Skip to content

Commit 870c8d7

Browse files
author
Joel Denning
authored
Fix url validation in patch import-map, switch to strict-ssl fetch (#177)
1 parent 14935c8 commit 870c8d7

File tree

5 files changed

+32
-320
lines changed

5 files changed

+32
-320
lines changed

package.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@
4242
"lodash": "^4.17.21",
4343
"minimist": "^1.2.8",
4444
"morgan": "^1.10.0",
45-
"request": "^2.88.2",
4645
"rwlock": "^5.0.0"
4746
},
4847
"devDependencies": {

src/modify.js

Lines changed: 17 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -104,27 +104,23 @@ exports.modifyImportMap = function (env, newValues) {
104104
: integrity;
105105

106106
// either imports or scopes have to be defined
107-
if (newImports || newScopes || newIntegrity) {
108-
return modifyLock(env, (json) => {
109-
if (newImports) {
110-
const imports = getMapFromManifest(json);
111-
Object.assign(imports, newImports);
112-
}
113-
if (newScopes) {
114-
json.scopes = json.scopes ?? {};
115-
const scopes = getScopesFromManifest(json);
116-
Object.assign(scopes, newScopes);
117-
}
118-
if (newIntegrity) {
119-
json.integrity = json.integrity ?? {};
120-
const integrity = getIntegrityFromManifest(json);
121-
Object.assign(integrity, newIntegrity);
122-
}
123-
return json;
124-
});
125-
} else {
126-
return Promise.resolve();
127-
}
107+
return modifyLock(env, (json) => {
108+
if (newImports) {
109+
const imports = getMapFromManifest(json);
110+
Object.assign(imports, newImports);
111+
}
112+
if (newScopes) {
113+
json.scopes = json.scopes ?? {};
114+
const scopes = getScopesFromManifest(json);
115+
Object.assign(scopes, newScopes);
116+
}
117+
if (newIntegrity) {
118+
json.integrity = json.integrity ?? {};
119+
const integrity = getIntegrityFromManifest(json);
120+
Object.assign(integrity, newIntegrity);
121+
}
122+
return json;
123+
});
128124
};
129125

130126
exports.modifyService = function (

src/verify-valid-url.js

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,3 @@
1-
const util = require("util");
2-
const request = require("request");
3-
const requestAsPromise = util.promisify(request);
4-
51
async function verifyValidUrl(req, url) {
62
if (req.query.skip_url_check === "true" || req.query.skip_url_check === "") {
73
// ?skip_url_check
@@ -10,15 +6,10 @@ async function verifyValidUrl(req, url) {
106
} else {
117
// ?skip_url_check=false
128
// ?<no param>
13-
try {
14-
const resp = await requestAsPromise({ url, strictSSL: false });
15-
if (resp.statusCode < 200 || resp.statusCode >= 400) {
16-
throw Error(resp.statusCode);
17-
}
18-
return true;
19-
} catch (err) {
9+
const r = await fetch(url);
10+
if (!r.ok) {
2011
throw Error(
21-
`The following url in the request body is not reachable: ${url}`
12+
`The following url in the request body is not reachable: ${url} ${r.status} ${r.statusText}`
2213
);
2314
}
2415
}

src/web-server.js

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ app.patch("/import-map.json", (req, res) => {
162162
}
163163

164164
// Import map validation
165-
let validImportUrlPromises = Promise.resolve();
165+
let validImportUrlPromises = [];
166166
if (req.body.imports) {
167167
const importUrlsToValidate = findUrlsToValidateInServices(req.body.imports);
168168
const unsafeUrls = importUrlsToValidate.map(checkUrlUnsafe).filter(Boolean);
@@ -181,7 +181,7 @@ app.patch("/import-map.json", (req, res) => {
181181
}
182182

183183
// Scope validation
184-
let validScopeUrlPromises = Promise.resolve();
184+
let validScopeUrlPromises = [];
185185
if (req.body.scopes) {
186186
const scopeUrlsToValidate = findUrlsToValidateInScopes(req.body.scopes);
187187
const unsafeUrls = scopeUrlsToValidate.map(checkUrlUnsafe).filter(Boolean);
@@ -199,7 +199,7 @@ app.patch("/import-map.json", (req, res) => {
199199
}
200200
}
201201

202-
let validIntegrityUrlPromises = Promise.resolve();
202+
let validIntegrityUrlPromises = [];
203203
if (req.body.integrity) {
204204
const integrityUrlsToValidate = findUrlsToValidateInIntegrity(
205205
req.body.integrity
@@ -222,9 +222,9 @@ app.patch("/import-map.json", (req, res) => {
222222
}
223223

224224
return Promise.all([
225-
validImportUrlPromises,
226-
validScopeUrlPromises,
227-
validIntegrityUrlPromises,
225+
...validImportUrlPromises,
226+
...validScopeUrlPromises,
227+
...validIntegrityUrlPromises,
228228
])
229229
.then(() => {
230230
modify
@@ -234,7 +234,6 @@ app.patch("/import-map.json", (req, res) => {
234234
integrity: req.body.integrity,
235235
})
236236
.then((newImportMap) => {
237-
console.log(`Patched import map. New import map`, newImportMap);
238237
res.status(200).send(newImportMap);
239238
})
240239
.catch((err) => {

0 commit comments

Comments
 (0)