@backstage/plugin-search-backend 0.2.6 → 0.3.1-next.0

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @backstage/plugin-search-backend
 
+## 0.3.1-next.0
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.10.4-next.0
+
+## 0.3.0
+
+### Minor Changes
+
+- a41fbfe739: Search result location filtering
+
+  This change introduces a filter for search results based on their location protocol. The intention is to filter out unsafe or
+  malicious values before they can be consumed by the frontend. By default locations must be http/https URLs (or paths).
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.10.0
+
+## 0.2.8
+
+### Patch Changes
+
+- dcd1a0c3f4: Minor improvement to the API reports, by not unpacking arguments directly
+- Updated dependencies
+  - @backstage/backend-common@0.9.13
+
+## 0.2.7
+
+### Patch Changes
+
+- bab752e2b3: Change default port of backend from 7000 to 7007.
+
+  This is due to the AirPlay Receiver process occupying port 7000 and preventing local Backstage instances on MacOS to start.
+
+  You can change the port back to 7000 or any other value by providing an `app-config.yaml` with the following values:
+
+  ```
+  backend:
+    listen: 0.0.0.0:7123
+    baseUrl: http://localhost:7123
+  ```
+
+  More information can be found here: https://backstage.io/docs/conf/writing
+
+- Updated dependencies
+  - @backstage/backend-common@0.9.11
+
 ## 0.2.6
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -8,17 +8,27 @@ function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'defau
 
 var Router__default = /*#__PURE__*/_interopDefaultLegacy(Router);
 
-async function createRouter({
-  engine,
-  logger
-}) {
-  const router = Router__default['default']();
+const allowedLocationProtocols = ["http:", "https:"];
+async function createRouter(options) {
+  const { engine, logger } = options;
+  const filterResultSet = ({ results, ...resultSet }) => ({
+    ...resultSet,
+    results: results.filter((result) => {
+      const protocol = new URL(result.document.location, "https://example.com").protocol;
+      const isAllowed = allowedLocationProtocols.includes(protocol);
+      if (!isAllowed) {
+        logger.info(`Rejected search result for "${result.document.title}" as location protocol "${protocol}" is unsafe`);
+      }
+      return isAllowed;
+    })
+  });
+  const router = Router__default["default"]();
   router.get("/query", async (req, res) => {
-    const {term, filters = {}, types, pageCursor} = req.query;
+    const { term, filters = {}, types, pageCursor } = req.query;
     logger.info(`Search request received: term="${term}", filters=${JSON.stringify(filters)}, types=${types ? types.join(",") : ""}, pageCursor=${pageCursor != null ? pageCursor : ""}`);
     try {
-      const results = await (engine == null ? void 0 : engine.query(req.query));
-      res.send(results);
+      const resultSet = await (engine == null ? void 0 : engine.query(req.query));
+      res.send(filterResultSet(resultSet));
     } catch (err) {
       throw new Error(`There was a problem performing the search query. ${err}`);
     }

