Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit dc9de69

Browse filesBrowse files
dmitry-shibanovdmitry-shibanov
authored
Update node-fetch from 2.6.6 to 2.6.7 (actions#327)
1 parent ba33a69 commit dc9de69
Copy full SHA for dc9de69

File tree

Expand file treeCollapse file tree

5 files changed

+64
-8
lines changed
Filter options
Expand file treeCollapse file tree

5 files changed

+64
-8
lines changed

‎.github/workflows/licensed.yml

Copy file name to clipboardExpand all lines: .github/workflows/licensed.yml
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ jobs:
1414
name: Check licenses
1515
steps:
1616
- uses: actions/checkout@v2
17+
- name: Set Node.js 12.x
18+
uses: actions/setup-node@v2
19+
with:
20+
node-version: 12.x
1721
- run: npm ci
1822
- name: Install licensed
1923
run: |

‎.licenses/npm/node-fetch.dep.yml

Copy file name to clipboardExpand all lines: .licenses/npm/node-fetch.dep.yml
+1-1Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/cache-save/index.js

Copy file name to clipboardExpand all lines: dist/cache-save/index.js
+28-2Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34585,9 +34585,17 @@ AbortError.prototype = Object.create(Error.prototype);
3458534585
AbortError.prototype.constructor = AbortError;
3458634586
AbortError.prototype.name = 'AbortError';
3458734587

34588+
const URL$1 = Url.URL || whatwgUrl.URL;
34589+
3458834590
// fix an issue where "PassThrough", "resolve" aren't a named export for node <10
3458934591
const PassThrough$1 = Stream.PassThrough;
34590-
const resolve_url = Url.resolve;
34592+
34593+
const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
34594+
const orig = new URL$1(original).hostname;
34595+
const dest = new URL$1(destination).hostname;
34596+
34597+
return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
34598+
};
3459134599

3459234600
/**
3459334601
* Fetch function
@@ -34675,7 +34683,19 @@ function fetch(url, opts) {
3467534683
const location = headers.get('Location');
3467634684

3467734685
// HTTP fetch step 5.3
34678-
const locationURL = location === null ? null : resolve_url(request.url, location);
34686+
let locationURL = null;
34687+
try {
34688+
locationURL = location === null ? null : new URL$1(location, request.url).toString();
34689+
} catch (err) {
34690+
// error here can only be invalid URL in Location: header
34691+
// do not throw when options.redirect == manual
34692+
// let the user extract the errorneous redirect URL
34693+
if (request.redirect !== 'manual') {
34694+
reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
34695+
finalize();
34696+
return;
34697+
}
34698+
}
3467934699

3468034700
// HTTP fetch step 5.5
3468134701
switch (request.redirect) {
@@ -34723,6 +34743,12 @@ function fetch(url, opts) {
3472334743
size: request.size
3472434744
};
3472534745

34746+
if (!isDomainOrSubdomain(request.url, locationURL)) {
34747+
for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
34748+
requestOpts.headers.delete(name);
34749+
}
34750+
}
34751+
3472634752
// HTTP-redirect fetch step 9
3472734753
if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
3472834754
reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));

‎dist/setup/index.js

Copy file name to clipboardExpand all lines: dist/setup/index.js
+28-2Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37137,9 +37137,17 @@ AbortError.prototype = Object.create(Error.prototype);
3713737137
AbortError.prototype.constructor = AbortError;
3713837138
AbortError.prototype.name = 'AbortError';
3713937139

37140+
const URL$1 = Url.URL || whatwgUrl.URL;
37141+
3714037142
// fix an issue where "PassThrough", "resolve" aren't a named export for node <10
3714137143
const PassThrough$1 = Stream.PassThrough;
37142-
const resolve_url = Url.resolve;
37144+
37145+
const isDomainOrSubdomain = function isDomainOrSubdomain(destination, original) {
37146+
const orig = new URL$1(original).hostname;
37147+
const dest = new URL$1(destination).hostname;
37148+
37149+
return orig === dest || orig[orig.length - dest.length - 1] === '.' && orig.endsWith(dest);
37150+
};
3714337151

3714437152
/**
3714537153
* Fetch function
@@ -37227,7 +37235,19 @@ function fetch(url, opts) {
3722737235
const location = headers.get('Location');
3722837236

3722937237
// HTTP fetch step 5.3
37230-
const locationURL = location === null ? null : resolve_url(request.url, location);
37238+
let locationURL = null;
37239+
try {
37240+
locationURL = location === null ? null : new URL$1(location, request.url).toString();
37241+
} catch (err) {
37242+
// error here can only be invalid URL in Location: header
37243+
// do not throw when options.redirect == manual
37244+
// let the user extract the errorneous redirect URL
37245+
if (request.redirect !== 'manual') {
37246+
reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect'));
37247+
finalize();
37248+
return;
37249+
}
37250+
}
3723137251

3723237252
// HTTP fetch step 5.5
3723337253
switch (request.redirect) {
@@ -37275,6 +37295,12 @@ function fetch(url, opts) {
3727537295
size: request.size
3727637296
};
3727737297

37298+
if (!isDomainOrSubdomain(request.url, locationURL)) {
37299+
for (const name of ['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
37300+
requestOpts.headers.delete(name);
37301+
}
37302+
}
37303+
3727837304
// HTTP-redirect fetch step 9
3727937305
if (res.statusCode !== 303 && request.body && getTotalBytes(request) === null) {
3728037306
reject(new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect'));

‎package-lock.json

Copy file name to clipboardExpand all lines: package-lock.json
+3-3Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.