@backstage/plugin-search-backend 0.2.8 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @backstage/plugin-search-backend
 
+## 0.3.0
+
+### Minor Changes
+
+- a41fbfe739: Search result location filtering
+
+  This change introduces a filter for search results based on their location protocol. The intention is to filter out unsafe or
+  malicious values before they can be consumed by the frontend. By default locations must be http/https URLs (or paths).
+
+### Patch Changes
+
+- Updated dependencies
+  - @backstage/backend-common@0.10.0
+
 ## 0.2.8
 
 ### Patch Changes

package/dist/index.cjs.js

@@ -8,15 +8,27 @@ function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'defau
 
 var Router__default = /*#__PURE__*/_interopDefaultLegacy(Router);
 
+const allowedLocationProtocols = ["http:", "https:"];
 async function createRouter(options) {
   const { engine, logger } = options;
+  const filterResultSet = ({ results, ...resultSet }) => ({
+    ...resultSet,
+    results: results.filter((result) => {
+      const protocol = new URL(result.document.location, "https://example.com").protocol;
+      const isAllowed = allowedLocationProtocols.includes(protocol);
+      if (!isAllowed) {
+        logger.info(`Rejected search result for "${result.document.title}" as location protocol "${protocol}" is unsafe`);
+      }
+      return isAllowed;
+    })
+  });
   const router = Router__default["default"]();
   router.get("/query", async (req, res) => {
     const { term, filters = {}, types, pageCursor } = req.query;
     logger.info(`Search request received: term="${term}", filters=${JSON.stringify(filters)}, types=${types ? types.join(",") : ""}, pageCursor=${pageCursor != null ? pageCursor : ""}`);
     try {
-      const results = await (engine == null ? void 0 : engine.query(req.query));
-      res.send(results);
+      const resultSet = await (engine == null ? void 0 : engine.query(req.query));
+      res.send(filterResultSet(resultSet));
     } catch (err) {
       throw new Error(`There was a problem performing the search query. ${err}`);
     }

