fix: change ip to resolve the ip's SSRF risk

packages/sdk/package.json

@@ -28,7 +28,6 @@
     "body-parser": "1.20.1",
     "cors": "2.8.5",
     "dayjs": "1.11.6",
-    "ip": "1.1.9",
     "lodash": "^4.17.21",
     "open": "^8.4.0",
     "serve-static": "1.15.0",
@@ -39,7 +38,6 @@
   "devDependencies": {
     "@types/body-parser": "1.19.2",
     "@types/cors": "2.8.13",
-    "@types/ip": "1.1.0",
     "@types/lodash": "^4.17.0",
     "@types/node": "^16",
     "@types/serve-static": "1.15.0",

packages/sdk/src/sdk/server/apis/project.ts

@@ -1,7 +1,7 @@
 import { SDK } from '@rsdoctor/types';
-import ip from 'ip';
 import { BaseAPI } from './base';
 import { Router } from '../router';
+import { getLocalIpAddress } from '../utils';
 
 export class ProjectAPI extends BaseAPI {
   @Router.get(SDK.ServerAPI.API.Env)
@@ -11,7 +11,7 @@ export class ProjectAPI extends BaseAPI {
     const { server } = this.ctx;
 
     return {
-      ip: ip.address(),
+      ip: getLocalIpAddress(),
       port: server.port,
     };
   }

packages/sdk/src/sdk/server/index.ts

@@ -4,7 +4,6 @@ import serve from 'serve-static';
 import { Bundle } from '@rsdoctor/utils/common';
 import assert from 'assert';
 import bodyParser from 'body-parser';
-import ip from 'ip';
 import cors from 'cors';
 import { PassThrough } from 'stream';
 import { Socket } from './socket';
@@ -13,6 +12,7 @@ import * as APIs from './apis';
 import { chalk, logger } from '@rsdoctor/utils/logger';
 import { openBrowser } from '@/sdk/utils/openBrowser';
 import path from 'path';
+import { getLocalIpAddress } from './utils';
 export * from './utils';
 
 export class RsdoctorServer implements SDK.RsdoctorServerInstance {
@@ -45,7 +45,7 @@ export class RsdoctorServer implements SDK.RsdoctorServerInstance {
   }
 
   public get host(): string {
-    const host = ip.address();
+    const host = getLocalIpAddress();
     return host;
   }
 

packages/sdk/src/sdk/server/utils.ts

@@ -1,4 +1,5 @@
 import { SDK } from '@rsdoctor/types';
+import os from 'os';
 
 export function getDataByPagination<T>(
   data: T[],
@@ -18,3 +19,15 @@ export function getDataByPagination<T>(
     },
   };
 }
+
+export function getLocalIpAddress() {
+  const interfaces = os.networkInterfaces();
+  for (const iface of Object.values(interfaces)) {
+    for (const alias of iface as os.NetworkInterfaceInfo[]) {
+      if (alias.family === 'IPv4' && !alias.internal) {
+        return alias.address;
+      }
+    }
+  }
+  return '127.0.0.1'; // fallback to localhost if no external IP found
+}

packages/sdk/tests/server/apis/project.test.ts

@@ -1,9 +1,9 @@
 import { describe, it, expect, vi } from 'vitest';
-import ip from 'ip';
 import { Manifest, SDK } from '@rsdoctor/types';
 import { Manifest as ManifestShared } from '@rsdoctor/utils/common';
 
 import { cwd, setupSDK } from '../../utils';
+import { getLocalIpAddress } from '@/sdk/server/utils';
 
 vi.setConfig({ testTimeout: 50000 });
 
@@ -13,7 +13,7 @@ describe('test server/apis/project.ts', () => {
   it(`test api: ${SDK.ServerAPI.API.Env}`, async () => {
     const env = (await target.get(SDK.ServerAPI.API.Env)).toJSON();
 
-    expect(env.ip).toEqual(ip.address());
+    expect(env.ip).toEqual(getLocalIpAddress());
     expect(env.port).toEqual(target.server.port);
   });