@verdaccio/url 12.0.0-next-7.14 → 12.0.0-next-7.16

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Change Log
 
+## 12.0.0-next-7.16
+
+### Patch Changes
+
+- 38b1e82: patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array (#4613 by @Tobbe)
+  - @verdaccio/core@7.0.0-next-7.16
+
+## 12.0.0-next-7.15
+
+### Patch Changes
+
+- Updated dependencies [bd8703e]
+  - @verdaccio/core@7.0.0-next-7.15
+
 ## 12.0.0-next-7.14
 
 ### Patch Changes

package/build/index.js

@@ -106,8 +106,15 @@ function getPublicUrl(url_prefix = '', requestOptions) {
     if (!isHost(host)) {
       throw new Error('invalid host');
     }
+
+    // 'X-Forwarded-Proto' is the default header
     const protoHeader = (_process$env$VERDACCI = (_process$env$VERDACCI2 = process.env.VERDACCIO_FORWARDED_PROTO) === null || _process$env$VERDACCI2 === void 0 ? void 0 : _process$env$VERDACCI2.toLocaleLowerCase()) !== null && _process$env$VERDACCI !== void 0 ? _process$env$VERDACCI : _core.HEADERS.FORWARDED_PROTO.toLowerCase();
     const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];
+    if (Array.isArray(forwardedProtocolHeaderValue)) {
+      // This really should never happen - only set-cookie is allowed to have
+      // multiple values.
+      throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);
+    }
     const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);
     const combinedUrl = combineBaseUrl(protocol, host, url_prefix);
     debug('public url by request %o', combinedUrl);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_debug","_interopRequireDefault","require","_url","_validator","_core","obj","__esModule","default","debug","buildDebug","validProtocols","isURLhasValidProtocol","uri","test","isHost","url","options","validator","isURL","require_host","allow_trailing_dot","require_valid_protocol","require_port","require_tld","getWebProtocol","headerProtocol","protocol","returnProtocol","defaultProtocol","commaIndex","indexOf","slice","includes","wrapPrefix","prefix","startsWith","endsWith","combineBaseUrl","host","newPrefix","groupedURI","URL","result","href","validateURL","publicUrl","parsed","replace","Error","err","getPublicUrl","url_prefix","requestOptions","process","env","VERDACCIO_PUBLIC_URL","envURL","headers","_process$env$VERDACCI","_process$env$VERDACCI2","protoHeader","VERDACCIO_FORWARDED_PROTO","toLocaleLowerCase","HEADERS","FORWARDED_PROTO","toLowerCase","forwardedProtocolHeaderValue","combinedUrl","exports"],"sources":["../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\nimport { URL } from 'url';\nimport validator from 'validator';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:core:url');\n\nconst validProtocols = ['https', 'http'];\n\n/**\n * Check if URI is starting with \"http://\", \"https://\" or \"//\"\n * @param {string} uri\n */\nexport function isURLhasValidProtocol(uri: string): boolean {\n  return /^(https?:)?