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { SearchQuery, SearchResultSet } from '@backstage/search-common';\nimport { SearchEngine } from '@backstage/plugin-search-backend-node';\n\nexport type RouterOptions = {\n  engine: SearchEngine;\n  logger: Logger;\n};\n\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine, logger } = options;\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request<any, unknown, unknown, SearchQuery>,\n      res: express.Response<SearchResultSet>,\n    ) => {\n      const { term, filters = {}, types, pageCursor } = req.query;\n      logger.info(\n        `Search request received: term=\"${term}\", filters=${JSON.stringify(\n          filters,\n        )}, types=${types ? types.join(',') : ''}, pageCursor=${\n          pageCursor ?? ''\n        }`,\n      );\n\n      try {\n        const results = await engine?.query(req.query);\n        res.send(results);\n      } catch (err) {\n        throw new Error(\n          `There was a problem performing the search query. ${err}`,\n        );\n      }\n    },\n  );\n\n  return router;\n}\n"],"names":["Router"],"mappings":";;;;;;;;;;4BA4BE,SACyB;AACzB,QAAM,EAAE,QAAQ,WAAW;AAC3B,QAAM,SAASA;AACf,SAAO,IACL,UACA,OACE,KACA,QACG;AACH,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,eAAe,IAAI;AACtD,WAAO,KACL,kCAAkC,kBAAkB,KAAK,UACvD,mBACU,QAAQ,MAAM,KAAK,OAAO,kBACpC,kCAAc;AAIlB,QAAI;AACF,YAAM,UAAU,wCAAc,MAAM,IAAI;AACxC,UAAI,KAAK;AAAA,aACF,KAAP;AACA,YAAM,IAAI,MACR,oDAAoD;AAAA;AAAA;AAM5D,SAAO;AAAA;;;;"}
+{"version":3,"file":"index.cjs.js","sources":["../src/service/router.ts"],"sourcesContent":["/*\n * Copyright 2021 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport express from 'express';\nimport Router from 'express-promise-router';\nimport { Logger } from 'winston';\nimport { SearchQuery, SearchResultSet } from '@backstage/search-common';\nimport { SearchEngine } from '@backstage/plugin-search-backend-node';\n\nexport type RouterOptions = {\n  engine: SearchEngine;\n  logger: Logger;\n};\n\nconst allowedLocationProtocols = ['http:', 'https:'];\n\nexport async function createRouter(\n  options: RouterOptions,\n): Promise<express.Router> {\n  const { engine, logger } = options;\n\n  const filterResultSet = ({ results, ...resultSet }: SearchResultSet) => ({\n    ...resultSet,\n    results: results.filter(result => {\n      const protocol = new URL(result.document.location, 'https://example.com')\n        .protocol;\n      const isAllowed = allowedLocationProtocols.includes(protocol);\n      if (!isAllowed) {\n        logger.info(\n          `Rejected search result for \"${result.document.title}\" as location protocol \"${protocol}\" is unsafe`,\n        );\n      }\n      return isAllowed;\n    }),\n  });\n\n  const router = Router();\n  router.get(\n    '/query',\n    async (\n      req: express.Request<any, unknown, unknown, SearchQuery>,\n      res: express.Response<SearchResultSet>,\n    ) => {\n      const { term, filters = {}, types, pageCursor } = req.query;\n      logger.info(\n        `Search request received: term=\"${term}\", filters=${JSON.stringify(\n          filters,\n        )}, types=${types ? types.join(',') : ''}, pageCursor=${\n          pageCursor ?? ''\n        }`,\n      );\n\n      try {\n        const resultSet = await engine?.query(req.query);\n        res.send(filterResultSet(resultSet));\n      } catch (err) {\n        throw new Error(\n          `There was a problem performing the search query. ${err}`,\n        );\n      }\n    },\n  );\n\n  return router;\n}\n"],"names":["Router"],"mappings":";;;;;;;;;;AA2BA,MAAM,2BAA2B,CAAC,SAAS;4BAGzC,SACyB;AACzB,QAAM,EAAE,QAAQ,WAAW;AAE3B,QAAM,kBAAkB,CAAC,EAAE,YAAY;AAAkC,OACpE;AAAA,IACH,SAAS,QAAQ,OAAO,YAAU;AAChC,YAAM,WAAW,IAAI,IAAI,OAAO,SAAS,UAAU,uBAChD;AACH,YAAM,YAAY,yBAAyB,SAAS;AACpD,UAAI,CAAC,WAAW;AACd,eAAO,KACL,+BAA+B,OAAO,SAAS,gCAAgC;AAAA;AAGnF,aAAO;AAAA;AAAA;AAIX,QAAM,SAASA;AACf,SAAO,IACL,UACA,OACE,KACA,QACG;AACH,UAAM,EAAE,MAAM,UAAU,IAAI,OAAO,eAAe,IAAI;AACtD,WAAO,KACL,kCAAkC,kBAAkB,KAAK,UACvD,mBACU,QAAQ,MAAM,KAAK,OAAO,kBACpC,kCAAc;AAIlB,QAAI;AACF,YAAM,YAAY,wCAAc,MAAM,IAAI;AAC1C,UAAI,KAAK,gBAAgB;AAAA,aAClB,KAAP;AACA,YAAM,IAAI,MACR,oDAAoD;AAAA;AAAA;AAM5D,SAAO;AAAA;;;;"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@backstage/plugin-search-backend",
   "description": "The Backstage backend plugin that provides your backstage app with search",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "main": "dist/index.cjs.js",
   "types": "dist/index.d.ts",
   "license": "Apache-2.0",
@@ -20,7 +20,7 @@
     "clean": "backstage-cli clean"
   },
   "dependencies": {
-    "@backstage/backend-common": "^0.9.13",
+    "@backstage/backend-common": "^0.10.0",
     "@backstage/plugin-search-backend-node": "^0.4.2",
     "@backstage/search-common": "^0.2.0",
     "@types/express": "^4.17.6",
@@ -30,12 +30,12 @@
     "yn": "^4.0.0"
   },
   "devDependencies": {
-    "@backstage/cli": "^0.10.1",
+    "@backstage/cli": "^0.10.3",
     "@types/supertest": "^2.0.8",
     "supertest": "^6.1.3"
   },
   "files": [
     "dist"
   ],
-  "gitHead": "562be0b43016294e27af3ad024191bb86b13b1c1"
+  "gitHead": "b315430f9dfcfa19ab0dd90f5b4ac6904938fba7"
 }