@verdaccio/url 12.0.0-next-7.15 → 12.0.0-next-7.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +14 -0
- package/build/index.js +7 -0
- package/build/index.js.map +1 -1
- package/package.json +3 -3
- package/src/index.ts +8 -1
- package/tests/getPublicUrl.spec.ts +25 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Change Log
|
|
2
2
|
|
|
3
|
+
## 12.0.0-next-7.17
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [6e764e3]
|
|
8
|
+
- @verdaccio/core@7.0.0-next-7.17
|
|
9
|
+
|
|
10
|
+
## 12.0.0-next-7.16
|
|
11
|
+
|
|
12
|
+
### Patch Changes
|
|
13
|
+
|
|
14
|
+
- 38b1e82: patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array (#4613 by @Tobbe)
|
|
15
|
+
- @verdaccio/core@7.0.0-next-7.16
|
|
16
|
+
|
|
3
17
|
## 12.0.0-next-7.15
|
|
4
18
|
|
|
5
19
|
### Patch Changes
|
package/build/index.js
CHANGED
|
@@ -106,8 +106,15 @@ function getPublicUrl(url_prefix = '', requestOptions) {
|
|
|
106
106
|
if (!isHost(host)) {
|
|
107
107
|
throw new Error('invalid host');
|
|
108
108
|
}
|
|
109
|
+
|
|
110
|
+
// 'X-Forwarded-Proto' is the default header
|
|
109
111
|
const protoHeader = (_process$env$VERDACCI = (_process$env$VERDACCI2 = process.env.VERDACCIO_FORWARDED_PROTO) === null || _process$env$VERDACCI2 === void 0 ? void 0 : _process$env$VERDACCI2.toLocaleLowerCase()) !== null && _process$env$VERDACCI !== void 0 ? _process$env$VERDACCI : _core.HEADERS.FORWARDED_PROTO.toLowerCase();
|
|
110
112
|
const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];
|
|
113
|
+
if (Array.isArray(forwardedProtocolHeaderValue)) {
|
|
114
|
+
// This really should never happen - only set-cookie is allowed to have
|
|
115
|
+
// multiple values.
|
|
116
|
+
throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);
|
|
117
|
+
}
|
|
111
118
|
const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);
|
|
112
119
|
const combinedUrl = combineBaseUrl(protocol, host, url_prefix);
|
|
113
120
|
debug('public url by request %o', combinedUrl);
|
package/build/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":["_debug","_interopRequireDefault","require","_url","_validator","_core","obj","__esModule","default","debug","buildDebug","validProtocols","isURLhasValidProtocol","uri","test","isHost","url","options","validator","isURL","require_host","allow_trailing_dot","require_valid_protocol","require_port","require_tld","getWebProtocol","headerProtocol","protocol","returnProtocol","defaultProtocol","commaIndex","indexOf","slice","includes","wrapPrefix","prefix","startsWith","endsWith","combineBaseUrl","host","newPrefix","groupedURI","URL","result","href","validateURL","publicUrl","parsed","replace","Error","err","getPublicUrl","url_prefix","requestOptions","process","env","VERDACCIO_PUBLIC_URL","envURL","headers","_process$env$VERDACCI","_process$env$VERDACCI2","protoHeader","VERDACCIO_FORWARDED_PROTO","toLocaleLowerCase","HEADERS","FORWARDED_PROTO","toLowerCase","forwardedProtocolHeaderValue","combinedUrl","exports"],"sources":["../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\nimport { URL } from 'url';\nimport validator from 'validator';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:core:url');\n\nconst validProtocols = ['https', 'http'];\n\n/**\n * Check if URI is starting with \"http://\", \"https://\" or \"//\"\n * @param {string} uri\n */\nexport function isURLhasValidProtocol(uri: string): boolean {\n return /^(https?:)?