screwdriver-api 8.0.182 → 8.0.183

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "screwdriver-api",
3
- "version": "8.0.182",
3
+ "version": "8.0.183",
4
4
  "description": "API server for the Screwdriver.cd service",
5
5
  "main": "index.js",
6
6
  "scripts": {
@@ -83,10 +83,18 @@ module.exports = config => ({
83
83
  const directoryArray = manifestArray.filter(f => f.startsWith(`./${artifact}/`));
84
84
  let totalSize = 0;
85
85
 
86
+ // Manifest entries are build controlled, so encode them the same way
87
+ // single file requests are encoded. Appending them verbatim lets
88
+ // `..` segments be resolved away when the URL is normalized, which
89
+ // would point the request at another build's artifacts.
90
+ const fileUrl = file =>
91
+ `${baseUrl}/${encodeURIComponent(file.replace(/^\.\//, ''))}`
92
+ + `?token=${token}&type=download`;
93
+
86
94
  // Check file sizes by fetching metadata
87
95
  for (const file of directoryArray) {
88
96
  if (file) {
89
- const fileMetaResponse = await request.head(`${baseUrl}/${file}?token=${token}&type=download`);
97
+ const fileMetaResponse = await request.head(fileUrl(file));
90
98
  const fileSize = parseInt(fileMetaResponse.headers['content-length'], 10);
91
99
 
92
100
  // Accumulate total size
@@ -120,7 +128,7 @@ module.exports = config => ({
120
128
  // Fetch and append the directory files
121
129
  for (const file of directoryArray) {
122
130
  if (file) {
123
- const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
131
+ const fileStream = request.stream(fileUrl(file));
124
132
 
125
133
  // Handle errors from file streaming
126
134
  fileStream.on('error', (err) => {
@@ -92,7 +92,12 @@ module.exports = config => ({
92
92
  try {
93
93
  for (const file of manifestArray) {
94
94
  if (file) {
95
- const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
95
+ // Manifest entries are build controlled, so encode them before
96
+ // appending. Verbatim entries let `..` segments be resolved away
97
+ // when the URL is normalized, which would point the request at
98
+ // another build's artifacts.
99
+ const encodedFile = encodeURIComponent(file.replace(/^\.\//, ''));
100
+ const fileStream = request.stream(`${baseUrl}/${encodedFile}?token=${token}&type=download`);
96
101
 
97
102
  fileStream.on('error', (err) => {
98
103
  logger.error(`Error downloading file: ${file}`, err);