-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array #4613
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
juanpicado
approved these changes
Jun 2, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
charithe
pushed a commit
to cerbos/cerbos
that referenced
this pull request
Jun 10, 2024
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://togithub.com/pnpm/pnpm)) | [`9.1.4` -> `9.2.0`](https://renovatebot.com/diffs/npm/pnpm/9.1.4/9.2.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/9.2.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/pnpm/9.2.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/pnpm/9.1.4/9.2.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/9.1.4/9.2.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | | [verdaccio](https://verdaccio.org) ([source](https://togithub.com/verdaccio/verdaccio)) | [`5.31.0` -> `5.31.1`](https://renovatebot.com/diffs/npm/verdaccio/5.31.0/5.31.1) | [![age](https://developer.mend.io/api/mc/badges/age/npm/verdaccio/5.31.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/verdaccio/5.31.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/verdaccio/5.31.0/5.31.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/verdaccio/5.31.0/5.31.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v9.2.0`](https://togithub.com/pnpm/pnpm/releases/tag/v9.2.0) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v9.1.4...v9.2.0) #### Minor Changes - If `package-manager-strict-version` is set to `true`, pnpm will fail if its version doesn't exactly match the version in the "packageManager" field of `package.json`. #### Patch Changes - Update `@yarnpkg/pnp` to the latest version, fixing issue with `node:` imports [#​8161](https://togithub.com/pnpm/pnpm/issues/8161). - Deduplicate bin names to prevent race condition and corrupted bin scripts [#​7833](https://togithub.com/pnpm/pnpm/issues/7833). - pnpm doesn't fail if its version doesn't match the one specified in the "packageManager" field of `package.json` [#​8087](https://togithub.com/pnpm/pnpm/issues/8087). - `exec` now also streams prefixed output when `--recursive` or `--parallel` is specified just as `run` does [#​8065](https://togithub.com/pnpm/pnpm/issues/8065). #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/bit.svg" width="80"></a> </td> <td align="center" valign="middle"> <a href="https://figma.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"><img src="https://pnpm.io/img/users/figma.svg" width="80"></a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://prisma.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/prisma.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/prisma_light.svg" /> <img src="https://pnpm.io/img/users/prisma.svg" width="180" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://uscreen.de/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/uscreen.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/uscreen_light.svg" /> <img src="https://pnpm.io/img/users/uscreen.svg" width="180" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://www.jetbrains.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/jetbrains.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/jetbrains.svg" /> <img src="https://pnpm.io/img/users/jetbrains.svg" width="85" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="120" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" /> </picture> </a> </td> </tr> </tbody> </table> #### Our Silver Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://leniolabs.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/leniolabs.jpg" width="80"> </a> </td> <td align="center" valign="middle"> <a href="https://vercel.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/vercel.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/vercel_light.svg" /> <img src="https://pnpm.io/img/users/vercel.svg" width="180" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://depot.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/depot.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/depot_light.svg" /> <img src="https://pnpm.io/img/users/depot.svg" width="200" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://moonrepo.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/moonrepo.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/moonrepo_light.svg" /> <img src="https://pnpm.io/img/users/moonrepo.svg" width="200" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://devowl.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/devowlio.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/devowlio.svg" /> <img src="https://pnpm.io/img/users/devowlio.svg" width="200" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://macpaw.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/macpaw.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/macpaw_light.svg" /> <img src="https://pnpm.io/img/users/macpaw.svg" width="200" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://cerbos.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/cerbos.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/cerbos_light.svg" /> <img src="https://pnpm.io/img/users/cerbos.svg" width="180" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vpsserver.com/en-us/?utm_source=pnpm&utm_medium=release_notes" target="_blank"> <img src="https://pnpm.io/img/users/vpsserver.svg" width="180" /> </a> </td> </tr> </tbody> </table> </details> <details> <summary>verdaccio/verdaccio (verdaccio)</summary> ### [`v5.31.1`](https://togithub.com/verdaccio/verdaccio/releases/tag/v5.31.1) [Compare Source](https://togithub.com/verdaccio/verdaccio/compare/v5.31.0...v5.31.1) ##### [5.31.1](https://togithub.com/verdaccio/verdaccio/compare/v5.31.0...v5.31.1) (2024-06-06) ##### Bug Fixes - **deps:** update core verdaccio dependencies ([#​4668](https://togithub.com/verdaccio/verdaccio/issues/4668)) ([9e3a79d](https://togithub.com/verdaccio/verdaccio/commit/9e3a79d50345602bf8584b08005518f27f7e2afb)) - **patch(core/url): Throw if VERDACCIO_FORWARDED_PROTO resolves to an array** [verdaccio/verdaccio#4613. by [@​Tobbe](https://togithub.com/Tobbe) - **fix: log spacing depending on the FORMAT and COLORS options** [#​4631](https://togithub.com/verdaccio/verdaccio/issues/4631) by [@​somethingSTRANGE](https://togithub.com/somethingSTRANGE) - **deps:** update node.js to v20.14.0 ([#​4663](https://togithub.com/verdaccio/verdaccio/issues/4663)) ([6591927](https://togithub.com/verdaccio/verdaccio/commit/65919277274c9d5360ad39177f88ceb653164653)) - set engine to 14.21.3 ([6cf6064](https://togithub.com/verdaccio/verdaccio/commit/6cf6064d06a9375016294bd017834d19c474e738)) - set engine to Node.js 14 ([9a6d5b3](https://togithub.com/verdaccio/verdaccio/commit/9a6d5b3d442fd8819baf2f31487d0999c4289a0a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/cerbos/cerbos). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zOTMuMCIsInVwZGF0ZWRJblZlciI6IjM3LjM5My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcmVhL2RlcGVuZGVuY2llcyIsImJvdHMiLCJraW5kL2Nob3JlIl19--> Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
requestOptions.headers
are of typeIncomingHttpHeaders
. This is a dictionary whose values can bestring | string[] | undefined
. Looking at all the keys we can see that only"set-cookie?"
allows a value of typestring[]
.requestOptions.headers
is used like this:requestOptions.headers[protoHeader]
. So only ifprotoHeader
has the value"set-cookie"
can the returned value ever be an array. For all other values it's either going to beundefined
or a string. So only for"set-cookie
" will this code ever potentially throw this new error that is added in this PR.So. If for some very very weird reason 🙃 some user of Verdaccio has configured
VERDACCIO_FORWARDED_PROTO
to have the value "set-cookie" this is before and after this PR:Before:
forwardedProtocolHeaderValue
is an array of strings. This is passed togetWebProtocol
. That function will in this case returnrequestOptions.protocol
, which is the same behavior as ifforwardedProtocolHeaderValue
was undefined or an empty string. (So another option would be to just allow string arrays to be passed togetWebProtocol
. Would you prefer that?)After:
A (hopefully) helpful error is thrown, letting the user know they have most likely misconfigured their setup