@adobe/helix-html-pipeline 1.0.5 → 1.1.2

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## [1.1.2](https://github.com/adobe/helix-html-pipeline/compare/v1.1.1...v1.1.2) (2022-03-11)
+
+
+### Bug Fixes
+
+* handling invalid input url with 400 ([#16](https://github.com/adobe/helix-html-pipeline/issues/16)) ([4491691](https://github.com/adobe/helix-html-pipeline/commit/449169107cc1d6a3b7b5fd211b39174d59fb2a8e)), closes [#15](https://github.com/adobe/helix-html-pipeline/issues/15)
+
+## [1.1.1](https://github.com/adobe/helix-html-pipeline/compare/v1.1.0...v1.1.1) (2022-03-10)
+
+
+### Bug Fixes
+
+* adapt to breaking change (computeSurrogateKey is async) ([9c8830d](https://github.com/adobe/helix-html-pipeline/commit/9c8830dc8db3007921dd85f27537c030d80c0cbf))
+* **deps:** update dependency @adobe/helix-shared-utils to v2.0.4 ([b5cd927](https://github.com/adobe/helix-html-pipeline/commit/b5cd92783f03c47f7f26fbaa6c9438ea11c1e05b))
+
+# [1.1.0](https://github.com/adobe/helix-html-pipeline/compare/v1.0.5...v1.1.0) (2022-03-10)
+
+
+### Features
+
+* avoid node built-ins (path and url) ([9e315df](https://github.com/adobe/helix-html-pipeline/commit/9e315df46fc7f473e437feb2e2d3dfdf9c6ddfc2))
+
 ## [1.0.5](https://github.com/adobe/helix-html-pipeline/compare/v1.0.4...v1.0.5) (2022-03-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "1.0.5",
+  "version": "1.1.2",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@adobe/helix-markdown-support": "3.1.2",
-    "@adobe/helix-shared-utils": "2.0.3",
+    "@adobe/helix-shared-utils": "2.0.4",
     "github-slugger": "1.4.0",
     "hast-util-to-html": "8.0.3",
     "jsdom": "19.0.0",

package/src/html-pipe.js

@@ -110,6 +110,13 @@ export async function htmlPipe(state, req) {
     }
     log.error(`error running pipeline: ${res.status} ${res.error}`, e);
     res.headers.set('x-error', cleanupHeaderValue(res.error));
+
+    // turn any URL errors into a 400, since they are user input
+    // see https://github.com/adobe/helix-pipeline-service/issues/346
+    if (e.code === 'ERR_INVALID_URL') {
+      res.status = 400;
+      res.headers.set('x-error', cleanupHeaderValue(`invalid url: ${e.input}`));
+    }
   }
 
   return res;

package/src/steps/extract-metadata.js

@@ -9,8 +9,9 @@
  * OF ANY KIND, either express or implied. See the License for the specific language
  * governing permissions and limitations under the License.
  */
-import { resolve } from 'url';
-import { getAbsoluteUrl, makeCanonicalHtmlUrl, optimizeImageURL } from './utils.js';
+import {
+  getAbsoluteUrl, makeCanonicalHtmlUrl, optimizeImageURL, resolveUrl,
+} from './utils.js';
 import { filterGlobalMetadata, toMetaName, ALLOWED_RESPONSE_HEADERS } from '../utils/metadata.js';
 
 /**
@@ -110,7 +111,7 @@ function getLocalMetadata(document) {
  * @returns The optimized image URL
  */
 function optimizeMetaImage(pagePath, imgUrl) {
-  const src = resolve(pagePath, imgUrl);
+  const src = resolveUrl(pagePath, imgUrl);
   if (src.startsWith('/')) {
     return optimizeImageURL(src, 1200, 'pjpg');
   }

package/src/steps/folder-mapping.js

@@ -9,8 +9,7 @@
  * OF ANY KIND, either express or implied. See the License for the specific language
  * governing permissions and limitations under the License.
  */
-import { extname } from 'path';
-import { getPathInfo } from '../utils/path.js';
+import { getPathInfo, getExtension } from '../utils/path.js';
 
