github.com/verdaccio
1
0
Fork 0
mirror of https://github.com/verdaccio/verdaccio.git synced 2025-02-21 07:29:37 +01:00
Code Releases Wiki Activity

patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array (#4613)

Browse Source 
* patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array

* changeset
This commit is contained in:
Tobbe Lundberg 2024-06-02 10:11:25 +02:00 committed by GitHub
parent 2bc45c8e2f
commit 38b1e829d6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 38 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/stupid-dancers-relate.md Normal file
View File

@ -0,0 +1,5 @@
---
'@verdaccio/url': patch
---
patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array (#4613 by @Tobbe)

9
packages/core/url/src/index.ts
View File

@ -121,10 +121,17 @@ export function getPublicUrl(url_prefix: string = '', requestOptions: RequestOpt
throw new Error('invalid host');
}
// 'X-Forwarded-Proto' is the default header
const protoHeader: string =
process.env.VERDACCIO_FORWARDED_PROTO?.toLocaleLowerCase() ??
HEADERS.FORWARDED_PROTO.toLowerCase();
const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader] as string | undefined;
const forwardedProtocolHeaderValue = requestOptions.headers[protoHeader];
if (Array.isArray(forwardedProtocolHeaderValue)) {
// This really should never happen - only set-cookie is allowed to have
// multiple values.
throw new Error('invalid forwarded protocol header value. Reading header ' + protoHeader);
}
const protocol = getWebProtocol(forwardedProtocolHeaderValue, requestOptions.protocol);
const combinedUrl = combineBaseUrl(protocol, host, url_prefix);

25
packages/core/url/tests/getPublicUrl.spec.ts
View File

@ -316,6 +316,31 @@ describe('env variable', () => {
delete process.env.VERDACCIO_FORWARDED_PROTO;
});
test('with the VERDACCIO_FORWARDED_PROTO environment variable set to "set-cookie"', () => {
process.env.VERDACCIO_FORWARDED_PROTO = 'set-cookie';
const req = httpMocks.createRequest({
method: 'GET',
headers: {
host: 'some.com',
cookie: 'name=value; name2=value2;',
'set-cookie': [
'cookieName1=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
'cookieName2=value; expires=Tue, 19 Jan 2038 03:14:07 GMT;',
],
},
url: '/',
});
expect(() =>
getPublicUrl('/test/', {
host: req.hostname,
headers: req.headers as any,
protocol: req.protocol,
})
).toThrow('invalid forwarded protocol header value. Reading header set-cookie');
delete process.env.VERDACCIO_FORWARDED_PROTO;
});
test('with a invalid X-Forwarded-Proto https and host injection with invalid host', () => {
process.env.VERDACCIO_PUBLIC_URL = 'http://injection.test.com"><svg onload="alert(1)">';
const req = httpMocks.createRequest({