\\/\\//.test(uri);\n}\n\nexport function isHost(url: string = '', options = {}): boolean {\n  return validator.isURL(url, {\n    require_host: true,\n    allow_trailing_dot: false,\n    require_valid_protocol: false,\n    // @ts-ignore\n    require_port: false,\n    require_tld: false,\n    ...options,\n  });\n}\n\n/**\n * Detect running protocol (http or https)\n */\nexport function getWebProtocol(headerProtocol: string | undefined, protocol: string): string {\n  let returnProtocol;\n  const [, defaultProtocol] = validProtocols;\n  // HAProxy variant might return http,http with X-Forwarded-Proto\n  if (typeof headerProtocol === 'string' && headerProtocol !== '') {\n    debug('header protocol: %o', protocol);\n    const commaIndex = headerProtocol.indexOf(',');\n    returnProtocol = commaIndex > 0 ? headerProtocol.slice(0, commaIndex) : headerProtocol;\n  } else {\n    debug('req protocol: %o', headerProtocol);\n    returnProtocol = protocol;\n  }\n\n  return validProtocols.includes(returnProtocol) ? returnProtocol : defaultProtocol;\n}\n\nexport function wrapPrefix(prefix: string | void): string {\n  if (prefix === '' || typeof prefix === 'undefined' || prefix === null) {\n    return '';\n  } else if (!prefix.startsWith('/') && prefix.endsWith('/')) {\n    return `/${prefix}`;\n  } else if (!prefix.startsWith('/') && !prefix.endsWith('/')) {\n    return `/${prefix}/`;\n  } else if (prefix.startsWith('/') && !prefix.endsWith('/')) {\n    return `${prefix}/`;\n  } else {\n    return prefix;\n  }\n}\n\n/**\n * Create base url for registry.\n * @return {String} base registry url\n */\nexport function combineBaseUrl(protocol: string, host: string, prefix: string = ''): string {\n  debug('combined protocol %o', protocol);\n  debug('combined host %o', host);\n  const newPrefix = wrapPrefix(prefix);\n  debug('combined prefix %o', newPrefix);\n  const groupedURI = new URL(wrapPrefix(prefix), `${protocol}://${host}`);\n  const result = groupedURI.href;\n  debug('combined url %o', result);\n  return result;\n}\n\nexport function validateURL(publicUrl: string | void) {\n  try {\n    const parsed = new URL(publicUrl as string);\n    if (!validProtocols.includes(parsed.protocol.replace(':', ''))) {\n      throw Error('invalid protocol');\n    }\n    return true;\n  } catch (err: any) {\n    // TODO: add error logger here\n    return false;\n  }\n}\n\nexport type RequestOptions = {\n  /**\n   * Request host.\n   */\n  host: string;\n  /**\n   * Request protocol.\n   */\n  protocol: string;\n  /**\n   * Request headers.\n   */\n  headers: IncomingHttpHeaders;\n  remoteAddress?: string;\n  /**\n   * Logged username the request, usually after token verification.\n   */\n  username?: string;\n};\n\nexport function getPublicUrl(url_prefix: string = '', requestOptions: RequestOptions): string {\n  if (validateURL(process.env.VERDACCIO_PUBLIC_URL as string)) {\n    const envURL = new URL(wrapPrefix(url_prefix), process.env.VERDACCIO_PUBLIC_URL as string).href;\n    debug('public url by env %o', envURL);\n    return envURL;\n  } else if (requestOptions.headers['host']) {\n    const host = requestOptions.headers['host'];\n    if (!isHost(host)) {\n      throw new Error('invalid host');\n    }\n\n    const protoHeader: string =\n      process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??