@hummingbirdworks/proxy 0.3.0 → 0.3.1

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 ps Hummingbird
+Copyright (c) 2026 Hummingbird
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/bin/hummingbird-proxy.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 "use strict";
 
 const { spawn, spawnSync } = require("node:child_process");
@@ -95,15 +95,20 @@ function main() {
     return;
   }
 
-  // First non-flag argument is the config path; everything else is forwarded to mitmdump.
+  // Only the first token can be the config path, and only when it isn't a
+  // flag; everything else is forwarded to mitmdump so a flag's value (e.g. the
+  // `8888` in `-p 8888`) is never mistaken for the config path.
   let configArg;
-  const passthrough = [];
-  for (const arg of argv) {
-    if (configArg === undefined && !arg.startsWith("-")) {
-      configArg = arg;
-    } else {
-      passthrough.push(arg);
-    }
+  let passthrough;
+  if (argv.length > 0 && !argv[0].startsWith("-")) {
+    configArg = argv[0];
+    passthrough = argv.slice(1);
+  } else {
+    passthrough = argv.slice();
+  }
+  // Drop a leading `--` separator; the rest already goes to mitmdump.
+  if (passthrough[0] === "--") {
+    passthrough.shift();
   }
 
   const configPath = path.resolve(process.cwd(), configArg || DEFAULT_CONFIG);

package/hummingbird_proxy/addon.py

@@ -84,6 +84,7 @@ class DataverseProxy:
                         item_type,
                         item["name"],
                         item["_base_dir"],
+                        root=item["folder"],
                     )
                     return
 
@@ -95,5 +96,12 @@ class DataverseProxy:
                     if is_css:
                         parts.append("css")
                     parts.extend(segment for segment in relative.split("/") if segment)
-                    serving.serve_file(flow, os.path.join(*parts), item_type, item["name"], item["_base_dir"])
+                    serving.serve_file(
+                        flow,
+                        os.path.join(*parts),
+                        item_type,
+                        item["name"],
+                        item["_base_dir"],
+                        root=item["folder"],
+                    )
                     return

package/hummingbird_proxy/config.py

@@ -124,6 +124,11 @@ def validate_config(config: list[dict]) -> list[dict]:
         unknown = item.keys() - (required | _OPTIONAL_KEYS | _INTERNAL_KEYS)
         if unknown:
             raise ValueError(f"{label} (type={item_type!r}): unknown keys {sorted(unknown)}")
+        # Prefix matching relies on a trailing slash to mark the name boundary,
+        # so normalize it rather than silently mismatching a sibling resource.
+        if item_type in ("folder", "devserver") and isinstance(item.get("name"), str):
+            if not item["name"].endswith("/"):
+                item["name"] += "/"
         if not item.get("disabled", False):
             enabled.append(item)
     return enabled

package/hummingbird_proxy/serving.py

@@ -3,11 +3,27 @@
 from urllib.parse import urlsplit
 
 import mimetypes
+import os
 
 from mitmproxy import ctx, http
 
 from hummingbird_proxy.config import resolve_path
 
+# Explicit types for common web assets; the OS mimetypes DB is unreliable here
+# (e.g. Windows maps .js to text/plain, which browsers refuse to execute).
+_CONTENT_TYPES = {
+    ".js": "text/javascript",
+    ".mjs": "text/javascript",
+    ".cjs": "text/javascript",
+    ".css": "text/css",
+    ".html": "text/html",
+    ".htm": "text/html",
+    ".json": "application/json",
+    ".map": "application/json",
+    ".svg": "image/svg+xml",
+    ".wasm": "application/wasm",
+}
+
 
 def _log_redirect(flow: http.HTTPFlow, rule_type: str, rule_name: str, destination: str) -> None:
     ctx.log.info(
@@ -15,8 +31,32 @@ def _log_redirect(flow: http.HTTPFlow, rule_type: str, rule_name: str, destinati
     )
 
 
-def serve_file(flow: http.HTTPFlow, filepath: str, rule_type: str, rule_name: str, base_dir: str) -> None:
+def _is_within(root: str, path: str) -> bool:
+    """True if PATH is ROOT itself or nested under it (after normalization)."""
+    try:
+        return os.path.commonpath([root, path]) == root
+    except ValueError:
+        # Raised when the paths live on different drives (Windows).
+        return False
+
+
+def serve_file(
+    flow: http.HTTPFlow,
+    filepath: str,
+    rule_type: str,
+    rule_name: str,
+    base_dir: str,
+    root: str | None = None,
+) -> None:
     absolute_path = resolve_path(filepath, base_dir)
+    if root is not None and not _is_within(resolve_path(root, base_dir), absolute_path):
+        ctx.log.warn(f"Blocked path traversal for {rule_type}:{rule_name} -> {absolute_path}")
+        flow.response = http.Response.make(
+            403,
+            b"dataverseproxy: path escapes the configured folder",
+            {"Content-Type": "text/plain"},
+        )
+        return
     try:
         with open(absolute_path, "rb") as handle:
             content = handle.read()
@@ -28,7 +68,10 @@ def serve_file(flow: http.HTTPFlow, filepath: str, rule_type: str, rule_name: st
             {"Content-Type": "text/plain"},
         )
         return
-    content_type = mimetypes.guess_type(absolute_path)[0] or "application/octet-stream"
+    ext = os.path.splitext(absolute_path)[1].lower()
+    content_type = (
+        _CONTENT_TYPES.get(ext) or mimetypes.guess_type(absolute_path)[0] or "application/octet-stream"
+    )
     flow.response = http.Response.make(200, content, {"Content-Type": content_type})
     _log_redirect(flow, rule_type, rule_name, absolute_path)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hummingbirdworks/proxy",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "mitmproxy-based dev proxy that redirects Dataverse / Dynamics 365 web resources and PCF control assets to local dev builds or a running dev server.",
   "bin": {
     "hummingbird-proxy": "bin/hummingbird-proxy.js"
@@ -12,6 +12,18 @@
     },
     "./package.json": "./package.json"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ps-Hummingbird/powerapps-mitm-proxy-addon.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ps-Hummingbird/powerapps-mitm-proxy-addon/issues"
+  },
+  "homepage": "https://github.com/ps-Hummingbird/powerapps-mitm-proxy-addon#readme",
+  "author": {
+    "name": "Hummingbird",
+    "url": "https://www.hummingbirdworks.ai/"
+  },
   "files": [
     "bin/",
     "vite/",

package/powerapp_dev_proxy.py

@@ -8,8 +8,6 @@ during load, so the sibling ``hummingbird_proxy`` package resolves here. All
 implementation lives in that package; this module is just the entrypoint.
 """
 
-# Version 2026-08-21
-
 from hummingbird_proxy import DataverseProxy, config_path
 
 addons = [DataverseProxy(config_path())]