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { SearchQuery, SearchResultSet } from '@backstage/search-common';\nimport { SearchEngine } from '@backstage/plugin-search-backend-node';\n\ntype RouterOptions = {\n  engine: SearchEngine;\n  logger: Logger;\n};\n\nexport async function createRouter({\n  engine,\n  logger,\n}: RouterOptions): Promise<express.Router> {\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request<any, unknown, unknown, SearchQuery>,\n      res: express.Response<SearchResultSet>,\n    ) => {\n      const { term, filters = {}, types, pageCursor } = req.query;\n      logger.info(\n        `Search request received: term=\"${term}\", filters=${JSON.stringify(\n          filters,\n        )}, types=${types ? types.join(',') : ''}, pageCursor=${\n          pageCursor ?? ''\n        }`,\n      );\n\n      try {\n        const results = await engine?.query(req.query);\n        res.send(results);\n      } catch (err) {\n        throw new Error(\n          `There was a problem performing the search query. ${err}`,\n        );\n      }\n    },\n  );\n\n  return router;\n}\n"],"names":["Router"],"mappings":";;;;;;;;;;4BA2BmC;AAAA,EACjC;AAAA,EACA;AAAA,GACyC;AACzC,QAAM,SAASA;AACf,SAAO,IACL,UACA,OACE,KACA,QACG;AACH,UAAM,CAAE,MAAM,UAAU,IAAI,OAAO,cAAe,IAAI;AACtD,WAAO,KACL,kCAAkC,kBAAkB,KAAK,UACvD,mBACU,QAAQ,MAAM,KAAK,OAAO,kBACpC,kCAAc;AAIlB,QAAI;AACF,YAAM,UAAU,wCAAc,MAAM,IAAI;AACxC,UAAI,KAAK;AAAA,aACF,KAAP;AACA,YAAM,IAAI,MACR,oDAAoD;AAAA;AAAA;AAM5D,SAAO;AAAA;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { SearchQuery, SearchResultSet } from '@backstage/search-common';\nimport { SearchEngine } from '@backstage/plugin-search-backend-node';\n\nexport type RouterOptions = {\n  engine: SearchEngine;\n  logger: Logger;\n};\n\nconst allowedLocationProtocols = ['http:', 'https:'];\n\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine, logger } = options;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request<any, unknown, unknown, SearchQuery>,\n      res: express.Response<SearchResultSet>,\n    ) => {\n      const { term, filters = {}, types, pageCursor } = req.query;\n      logger.info(\n        `Search request received: term=\"${term}\", filters=${JSON.stringify(\n          filters,\n        )}, types=${types ? types.join(',') : ''}, pageCursor=${\n          pageCursor ?? ''\n        }`,\n      );\n\n      try {\n        const resultSet = await engine?.query(req.query);\n        res.send(filterResultSet(resultSet));\n      } catch (err) {\n        throw new Error(\n          `There was a problem performing the search query. ${err}`,\n        );\n      }\n    },\n  );\n\n  return router;\n}\n"],"names":["Router"],"mappings":";;;;;;;;;;AA2BA,MAAM,2BAA2B,CAAC,SAAS;4BAGzC,SACyB;AACzB,QAAM,EAAE,QAAQ,WAAW;AAE3B,QAAM,kBAAkB,CAAC,EAAE,YAAY;AAAkC,OACpE;AAAA,IACH,SAAS,QAAQ,OAAO,YAAU;AAChC,YAAM,WAAW,IAAI,IAAI,OAAO,SAAS,UAAU,uBAChD;AACH,YAAM,YAAY,yBAAyB,SAAS;AACpD,UAAI,CAAC,WAAW;AACd,eAAO,KACL,+BAA+B,OAAO,SAAS,gCAAgC;AAAA;AAGnF,aAAO;AAAA;AAAA;AAIX,QAAM,SAASA;AACf,SAAO,IACL,UACA,OACE,KACA,QACG;AACH,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,eAAe,IAAI;AACtD,WAAO,KACL,kCAAkC,kBAAkB,KAAK,UACvD,mBACU,QAAQ,MAAM,KAAK,OAAO,kBACpC,kCAAc;AAIlB,QAAI;AACF,YAAM,YAAY,wCAAc,MAAM,IAAI;AAC1C,UAAI,KAAK,gBAAgB;AAAA,aAClB,KAAP;AACA,YAAM,IAAI,MACR,oDAAoD;AAAA;AAAA;AAM5D,SAAO;AAAA;;;;"}

package/dist/index.d.ts

@@ -6,6 +6,6 @@ declare type RouterOptions = {
     engine: SearchEngine;
     logger: Logger;
 };
-declare function createRouter({ engine, logger, }: RouterOptions): Promise<express.Router>;
+declare function createRouter(options: RouterOptions): Promise<express.Router>;
 
-export { createRouter };
+export { RouterOptions, createRouter };

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@backstage/plugin-search-backend",
-  "version": "0.2.6",
+  "description": "The Backstage backend plugin that provides your backstage app with search",
+  "version": "0.3.1-next.0",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
@@ -19,8 +20,8 @@
     "clean": "backstage-cli clean"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.9.1",
-    "@backstage/plugin-search-backend-node": "^0.4.2",
+    "@backstage/backend-common": "^0.10.4-next.0",
+    "@backstage/plugin-search-backend-node": "^0.4.4",
     "@backstage/search-common": "^0.2.0",
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
@@ -29,12 +30,12 @@
     "yn": "^4.0.0"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.7.10",
+    "@backstage/cli": "^0.12.0-next.0",
     "@types/supertest": "^2.0.8",
     "supertest": "^6.1.3"
   },
   "files": [
     "dist"
   ],
-  "gitHead": "174a8b532e8b6dda0e733ec943d1aa7187a3821a"
+  "gitHead": "31184691d5a38cb78b091c8f7ad6db80604519a6"
 }