\\/\\//.test(uri);\n}\n\nexport function isHost(url: string = '', options = {}): boolean {\n return validator.isURL(url, {\n require_host: true,\n allow_trailing_dot: false,\n require_valid_protocol: false,\n // @ts-ignore\n require_port: false,\n require_tld: false,\n ...options,\n });\n}\n\n/**\n * Detect running protocol (http or https)\n */\nexport function getWebProtocol(headerProtocol: string | undefined, protocol: string): string {\n let returnProtocol;\n const [, defaultProtocol] = validProtocols;\n // HAProxy variant might return http,http with X-Forwarded-Proto\n if (typeof headerProtocol === 'string' && headerProtocol !== '') {\n debug('header protocol: %o', protocol);\n const commaIndex = headerProtocol.indexOf(',');\n returnProtocol = commaIndex > 0 ? headerProtocol.slice(0, commaIndex) : headerProtocol;\n } else {\n debug('req protocol: %o', headerProtocol);\n returnProtocol = protocol;\n }\n\n return validProtocols.includes(returnProtocol) ? returnProtocol : defaultProtocol;\n}\n\nexport function wrapPrefix(prefix: string | void): string {\n if (prefix === '' || typeof prefix === 'undefined' || prefix === null) {\n return '';\n } else if (!prefix.startsWith('/') && prefix.endsWith('/')) {\n return `/${prefix}`;\n } else if (!prefix.startsWith('/') && !prefix.endsWith('/')) {\n return `/${prefix}/`;\n } else if (prefix.startsWith('/') && !prefix.endsWith('/')) {\n return `${prefix}/`;\n } else {\n return prefix;\n }\n}\n\n/**\n * Create base url for registry.\n * @return {String} base registry url\n */\nexport function combineBaseUrl(protocol: string, host: string, prefix: string = ''): string {\n debug('combined protocol %o', protocol);\n debug('combined host %o', host);\n const newPrefix = wrapPrefix(prefix);\n debug('combined prefix %o', newPrefix);\n const groupedURI = new URL(wrapPrefix(prefix), `${protocol}://${host}`);\n const result = groupedURI.href;\n debug('combined url %o', result);\n return result;\n}\n\nexport function validateURL(publicUrl: string | void) {\n try {\n const parsed = new URL(publicUrl as string);\n if (!validProtocols.includes(parsed.protocol.replace(':', ''))) {\n throw Error('invalid protocol');\n }\n return true;\n } catch (err: any) {\n // TODO: add error logger here\n return false;\n }\n}\n\nexport type RequestOptions = {\n /**\n * Request host.\n */\n host: string;\n /**\n * Request protocol.\n */\n protocol: string;\n /**\n * Request headers.\n */\n headers: IncomingHttpHeaders;\n remoteAddress?: string;\n /**\n * Logged username the request, usually after token verification.\n */\n username?: string;\n};\n\nexport function getPublicUrl(url_prefix: string = '', requestOptions: RequestOptions): string {\n if (validateURL(process.env.VERDACCIO_PUBLIC_URL as string)) {\n const envURL = new URL(wrapPrefix(url_prefix), process.env.VERDACCIO_PUBLIC_URL as string).href;\n debug('public url by env %o', envURL);\n return envURL;\n } else if (requestOptions.headers['host']) {\n const host = requestOptions.headers['host'];\n if (!isHost(host)) {\n throw new Error('invalid host');\n }\n\n const protoHeader: string =\n process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??\n HEADERS.FORWARDED_PROTO.toLowerCase();\n const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader]
