Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser

@@ -1,6 +1,6 @@
 {
   "name": "google-translate-api-browser",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "A free and unlimited API for Google Translate that works in browser",
   "repository": {
     "type": "git",

@@ -1,9 +1,17 @@
 import { defaultTranslateOptions } from "./defaultTranslateOptions";
 import { TranslateOptions } from "./TranslateOptions";
 
+function validateTLD(tld: string) {
+  return Boolean(tld.match(/^[a-zA-Z]{2,63}$/));
+}
+
 export function generateRequestUrl(options: Partial<Omit<TranslateOptions, 'raw'>> = {}): string {
   const translateOptions = { ...defaultTranslateOptions, ...options };
 
+  if (!validateTLD(translateOptions.tld)) {
+    throw new Error("Invalid TLD: Must be 2-63 letters only")
+  }
+
   const queryParams = {
     rpcids: translateOptions.rpcids,
     'source-path': '/',

@@ -29,7 +29,7 @@ export function normaliseResponse(rawBody: string, raw = false): TranslationResu
   }
 
   if (!data) {
-    throw new Error('No data')
+    throw new Error('Data is either empty or corrupted')
   }
 
   const result: TranslationResult = {

@@ -4,13 +4,16 @@ import { TranslateOptions } from "./TranslateOptions";
 import { normaliseResponse, TranslationResult } from "./normaliseResponse";
 import * as https from 'node:https';
 
+export function createRequestBody(text: string, translateOptions: Pick<TranslateOptions, "to" | "from" | "rpcids">) {
+    const encodedData = encodeURIComponent(`[[["${translateOptions.rpcids}","[[\\"${text}\\",\\"${translateOptions.from}\\",\\"${translateOptions.to}\\",true],[1]]",null,"generic"]]]`);
+    return `f.req=${encodedData}&`;
+}
+
 export function translate(text: string, options: Partial<TranslateOptions> = {}): Promise<TranslationResult> {
   const translateOptions = { ...defaultTranslateOptions, ...options };
 
   return new Promise((resolve, reject) => {
-    const encodedData = encodeURIComponent(`[[["${translateOptions.rpcids}","[[\\"${text}\\",\\"${translateOptions.from}\\",\\"${translateOptions.to}\\",true],[1]]",null,"generic"]]]`);
-    const body = `f.req=${encodedData}&`;
-
+    const body = createRequestBody(text, translateOptions);
     const url = generateRequestUrl(translateOptions);
 
     const req = https.request(url, {
@@ -29,9 +32,7 @@ export function translate(text: string, options: Partial<TranslateOptions> = {})
       resp.on('end', () => {
         resolve(normaliseResponse(data))
       });
-    }).on('error', (err) => {
-      reject(err)
-    })
+    }).on('error', reject);
 
     req.write(body);
     req.end();