@envoy/envoy-integrations-sdk 1.3.0 → 1.3.2

package/.github/workflows/test.yaml

@@ -0,0 +1,15 @@
+name: Test
+
+on:
+  push:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v2
+        with:
+          node-version: '16'
+      - run: npm install
+      - run: npm run test

package/index.js

@@ -11,6 +11,7 @@ const HttpStatus = require('./lib/HttpStatus');
 const middleware = require('./lib/middleware');
 const errorMiddleware = require('./lib/errorMiddleware');
 const asyncHandler = require('./lib/asyncHandler');
+const createAxiosClient = require('./lib/axios');
 
 /**
  * @typedef {Object} Envoy
@@ -44,4 +45,5 @@ module.exports = {
   middleware,
   errorMiddleware,
   asyncHandler,
+  createAxiosClient,
 };

package/lib/axios.js

@@ -0,0 +1,23 @@
+const { AxiosError } = require('axios');
+const axios = require('axios');
+
+function createAxiosClient(config) {
+    const client = axios.create(config);
+    client.interceptors.response.use(
+        (response) => {
+           return response 
+        },
+        (error) => {
+            // if the response class type is AxiosError, scrub config fields containing sensitive data
+            if (error instanceof AxiosError) {
+                delete error.config.headers;
+                delete error.config.proxy;
+            }
+            return Promise.reject(error);
+        },
+    );
+
+    return client;
+}
+
+module.exports = createAxiosClient;

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@envoy/envoy-integrations-sdk",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "jest"
   },
   "repository": {
     "type": "git",
@@ -17,9 +17,10 @@
   },
   "homepage": "https://github.com/envoy/envoy-integrations-sdk-nodejs#readme",
   "dependencies": {
+    "axios": "^1.4.0",
     "body-parser": "^1.19.0",
     "dotenv": "^8.1.0",
-    "jsonwebtoken": "^8.5.1",
+    "jsonwebtoken": "^9.0.0",
     "request": "^2.88.0",
     "request-promise-native": "^1.0.7"
   },
@@ -28,8 +29,9 @@
     "eslint": "^5.16.0",
     "eslint-config-airbnb-base": "^13.1.0",
     "eslint-plugin-import": "^2.17.3",
+    "jest": "^29.5.0",
     "jsdoc-to-markdown": "^5.0.0",
-    "mocha": "^6.1.4",
+    "mocha": "^10.2.0",
     "proxyquire": "^2.1.0",
     "sinon": "^7.3.2"
   }

package/test/axios.test.js

@@ -0,0 +1,54 @@
+const axios = require('axios');
+const createClient = require('../lib/axios')
+
+describe('axios', () => {
+    it('default client should leak credentials in AxiosError', async () => {
+        const client = axios.create({
+            headers: {
+                Authorization: 'Bearer 1234',
+            },
+            proxy: {
+                host: 'localhost',
+                auth: {
+                    username: 'myWhackyUsername',
+                    password: 'myWhackyPassword',
+                }
+            }
+        });
+        try {
+            await client.get('http://localhost:3000/axios-error');
+        } catch (error) {
+            expect(error.config.headers).toBeDefined();
+            expect(error.config.proxy).toBeDefined();
+            const errorStr = JSON.stringify(error);
+            expect(errorStr).toContain('Bearer 1234');
+            expect(errorStr).toContain('myWhackyUsername');
+            expect(errorStr).toContain('myWhackyPassword');
+        }
+    });
+
+    it('should sanitize AxiosError response', async () => {
+        const client = createClient({
+            headers: {
+                Authorization: 'Bearer 1234',
+            },
+            proxy: {
+                host: 'localhost',
+                auth: {
+                    username: 'myWhackyUsername',
+                    password: 'myWhackyPassword',
+                }
+            }
+        });
+        try {
+            await client.get('http://localhost:3000/axios-error');
+        } catch (error) {
+            expect(error.config.headers).toBeUndefined();
+            expect(error.config.proxy).toBeUndefined();
+            const errorStr = JSON.stringify(error);
+            expect(errorStr).not.toContain('Bearer 1234');
+            expect(errorStr).not.toContain('myWhackyUsername');
+            expect(errorStr).not.toContain('myWhackyPassword');
+        }
+    });
+});