|
|
1
|
+
{"version":3,"file":"index.js","names":["_debug","_interopRequireDefault","require","_url","_validator","_core","obj","__esModule","default","debug","buildDebug","validProtocols","isURLhasValidProtocol","uri","test","isHost","url","options","validator","isURL","require_host","allow_trailing_dot","require_valid_protocol","require_port","require_tld","getWebProtocol","headerProtocol","protocol","returnProtocol","defaultProtocol","commaIndex","indexOf","slice","includes","wrapPrefix","prefix","startsWith","endsWith","combineBaseUrl","host","newPrefix","groupedURI","URL","result","href","validateURL","publicUrl","parsed","replace","Error","err","getPublicUrl","url_prefix","requestOptions","process","env","VERDACCIO_PUBLIC_URL","envURL","headers","_process$env$VERDACCI","_process$env$VERDACCI2","protoHeader","VERDACCIO_FORWARDED_PROTO","toLocaleLowerCase","HEADERS","FORWARDED_PROTO","toLowerCase","forwardedProtocolHeaderValue","Array","isArray","combinedUrl","exports"],"sources":["../src/index.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\nimport { URL } from 'url';\nimport validator from 'validator';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:core:url');\n\nconst validProtocols = ['https', 'http'];\n\n/**\n * Check if URI is starting with \"http://\", \"https://\" or \"//\"\n * @param {string} uri\n */\nexport function isURLhasValidProtocol(uri: string): boolean {\n return /^(https?:)?\\/\\//.test(uri);\n}\n\nexport function isHost(url: string = '', options = {}): boolean {\n return validator.isURL(url, {\n require_host: true,\n allow_trailing_dot: false,\n require_valid_protocol: false,\n // @ts-ignore\n require_port: false,\n require_tld: false,\n ...options,\n });\n}\n\n/**\n * Detect running protocol (http or https)\n */\nexport function getWebProtocol(headerProtocol: string | undefined, protocol: string): string {\n let returnProtocol;\n const [, defaultProtocol] = validProtocols;\n // HAProxy variant might return http,http with X-Forwarded-Proto\n if (typeof headerProtocol === 'string' && headerProtocol !== '') {\n debug('header protocol: %o', protocol);\n const commaIndex = headerProtocol.indexOf(',');\n returnProtocol = commaIndex > 0 ? headerProtocol.slice(0, commaIndex) : headerProtocol;\n } else {\n debug('req protocol: %o', headerProtocol);\n returnProtocol = protocol;\n }\n\n return validProtocols.includes(returnProtocol) ? returnProtocol : defaultProtocol;\n}\n\nexport function wrapPrefix(prefix: string | void): string {\n if (prefix === '' || typeof prefix === 'undefined' || prefix === null) {\n return '';\n } else if (!prefix.startsWith('/') && prefix.endsWith('/')) {\n return `/${prefix}`;\n } else if (!prefix.startsWith('/') && !prefix.endsWith('/')) {\n return `/${prefix}/`;\n } else if (prefix.startsWith('/') && !prefix.endsWith('/')) {\n return `${prefix}/`;\n } else {\n return prefix;\n }\n}\n\n/**\n * Create base url for registry.