\n      HEADERS.FORWARDED_PROTO.toLowerCase();\n    const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader] as string | undefined;\n\n    const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);\n    const combinedUrl = combineBaseUrl(protocol, host, url_prefix);\n    debug('public url by request %o', combinedUrl);\n    return combinedUrl;\n  } else {\n    return '/';\n  }\n}\n\nexport const isURL = validator.isURL;\n"],"mappings":";;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AAA0C,SAAAD,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAE1C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE9C,MAAMC,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;;AAExC;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CAACC,GAAW,EAAW;EAC1D,OAAO,iBAAiB,CAACC,IAAI,CAACD,GAAG,CAAC;AACpC;AAEO,SAASE,MAAMA,CAACC,GAAW,GAAG,EAAE,EAAEC,OAAO,GAAG,CAAC,CAAC,EAAW;EAC9D,OAAOC,kBAAS,CAACC,KAAK,CAACH,GAAG,EAAE;IAC1BI,YAAY,EAAE,IAAI;IAClBC,kBAAkB,EAAE,KAAK;IACzBC,sBAAsB,EAAE,KAAK;IAC7B;IACAC,YAAY,EAAE,KAAK;IACnBC,WAAW,EAAE,KAAK;IAClB,GAAGP;EACL,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACO,SAASQ,cAAcA,CAACC,cAAkC,EAAEC,QAAgB,EAAU;EAC3F,IAAIC,cAAc;EAClB,MAAM,GAAGC,eAAe,CAAC,GAAGlB,cAAc;EAC1C;EACA,IAAI,OAAOe,cAAc,KAAK,QAAQ,IAAIA,cAAc,KAAK,EAAE,EAAE;IAC/DjB,KAAK,CAAC,qBAAqB,EAAEkB,QAAQ,CAAC;IACtC,MAAMG,UAAU,GAAGJ,cAAc,CAACK,OAAO,CAAC,GAAG,CAAC;IAC9CH,cAAc,GAAGE,UAAU,GAAG,CAAC,GAAGJ,cAAc,CAACM,KAAK,CAAC,CAAC,EAAEF,UAAU,CAAC,GAAGJ,cAAc;EACxF,CAAC,MAAM;IACLjB,KAAK,CAAC,kBAAkB,EAAEiB,cAAc,CAAC;IACzCE,cAAc,GAAGD,QAAQ;EAC3B;EAEA,OAAOhB,cAAc,CAACsB,QAAQ,CAACL,cAAc,CAAC,GAAGA,cAAc,GAAGC,eAAe;AACnF;AAEO,SAASK,UAAUA,CAACC,MAAqB,EAAU;EACxD,IAAIA,MAAM,KAAK,EAAE,IAAI,OAAOA,MAAM,KAAK,WAAW,IAAIA,MAAM,KAAK,IAAI,EAAE;IACrE,OAAO,EAAE;EACX,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAID,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,IAAGF,MAAO,EAAC;EACrB,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC3D,OAAQ,IAAGF,MAAO,GAAE;EACtB,CAAC,MAAM,IAAIA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,GAAEF,MAAO,GAAE;EACrB,CAAC,MAAM;IACL,OAAOA,MAAM;EACf;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASG,cAAcA,CAACX,QAAgB,EAAEY,IAAY,EAAEJ,MAAc,GAAG,EAAE,EAAU;EAC1F1B,KAAK,CAAC,sBAAsB,EAAEkB,QAAQ,CAAC;EACvClB,KAAK,CAAC,kBAAkB,EAAE8B,IAAI,CAAC;EAC/B,MAAMC,SAAS,GAAGN,UAAU,CAACC,MAAM,CAAC;EACpC1B,KAAK,CAAC,oBAAoB,EAAE+B,SAAS,CAAC;EACtC,MAAMC,UAAU,GAAG,IAAIC,QAAG,CAACR,UAAU,CAACC,MAAM,CAAC,EAAG,GAAER,QAAS,MAAKY,IAAK,EAAC,CAAC;EACvE,MAAMI,MAAM,GAAGF,UAAU,CAACG,IAAI;EAC9BnC,KAAK,CAAC,iBAAiB,EAAEkC,MAAM,CAAC;EAChC,OAAOA,MAAM;AACf;AAEO,SAASE,WAAWA,CAACC,SAAwB,EAAE;EACpD,IAAI;IACF,MAAMC,MAAM,GAAG,IAAIL,QAAG,CAACI,SAAmB,CAAC;IAC3C,IAAI,CAACnC,cAAc,CAACsB,QAAQ,CAACc,MAAM,CAACpB,QAAQ,CAACqB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE;MAC9D,MAAMC,KAAK,CAAC,kBAAkB,CAAC;IACjC;IACA,OAAO,IAAI;EACb,CAAC,CAAC,OAAOC,GAAQ,EAAE;IACjB;IACA,OAAO,KAAK;EACd;AACF;AAsBO,SAASC,YAAYA,CAACC,UAAkB,GAAG,EAAE,EAAEC,cAA8B,EAAU;EAC5F,IAAIR,WAAW,CAACS,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,EAAE;IAC3D,MAAMC,MAAM,GAAG,IAAIf,QAAG,CAACR,UAAU,CAACkB,UAAU,CAAC,EAAEE,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,CAACZ,IAAI;IAC/FnC,KAAK,CAAC,sBAAsB,EAAEgD,MAAM,CAAC;IACrC,OAAOA,MAAM;EACf,CAAC,MAAM,IAAIJ,