From 90c49f2166b6472fb825ee29fea362d52da4f9ef Mon Sep 17 00:00:00 2001
From: Vipul <vsvipul@github.com>
Date: Mon, 24 Jan 2022 13:16:28 +0000
Subject: [PATCH] Update dist/ changes
---
dist/restore/index.js | 30 ++++++++++++++++++++++++++++--
dist/save/index.js | 30 ++++++++++++++++++++++++++++--
2 files changed, 56 insertions(+), 4 deletions(-)
diff --git a/dist/restore/index.js b/dist/restore/index.js
index 671451c..89c022a 100644
--- a/dist/restore/index.js
+++ b/dist/restore/index.js
@@ -37903,9 +37903,17 @@ AbortError.prototype = Object.create(Error.prototype);
AbortError.prototype.constructor = AbortError;
AbortError.prototype.name = 'AbortError';
+const URL$1 = Url.URL || whatwgUrl.URL;
+
// fix an issue where "PassThrough", "resolve" aren't a named export for node <10
const PassThrough$1 = Stream.PassThrough;
-const resolve_url = Url.resolve;
+
+const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
+ const orig = new URL$1(original).hostname;
+ const dest = new URL$1(destination).hostname;
+
+ return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
+};
/**
* Fetch function
@@ -37993,7 +38001,19 @@ function fetch(url, opts) {
const location = headers.get('Location');
// HTTP fetch step 5.3
- const locationURL = location === null ? null : resolve_url(request.url, location);
+ let locationURL = null;
+ try {
+ locationURL = location === null ? null : new URL$1(location, request.url).toString();
+ } catch (err) {
+ // error here can only be invalid URL in Location: header
+ // do not throw when options.redirect == manual
+ // let the user extract the errorneous redirect URL
+ if (request.redirect !== 'manual') {
+ reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
+ finalize();
+ return;
+ }
+ }
// HTTP fetch step 5.5
switch (request.redirect) {
@@ -38041,6 +38061,12 @@ function fetch(url, opts) {
size: request.size
};
+ if (!isDomainOrSubdomain(request.url, locationURL)) {
+ for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
+ requestOpts.headers.delete(name);
+ }
+ }
+
// HTTP-redirect fetch step 9
if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));
diff --git a/dist/save/index.js b/dist/save/index.js
index b0d491d..98c844d 100644
--- a/dist/save/index.js
+++ b/dist/save/index.js
@@ -37903,9 +37903,17 @@ AbortError.prototype = Object.create(Error.prototype);
AbortError.prototype.constructor = AbortError;
AbortError.prototype.name = 'AbortError';
+const URL$1 = Url.URL || whatwgUrl.URL;
+
// fix an issue where "PassThrough", "resolve" aren't a named export for node <10
const PassThrough$1 = Stream.PassThrough;
-const resolve_url = Url.resolve;
+
+const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
+ const orig = new URL$1(original).hostname;
+ const dest = new URL$1(destination).hostname;
+
+ return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
+};
/**
* Fetch function
@@ -37993,7 +38001,19 @@ function fetch(url, opts) {
const location = headers.get('Location');
// HTTP fetch step 5.3
- const locationURL = location === null ? null : resolve_url(request.url, location);
+ let locationURL = null;
+ try {
+ locationURL = location === null ? null : new URL$1(location, request.url).toString();
+ } catch (err) {
+ // error here can only be invalid URL in Location: header
+ // do not throw when options.redirect == manual
+ // let the user extract the errorneous redirect URL
+ if (request.redirect !== 'manual') {
+ reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
+ finalize();
+ return;
+ }
+ }
// HTTP fetch step 5.5
switch (request.redirect) {
@@ -38041,6 +38061,12 @@ function fetch(url, opts) {
size: request.size
};
+ if (!isDomainOrSubdomain(request.url, locationURL)) {
+ for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
+ requestOpts.headers.delete(name);
+ }
+ }
+
// HTTP-redirect fetch step 9
if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));