\n * @return {String} base registry url\n */\nexport function combineBaseUrl(protocol: string, host: string, prefix: string = ''): string {\n debug('combined protocol %o', protocol);\n debug('combined host %o', host);\n const newPrefix = wrapPrefix(prefix);\n debug('combined prefix %o', newPrefix);\n const groupedURI = new URL(wrapPrefix(prefix), `${protocol}://${host}`);\n const result = groupedURI.href;\n debug('combined url %o', result);\n return result;\n}\n\nexport function validateURL(publicUrl: string | void) {\n try {\n const parsed = new URL(publicUrl as string);\n if (!validProtocols.includes(parsed.protocol.replace(':', ''))) {\n throw Error('invalid protocol');\n }\n return true;\n } catch (err: any) {\n // TODO: add error logger here\n return false;\n }\n}\n\nexport type RequestOptions = {\n /**\n * Request host.\n */\n host: string;\n /**\n * Request protocol.\n */\n protocol: string;\n /**\n * Request headers.\n */\n headers: IncomingHttpHeaders;\n remoteAddress?: string;\n /**\n * Logged username the request, usually after token verification.\n */\n username?: string;\n};\n\nexport function getPublicUrl(url_prefix: string = '', requestOptions: RequestOptions): string {\n if (validateURL(process.env.VERDACCIO_PUBLIC_URL as string)) {\n const envURL = new URL(wrapPrefix(url_prefix), process.env.VERDACCIO_PUBLIC_URL as string).href;\n debug('public url by env %o', envURL);\n return envURL;\n } else if (requestOptions.headers['host']) {\n const host = requestOptions.headers['host'];\n if (!isHost(host)) {\n throw new Error('invalid host');\n }\n\n // 'X-Forwarded-Proto' is the default header\n const protoHeader: string =\n process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??\n HEADERS.FORWARDED_PROTO.toLowerCase();\n const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];\n\n if (Array.isArray(forwardedProtocolHeaderValue)) {\n // This really should never happen - only set-cookie is allowed to have\n // multiple values.\n throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);\n }\n\n const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);\n const combinedUrl = combineBaseUrl(protocol, host, url_prefix);\n debug('public url by request %o', combinedUrl);\n return combinedUrl;\n } else {\n return '/';\n }\n}\n\nexport const isURL = validator.isURL;\n"],"mappings":";;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AAA0C,SAAAD,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAE1C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE9C,MAAMC,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;;AAExC;AACA;AACA;AACA;AACO,SAASC,qBAAqBA,CAACC,GAAW,EAAW;EAC1D,OAAO,iBAAiB,CAACC,IAAI,CAACD,GAAG,CAAC;AACpC;AAEO,SAASE,MAAMA,CAACC,GAAW,GAAG,EAAE,EAAEC,OAAO,GAAG,CAAC,CAAC,EAAW;EAC9D,OAAOC,kBAAS,CAACC,KAAK,CAACH,GAAG,EAAE;IAC1BI,YAAY,EAAE,IAAI;IAClBC,kBAAkB,EAAE,KAAK;IACzBC,sBAAsB,EAAE,KAAK;IAC7B;IACAC,YAAY,EAAE,KAAK;IACnBC,WAAW,EAAE,KAAK;IAClB,GAAGP;EACL,CAAC,CAAC;AACJ;;AAEA;AACA;AACA;AACO,SAASQ,cAAcA,CAACC,cAAkC,EAAEC