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;IAAA,IAAAC,qBAAA,EAAAC,sBAAA;IACzC,MAAMrB,IAAI,GAAGc,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC3C,MAAM,CAACwB,IAAI,CAAC,EAAE;MACjB,MAAM,IAAIU,KAAK,CAAC,cAAc,CAAC;IACjC;IAEA,MAAMY,WAAmB,IAAAF,qBAAA,IAAAC,sBAAA,GACvBN,OAAO,CAACC,GAAG,CAACO,yBAAyB,cAAAF,sBAAA,uBAArCA,sBAAA,CAAuCG,iBAAiB,CAAC,CAAC,cAAAJ,qBAAA,cAAAA,qBAAA,GAC1DK,aAAO,CAACC,eAAe,CAACC,WAAW,CAAC,CAAC;IACvC,MAAMC,4BAA4B,GAAGd,cAAc,CAACK,OAAO,CAACG,WAAW,CAAuB;IAE9F,MAAMlC,QAAQ,GAAGF,cAAc,CAAC0C,4BAA4B,EAAEd,cAAc,CAAC1B,QAAQ,CAAC;IACtF,MAAMyC,WAAW,GAAG9B,cAAc,CAACX,QAAQ,EAAEY,IAAI,EAAEa,UAAU,CAAC;IAC9D3C,KAAK,CAAC,0BAA0B,EAAE2D,WAAW,CAAC;IAC9C,OAAOA,WAAW;EACpB,CAAC,MAAM;IACL,OAAO,GAAG;EACZ;AACF;AAEO,MAAMjD,KAAK,GAAAkD,OAAA,CAAAlD,KAAA,GAAGD,kBAAS,CAACC,KAAK"}
+{"version":3,"file":"index.js","names":["_debug","_interopRequireDefault","require","_url","_validator","_core","obj","__esModule","default","debug","buildDebug","validProtocols","isURLhasValidProtocol","uri","test","isHost","url","options","validator","isURL","require_host","allow_trailing_dot","require_valid_protocol","require_port","require_tld","getWebProtocol","headerProtocol","protocol","returnProtocol","defaultProtocol","commaIndex","indexOf","slice","includes","wrapPrefix","prefix","startsWith","endsWith","combineBaseUrl","host","newPrefix","groupedURI","URL","result","href","validateURL","publicUrl","parsed","replace","Error","err","getPublicUrl","url_prefix","requestOptions","process","env","VERDACCIO_PUBLIC_URL","envURL","headers","_process$env$VERDACCI","_process$env$VERDACCI2","protoHeader","VERDACCIO_FORWARDED_PROTO","toLocaleLowerCase","HEADERS","FORWARDED_PROTO","toLowerCase","forwardedProtocolHeaderValue","Array","isArray","combinedUrl","exports"],"sources":["../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\nimport { URL } from 'url';\nimport validator from 'validator';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:core:url');\n\nconst validProtocols = ['https', 'http'];\n\n/**\n * Check if URI is starting with \"http://\", \"https://\" or \"//\"\n * @param {string} uri\n */\nexport function isURLhasValidProtocol(uri: string): boolean {\n  return /^(https?:)?\\/\\//.test(uri);\n}\n\nexport function isHost(url: string = '', options = {}): boolean {\n  return validator.isURL(url, {\n    require_host: true,\n    allow_trailing_dot: false,\n    require_valid_protocol: false,\n    // @ts-ignore\n    require_port: false,\n    require_tld: false,\n    ...options,\n  });\n}\n\n/**\n * Detect running protocol (http or https)\n */\nexport function getWebProtocol(headerProtocol: string | undefined, protocol: string): string {\n  let returnProtocol;\n  const [, defaultProtocol] = validProtocols;\n  // HAProxy variant might return http,http with X-Forwarded-Proto\n  if (typeof headerProtocol === 'string' && headerProtocol !