";

++function mockImageFetch(sizeBytes, mimeType = "image/jpeg") {+  return {+    ok: true,+    headers: { get: (k) => (k === "Content-Type" ? mimeType : null) },+    arrayBuffer: async () => makeImageBuffer(sizeBytes),+  };+}++describe("CodexExecutor image handling", () => {+  let originalFetch;++  beforeEach(() => {+    originalFetch = global.fetch;+  });++  afterEach(() => {+    global.fetch = originalFetch;+    vi.restoreAllMocks();

+      input: [+        {

+    };++    await executor.prefetchImages(body);++    const imgBlock = body.input[0].content.find((c) => c.type === "input_image");+    expect(imgBlock, "input_image block must be present after prefetch").toBeDefined();+    expect(imgBlock.image_url.startsWith("data:image/jpeg;base64,")).toBe(true);+    expect(imgBlock.detail).toBe("high");

+  it("passes through existing data URIs without calling fetch", async () => {+    global.fetch = vi.fn();++    const executor = new CodexExecutor();+    const body = {+      input: [+        {+          role: "user",+          content: [{ type: "image_url", image_url: { url: DATA_URI } }],+        },+      ],+    };++    await executor.prefetchImages(body);++    const imgBlock = body.input[0].content.find((c) => c.type === "input_image");

   return false; }

+    const records = await lookup(hostname, { all: true });+    if (!records.length || records.some((r) => isPrivateIp(r.address))) return null;+    return records;   } catch {-    return false;+    return null;   } } @@ -78,15 +81,21 @@ export async function fetchImageAsBase64(imageUrl, options = {}) { 

+   try {     // redirect:"manual" prevents a public URL redirecting to a private one (SSRF bypass).-    const response = await fetch(imageUrl, { signal: fetchSignal, redirect: "manual" });+    const response = await fetch(imageUrl, { signal: fetchSignal, redirect: "manual", dispatcher });     if (!response.ok || !response.body) return null;      // Stream-read with a hard byte cap to avoid loading huge payloads into memory.@@ -110,5 +119,6 @@ export async function fetchImageAsBase64(imageUrl, options = {}) {     return null;   } finally {     if (timeout) clearTimeout(timeout);+    dispatcher.close().catch(() => {});   } }