,QAAgB,EAAU;EAC3F,IAAIC,cAAc;EAClB,MAAM,GAAGC,eAAe,CAAC,GAAGlB,cAAc;EAC1C;EACA,IAAI,OAAOe,cAAc,KAAK,QAAQ,IAAIA,cAAc,KAAK,EAAE,EAAE;IAC/DjB,KAAK,CAAC,qBAAqB,EAAEkB,QAAQ,CAAC;IACtC,MAAMG,UAAU,GAAGJ,cAAc,CAACK,OAAO,CAAC,GAAG,CAAC;IAC9CH,cAAc,GAAGE,UAAU,GAAG,CAAC,GAAGJ,cAAc,CAACM,KAAK,CAAC,CAAC,EAAEF,UAAU,CAAC,GAAGJ,cAAc;EACxF,CAAC,MAAM;IACLjB,KAAK,CAAC,kBAAkB,EAAEiB,cAAc,CAAC;IACzCE,cAAc,GAAGD,QAAQ;EAC3B;EAEA,OAAOhB,cAAc,CAACsB,QAAQ,CAACL,cAAc,CAAC,GAAGA,cAAc,GAAGC,eAAe;AACnF;AAEO,SAASK,UAAUA,CAACC,MAAqB,EAAU;EACxD,IAAIA,MAAM,KAAK,EAAE,IAAI,OAAOA,MAAM,KAAK,WAAW,IAAIA,MAAM,KAAK,IAAI,EAAE;IACrE,OAAO,EAAE;EACX,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAID,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,IAAGF,MAAO,EAAC;EACrB,CAAC,MAAM,IAAI,CAACA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC3D,OAAQ,IAAGF,MAAO,GAAE;EACtB,CAAC,MAAM,IAAIA,MAAM,CAACC,UAAU,CAAC,GAAG,CAAC,IAAI,CAACD,MAAM,CAACE,QAAQ,CAAC,GAAG,CAAC,EAAE;IAC1D,OAAQ,GAAEF,MAAO,GAAE;EACrB,CAAC,MAAM;IACL,OAAOA,MAAM;EACf;AACF;;AAEA;AACA;AACA;AACA;AACO,SAASG,cAAcA,CAACX,QAAgB,EAAEY,IAAY,EAAEJ,MAAc,GAAG,EAAE,EAAU;EAC1F1B,KAAK,CAAC,sBAAsB,EAAEkB,QAAQ,CAAC;EACvClB,KAAK,CAAC,kBAAkB,EAAE8B,IAAI,CAAC;EAC/B,MAAMC,SAAS,GAAGN,UAAU,CAACC,MAAM,CAAC;EACpC1B,KAAK,CAAC,oBAAoB,EAAE+B,SAAS,CAAC;EACtC,MAAMC,UAAU,GAAG,IAAIC,QAAG,CAACR,UAAU,CAACC,MAAM,CAAC,EAAG,GAAER,QAAS,MAAKY,IAAK,EAAC,CAAC;EACvE,MAAMI,MAAM,GAAGF,UAAU,CAACG,IAAI;EAC9BnC,KAAK,CAAC,iBAAiB,EAAEkC,MAAM,CAAC;EAChC,OAAOA,MAAM;AACf;AAEO,SAASE,WAAWA,CAACC,SAAwB,EAAE;EACpD,IAAI;IACF,MAAMC,MAAM,GAAG,IAAIL,QAAG,CAACI,SAAmB,CAAC;IAC3C,IAAI,CAACnC,cAAc,CAACsB,QAAQ,CAACc,MAAM,CAACpB,QAAQ,CAACqB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE;MAC9D,MAAMC,KAAK,CAAC,kBAAkB,CAAC;IACjC;IACA,OAAO,IAAI;EACb,CAAC,CAAC,OAAOC,GAAQ,EAAE;IACjB;IACA,OAAO,KAAK;EACd;AACF;AAsBO,SAASC,YAAYA,CAACC,UAAkB,GAAG,EAAE,EAAEC,cAA8B,EAAU;EAC5F,IAAIR,WAAW,CAACS,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,EAAE;IAC3D,MAAMC,MAAM,GAAG,IAAIf,QAAG,CAACR,UAAU,CAACkB,UAAU,CAAC,EAAEE,OAAO,CAACC,GAAG,CAACC,oBAA8B,CAAC,CAACZ,IAAI;IAC/FnC,KAAK,CAAC,sBAAsB,EAAEgD,MAAM,CAAC;IACrC,OAAOA,MAAM;EACf,CAAC,MAAM,IAAIJ,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC,EAAE;IAAA,IAAAC,qBAAA,EAAAC,sBAAA;IACzC,MAAMrB,IAAI,GAAGc,cAAc,CAACK,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC3C,MAAM,CAACwB,IAAI,CAAC,EAAE;MACjB,MAAM,IAAIU,KAAK,CAAC,cAAc,CAAC;IACjC;;IAEA;IACA,MAAMY,WAAmB,IAAAF,qBAAA,IAAAC,sBAAA,GACvBN,OAAO,CAACC,GAAG,CAACO,yBAAyB,cAAAF,sBAAA,uBAArCA,sBAAA,CAAuCG,iBAAiB,CAAC,CAAC,cAAAJ,qBAAA,cAAAA,qBAAA,GAC1DK,aAAO,CAACC,eAAe,CAACC,WAAW,CAAC,CAAC;IACvC,MAAMC,4BAA4B,GAAGd,cAAc,CAACK,OAAO,CAACG,WAAW,CAAC;IAExE,IAAIO,KAAK,CAACC,OAAO,CAACF,4BAA4B,CAAC,EAAE;MAC/C;MACA;MACA,MAAM,IAAIlB,KAAK,CAAC,0DAA0D,GAAGY,WAAW,CAAC;IAC3F;IAEA,MAAMlC,QAAQ,GAAGF,cAAc,CAAC0C,4BAA4B,EAAEd,cAAc,CAAC1B,QAAQ,CAAC;IACtF,MAAM2C,WAAW,GAAGhC,cAAc,CAACX,QAAQ,EAAEY,IAAI,EAAEa,UAAU,CAAC;IAC9D3C,KAAK,CAAC,0BAA0B,EAAE6D,WAAW,CAAC;IAC9C,OAAOA,WAAW;EACpB,CAAC,MAAM;IACL,OAAO,GAAG;EACZ;AACF;AAEO,MAAMnD,KAAK,GAAAoD,OAAA,CAAApD,KAAA,GAAGD,kBAAS,CAACC,KAAK"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/url",
|
|
3
|
-
"version": "12.0.0-next-7.