== '') {\n    debug('header protocol: %o', protocol);\n    const commaIndex = headerProtocol.indexOf(',');\n    returnProtocol = commaIndex > 0 ? headerProtocol.slice(0, commaIndex) : headerProtocol;\n  } else {\n    debug('req protocol: %o', headerProtocol);\n    returnProtocol = protocol;\n  }\n\n  return validProtocols.includes(returnProtocol) ? returnProtocol : defaultProtocol;\n}\n\nexport function wrapPrefix(prefix: string | void): string {\n  if (prefix === '' || typeof prefix === 'undefined' || prefix === null) {\n    return '';\n  } else if (!prefix.startsWith('/') && prefix.endsWith('/')) {\n    return `/${prefix}`;\n  } else if (!prefix.startsWith('/') && !prefix.endsWith('/')) {\n    return `/${prefix}/`;\n  } else if (prefix.startsWith('/') && !prefix.endsWith('/')) {\n    return `${prefix}/`;\n  } else {\n    return prefix;\n  }\n}\n\n/**\n * Create base url for registry.\n * @return {String} base registry url\n */\nexport function combineBaseUrl(protocol: string, host: string, prefix: string = ''): string {\n  debug('combined protocol %o', protocol);\n  debug('combined host %o', host);\n  const newPrefix = wrapPrefix(prefix);\n  debug('combined prefix %o', newPrefix);\n  const groupedURI = new URL(wrapPrefix(prefix), `${protocol}://${host}`);\n  const result = groupedURI.href;\n  debug('combined url %o', result);\n  return result;\n}\n\nexport function validateURL(publicUrl: string | void) {\n  try {\n    const parsed = new URL(publicUrl as string);\n    if (!validProtocols.includes(parsed.protocol.replace(':', ''))) {\n      throw Error('invalid protocol');\n    }\n    return true;\n  } catch (err: any) {\n    // TODO: add error logger here\n    return false;\n  }\n}\n\nexport type RequestOptions = {\n  /**\n   * Request host.\n   */\n  host: string;\n  /**\n   * Request protocol.\n   */\n  protocol: string;\n  /**\n   * Request headers.\n   */\n  headers: IncomingHttpHeaders;\n  remoteAddress?: string;\n  /**\n   * Logged username the request, usually after token verification.\n   */\n  username?: string;\n};\n\nexport function getPublicUrl(url_prefix: string = '', requestOptions: RequestOptions): string {\n  if (validateURL(process.env.VERDACCIO_PUBLIC_URL as string)) {\n    const envURL = new URL(wrapPrefix(url_prefix), process.env.VERDACCIO_PUBLIC_URL as string).href;\n    debug('public url by env %o', envURL);\n    return envURL;\n  } else if (requestOptions.headers['host']) {\n    const host = requestOptions.headers['host'];\n    if (!isHost(host)) {\n      throw new Error('invalid host');\n    }\n\n    // 'X-Forwarded-Proto' is the default header\n    const protoHeader: string =\n      process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??\n      HEADERS.FORWARDED_PROTO.toLowerCase();\n    const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];\n\n    if (Array.isArray(forwardedProtocolHeaderValue)) {\n      // This really should never happen - only set-cookie is allowed to have\n      // multiple values.\n      throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);\n    }\n\n    const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);\n    const combinedUrl = combineBaseUrl(protocol, host, url_prefix);\n    debug('public url by request %o', combinedUrl);\n    return combinedUrl;\n  } else {\n    return '/';\n  }\n}\n\nexport const isURL = validator.isURL;\n"],"mappings":";;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AAA0C,SAAAD,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAE1C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE9C,MAAMC,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;;AAExC;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CAACC,GAAW,EAAW;EAC1D,OAAO,iBAAiB,CAACC,IAAI,CAACD,GAAG,CAAC;AACpC;AAEO,SAASE,MAAMA,CAACC,GAAW,GAAG,EAAE,EAAEC,OAAO,GAAG,CAAC,CAAC,EAAW;EAC9D,OAAOC,kBAAS,CAACC,KAAK,CAACH,GAAG,EAAE;IAC1BI,YAAY,EAAE,IAAI;IAClBC,kBAAkB,EAAE,KAAK;IACzBC,sBAAsB,EAAE,KAAK;IAC7B;IACAC,YAAY,EAAE,KAAK;IACnBC,WAAW,EAAE,KAAK;IAClB,GAAGP;EACL,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACO,SAASQ,cAAcA,CAACC,cAAkC,EAAEC,QAAgB,EAAU;EAC3F,IAAIC,cAAc;EAClB,MAAM,GAAGC,eAAe,CAAC,GAAGlB,cAAc;EAC1C;EACA,IAAI,OAAOe,cAAc,KAAK,QAAQ,IAAIA,cAAc,KAAK,EAAE,EAAE;IAC/DjB,KAAK,CAAC,qBAAqB,EAAEkB,QAAQ,CAAC;IACtC,MAAMG,UAAU,GAAGJ,cAAc,CAACK,OAAO,CAAC,GAAG,CAAC;IAC9CH,cAAc,GAAGE,UAAU,GAAG,CAAC,GAAGJ,cAAc,CAACM,KAAK,CAAC,CAAC,EAAEF,UAAU,CAAC,GAAGJ,cAAc;EACxF,CAAC,MAAM;IACLjB,KAAK,CAAC,kBAAkB,EAAEiB,cAAc,CAAC;IACzCE,cAAc,GAAGD,QAAQ;EAC3B;EAEA,OAAOhB,cAAc,CAACsB,QAAQ,CAACL,cAAc,CAAC,GAAGA,cAAc,GAAGC,eAAe;AACnF;AAEO,SAASK,UAAUA,CAACC,MAAqB,EAAU;EACxD,IAAIA,MAAM,KAAK,EAAE,IAAI,OAAOA,MAAM,KAAK,WAAW,IAAIA,MAAM,KAAK,IAAI,EAAE;IACrE,OAAO,EAAE;EACX,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAID,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,IAAGF,MAAO,EAAC;EACrB,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC3D,OAAQ,IAAGF,MAAO,GAAE;EACtB,CAAC,MAAM,IAAIA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,GAAEF,MAAO,GAAE;EACrB,CAAC,MAAM;IACL,OAAOA,MAAM;EACf;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASG,cAAcA,CAACX,QAAgB,EAAEY,IAAY,EAAEJ,MAAc,GAAG,EAAE,EAAU;EAC1F1B,KAAK,CAAC,sBAAsB,EAAEkB,QAAQ,CAAC;EACvClB,KAAK,CAAC,kBAAkB,EAAE8B,IAAI,CAAC;EAC/B,MAAMC,SAAS,GAAGN,UAAU,CAACC,MAAM,CAAC;EACpC1B,KAAK,CAAC,oBAAoB,EAAE+B,SAAS,CAAC;EACtC,MAAMC,UAAU,GAAG,IAAIC,QAAG,CAACR,UAAU,CAACC,MAAM,CAAC,EAAG,GAAER,QAAS,MAAKY,IAAK,EAAC,CAAC;EACvE,MAAMI,MAAM,GAAGF,UAAU,CAACG,IAAI;EAC9BnC,KAAK,CAAC,iBAAiB,EAAEkC,MAAM,CAAC;EAChC,OAAOA,MAAM;AACf;AAEO,SAASE,WAAWA,CAACC,SAAwB,EAAE;EACpD,IAAI;IACF,MAAMC,MAAM,GAAG,IAAIL,QAAG,CAACI,SAAmB,CAAC;IAC3C,IAAI,CAACnC,cAAc,CAACsB,QAAQ,CAACc,MAAM,CAACpB,QAAQ,CAACqB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE;MAC9D,MAAMC,KAAK,CAAC,kBAAkB,CAAC;IACjC;IACA,OAAO,IAAI;EACb,CAAC,CAAC,OAAOC,GAAQ,EAAE;IACjB;IACA,OAAO,KAAK;EACd;AACF;AAsBO,SAASC,YAAYA,CAACC,UAAkB,GAAG,EAAE,EAAEC,cAA8B,EAAU;EAC5F,IAAIR,WAAW,CAACS,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,EAAE;IAC3D,MAAMC,MAAM,GAAG,IAAIf,QAAG,CAACR,UAAU,CAACkB,UAAU,CAAC,EAAEE,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,CAACZ,IAAI;IAC/FnC,KAAK,CAAC,sBAAsB,EAAEgD,MAAM,CAAC;IACrC,OAAOA,MAAM;EACf,CAAC,MAAM,IAAIJ,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;IAAA,IAAAC,qBAAA,EAAAC,sBAAA;IACzC,MAAMrB,IAAI,GAAGc,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC3C,MAAM,CAACwB,IAAI,CAAC,EAAE;MACjB,MAAM,IAAIU,KAAK,CAAC,cAAc,CAAC;IACjC;;IAEA;IACA,MAAMY,WAAmB,IAAAF,qBAAA,IAAAC,sBAAA,GACvBN,OAAO,CAACC,GAAG,CAACO,yBAAyB,cAAAF,sBAAA,uBAArCA,sBAAA,CAAuCG,iBAAiB,CAAC,CAAC,cAAAJ,qBAAA,cAAAA,qBAAA,GAC1DK,aAAO,CAACC,eAAe,CAACC,WAAW,CAAC,CAAC;IACvC,MAAMC,4BAA4B,GAAGd,cAAc,CAACK,OAAO,CAACG,WAAW,CAAC;IAExE,IAAIO,KAAK,CAACC,OAAO,CAACF,4BAA4B,CAAC,EAAE;MAC/C;MACA;MACA,MAAM,IAAIlB,KAAK,CAAC,0DAA0D,GAAGY,WAAW,CAAC;IAC3F;IAEA,MAAMlC,QAAQ,GAAGF,cAAc,CAAC0C,4BAA4B,EAAEd,cAAc,CAAC1B,QAAQ,CAAC;IACtF,MAAM2C,WAAW,GAAGhC,cAAc,CAACX,QAAQ,EAAEY,IAAI,EAAEa,UAAU,CAAC;IAC9D3C,KAAK,CAAC,0BAA0B,EAAE6D,WAAW,CAAC;IAC9C,OAAOA,WAAW;EACpB,CAAC,MAAM;IACL,OAAO,GAAG;EACZ;AACF;AAEO,MAAMnD,KAAK,GAAAoD,OAAA,CAAApD,KAAA,GAAGD,kBAAS,CAACC,KAAK"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/url",
-  "version": "12.0.0-next-7.14",
+  "version": "12.0.0-next-7.16",
   "description": "url utilities resolver",
   "keywords": [
     "private",
@@ -33,13 +33,13 @@
     "access": "public"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next-7.14",
+    "@verdaccio/core": "7.0.0-next-7.16",
     "debug": "4.3.4",
     "lodash": "4.17.21",
     "validator": "13.11.0"
   },
   "devDependencies": {
-    "@verdaccio/types": "12.0.0-next.2",
+    "@verdaccio/types": "12.0.0-next-7.3",
     "node-mocks-http": "1.14.1"
   },
   "funding": {

package/src/index.ts

@@ -121,10 +121,17 @@ export function getPublicUrl(url_prefix: string = '', requestOptions: RequestOpt
       throw new Error('invalid host');
     }
 
+    // 'X-Forwarded-Proto' is the default header
     const protoHeader: string =
       process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??
       HEADERS.FORWARDED_PROTO.toLowerCase();
-    const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader] as string | undefined;
+    const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];
+
+    if (Array.isArray(forwardedProtocolHeaderValue)) {
+      // This really should never happen - only set-cookie is allowed to have
+      // multiple values.
+      throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);
+    }
 
     const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);
     const combinedUrl = combineBaseUrl(protocol, host, url_prefix);

package/tests/getPublicUrl.spec.ts

@@ -316,6 +316,31 @@ describe('env variable', () => {
     delete process.env.VERDACCIO_FORWARDED_PROTO;
   });
 
+  test('with the VERDACCIO_FORWARDED_PROTO environment variable set to "set-cookie"', () => {
+    process.env.VERDACCIO_FORWARDED_PROTO = 'set-cookie';
+    const req = httpMocks.createRequest({
+      method: 'GET',
+      headers: {
+        host: 'some.com',
+        cookie: 'name=value; name2=value2;',
+        'set-cookie': [
+          'cookieName1=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
+          'cookieName2=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
+        ],
+      },
+      url: '/',
+    });
+
+    expect(() =>
+      getPublicUrl('/test/', {
+        host: req.hostname,
+        headers: req.headers as any,
+        protocol: req.protocol,
+      })
+    ).toThrow('invalid forwarded protocol header value. Reading header set-cookie');
+    delete process.env.VERDACCIO_FORWARDED_PROTO;
+  });
+
   test('with a invalid X-Forwarded-Proto https and host injection with invalid host', () => {
     process.env.VERDACCIO_PUBLIC_URL = 'http://injection.test.com"><svg onload="alert(1)">';
     const req = httpMocks.createRequest({