 /**
  * Finds the mapping from path to folders in fstab
@@ -49,7 +48,7 @@ export default function folderMapping(state) {
   const mapped = mapPath(folders, path);
   if (mapped) {
     state.info = getPathInfo(mapped);
-    if (extname(mapped)) {
+    if (getExtension(mapped)) {
       // special case: use code-bus
       state.content.sourceBus = 'code';
       state.info.resourcePath = mapped;

package/src/steps/set-x-surrogate-key-header.js

@@ -18,14 +18,14 @@ import { computeSurrogateKey } from '@adobe/helix-shared-utils';
  * @param {PipelineResponse} res
  * @returns {Promise<void>}
  */
-export default function setXSurrogateKeyHeader(state, req, res) {
+export default async function setXSurrogateKeyHeader(state, req, res) {
   const {
     content, contentBusId, info, owner, repo, ref,
   } = state;
 
   const keys = [];
   if (content.sourceLocation) {
-    keys.push(computeSurrogateKey(content.sourceLocation));
+    keys.push(await computeSurrogateKey(content.sourceLocation));
   }
   if (info.selector !== 'plain') {
     keys.push(`${contentBusId}_metadata`);

package/src/steps/utils.js

@@ -9,7 +9,6 @@
  * OF ANY KIND, either express or implied. See the License for the specific language
  * governing permissions and limitations under the License.
  */
-import { parse, resolve } from 'url';
 
 /**
  * Returns the original host name from the request to the outer CDN.
@@ -25,21 +24,7 @@ export function getOriginalHost(headers) {
 }
 
 /**
- * Turns a relative into an absolute URL.
- * @param {object} headers The request headers
- * @param {string} url The relative or absolute URL
- * @returns {string} The absolute URL or <code>null</code>
- *                   if <code>url</code> is not a string
- */
-export function getAbsoluteUrl(headers, url) {
-  if (typeof url !== 'string') {
-    return null;
-  }
-  return resolve(`https://${getOriginalHost(headers)}/`, url);
-}
-
-/**
- * Returns the canonical HTML url for the give one by
+ * Returns the canonical HTML url for the given one by
  *
  * - removing .html extension
  * - removing index
@@ -95,13 +80,66 @@ export function toClassName(text) {
  * @returns {string}
  */
 export function optimizeImageURL(src, width, format = 'webply', optimize = 'medium') {
-  // use deprecated api to avoid complexity with non absolute paths
-  const url = parse(src, true);
+  if (typeof src !== 'string') {
+    throw new TypeError(`Parameter 'url' must be a string, not ${typeof src}`);
+  }
+
+  const simplePath = (uri) => uri.startsWith('/') || uri.startsWith('./');
+
+  const uri = src.trim();
+
+  let url;
+  if (simplePath(uri)) {
+    url = new URL(`https://dummy${uri[0] !== '/' ? '/' : ''}${uri}`);
+  } else {
+    url = new URL(uri);
+  }
   delete url.search;
   if (width) {
-    url.query.width = String(width);
+    url.searchParams.set('width', String(width));
+  }
+  url.searchParams.set('format', format);
+  url.searchParams.set('optimize', optimize);
+
+  if (simplePath(uri)) {
+    // preserve original path over url.pathname
+    const pos = uri.search(/[?#]/g);
+    if (pos > -1) {
+      return `${uri.substring(0, pos)}${url.search}${url.hash}`;
+    } else {
+      return `${uri}${url.search}${url.hash}`;
+    }
+  }
+  return url.toString();
+}
+
+/**
+ * Resolves a target URL relative to a base URL in a manner similar
+ * to that of a web browser resolving an anchor tag.
+ * @param {string} from
+ * @param {string} to
+ * @returns {string} resolved url
+ */
+export function resolveUrl(from, to) {
+  const resolvedUrl = new URL(to, new URL(from, 'resolve://'));
+  if (resolvedUrl.protocol === 'resolve:') {
+    // `from` is a relative URL.
+    const { pathname, search, hash } = resolvedUrl;
+    return pathname + search + hash;
+  }
+  return resolvedUrl.toString();
+}
+
+/**
+ * Turns a relative into an absolute URL.
+ * @param {object} headers The request headers
+ * @param {string} url The relative or absolute URL
+ * @returns {string} The absolute URL or <code>null</code>
+ *                   if <code>url</code> is not a string
+ */
+export function getAbsoluteUrl(headers, url) {
+  if (typeof url !== 'string') {
+    return null;
   }
-  url.query.format = format;
-  url.query.optimize = optimize;
-  return url.format();
+  return resolveUrl(`https://${getOriginalHost(headers)}/`, url);
 }

package/src/utils/path.js

@@ -101,3 +101,14 @@ export function validatePathInfo(info) {
   }
   return true;
 }
+
+/**
+ * Returns the file extension (e.g. '.html') of the given parh
+ * @param {string} path the path to get the extension from
+ * @return {string} the file extension or '' if there's no extension
+ */
+export function getExtension(path) {
+  const basename = path.split('/').pop();
+  const pos = basename.lastIndexOf('.');
+  return (basename === '' || pos < 1) ? '' : basename.slice(pos);
+}