|
|
3
|
+
"version": "12.0.0-next-7.17",
|
|
4
4
|
"description": "url utilities resolver",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"private",
|
|
@@ -33,13 +33,13 @@
|
|
|
33
33
|
"access": "public"
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@verdaccio/core": "7.0.0-next-7.
|
|
36
|
+
"@verdaccio/core": "7.0.0-next-7.17",
|
|
37
37
|
"debug": "4.3.4",
|
|
38
38
|
"lodash": "4.17.21",
|
|
39
39
|
"validator": "13.11.0"
|
|
40
40
|
},
|
|
41
41
|
"devDependencies": {
|
|
42
|
-
"@verdaccio/types": "12.0.0-next-7.
|
|
42
|
+
"@verdaccio/types": "12.0.0-next-7.4",
|
|
43
43
|
"node-mocks-http": "1.14.1"
|
|
44
44
|
},
|
|
45
45
|
"funding": {
|
package/src/index.ts
CHANGED
|
@@ -121,10 +121,17 @@ export function getPublicUrl(url_prefix: string = '', requestOptions: RequestOpt
|
|
|
121
121
|
throw new Error('invalid host');
|
|
122
122
|
}
|
|
123
123
|
|
|
124
|
+
// 'X-Forwarded-Proto' is the default header
|
|
124
125
|
const protoHeader: string =
|
|
125
126
|
process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??
|
|
126
127
|
HEADERS.FORWARDED_PROTO.toLowerCase();
|
|
127
|
-
const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader]
|
|
128
|
+
const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];
|
|
129
|
+
|
|
130
|
+
if (Array.isArray(forwardedProtocolHeaderValue)) {
|
|
131
|
+
// This really should never happen - only set-cookie is allowed to have
|
|
132
|
+
// multiple values.
|
|
133
|
+
throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);
|
|
134
|
+
}
|
|
128
135
|
|
|
129
136
|
const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);
|
|
130
137
|
const combinedUrl = combineBaseUrl(protocol, host, url_prefix);
|
|
@@ -316,6 +316,31 @@ describe('env variable', () => {
|
|
|
316
316
|
delete process.env.VERDACCIO_FORWARDED_PROTO;
|
|
317
317
|
});
|
|
318
318
|
|
|
319
|
+
test('with the VERDACCIO_FORWARDED_PROTO environment variable set to "set-cookie"', () => {
|
|
320
|
+
process.env.VERDACCIO_FORWARDED_PROTO = 'set-cookie';
|
|
321
|
+
const req = httpMocks.createRequest({
|
|
322
|
+
method: 'GET',
|
|
323
|
+
headers: {
|
|
324
|
+
host: 'some.com',
|
|
325
|
+
cookie: 'name=value; name2=value2;',
|
|
326
|
+
'set-cookie': [
|
|
327
|
+
'cookieName1=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
|
|
328
|
+
'cookieName2=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
|
|
329
|
+
],
|
|
330
|
+
},
|
|
331
|
+
url: '/',
|
|
332
|
+
});
|
|
333
|
+
|
|
334
|
+
expect(() =>
|
|
335
|
+
getPublicUrl('/test/', {
|
|
336
|
+
host: req.hostname,
|
|
337
|
+
headers: req.headers as any,
|
|
338
|
+
protocol: req.protocol,
|
|
339
|
+
})
|
|
340
|
+
).toThrow('invalid forwarded protocol header value. Reading header set-cookie');
|
|
341
|
+
delete process.env.VERDACCIO_FORWARDED_PROTO;
|
|
342
|
+
});
|
|
343
|
+
|
|
319
344
|
test('with a invalid X-Forwarded-Proto https and host injection with invalid host', () => {
|
|
320
345
|
process.env.VERDACCIO_PUBLIC_URL = 'http://injection.test.com"><svg onload="alert(1)">';
|
|
321
346
|
const req = httpMocks.createRequest({
|