Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Normalize workers assets path #7318

Merged
merged 2 commits into from
Nov 22, 2024
Merged

Conversation

WillTaylorDev
Copy link
Contributor

Prevents same-schema redirect attacks by collapsing multiple slashes in the path.

  • Tests
    • TODO (before merge)
    • Tests included
    • Tests not necessary because:
  • E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
    • I don't know
    • Required
    • Not required because: n/a
  • Public documentation
    • TODO (before merge)
    • Cloudflare docs PR(s):
    • Documentation not necessary because: n/a

@WillTaylorDev WillTaylorDev requested review from a team as code owners November 21, 2024 19:16
Copy link

changeset-bot bot commented Nov 21, 2024

🦋 Changeset detected

Latest commit: 8bc25be

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@cloudflare/workers-shared Minor
wrangler Patch
@cloudflare/vitest-pool-workers Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch from bf42f5e to 0e06721 Compare November 21, 2024 19:17
Copy link
Contributor

github-actions bot commented Nov 21, 2024

A wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-wrangler-7318

You can reference the automatically updated head of this PR with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/7318/npm-package-wrangler-7318

Or you can use npx with this latest build directly:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-wrangler-7318 dev path/to/script.js
Additional artifacts:
npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-create-cloudflare-7318 --no-auto-update
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-kv-asset-handler-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-miniflare-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-pages-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-vitest-pool-workers-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workers-editor-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workers-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workflows-shared-7318

Note that these links will no longer work once the GitHub Actions artifact expires.


[email protected] includes the following runtime dependencies:

Package Constraint Resolved
miniflare workspace:* 3.20241106.1
workerd 1.20241106.1 1.20241106.1
workerd --version 1.20241106.1 2024-11-06

Please ensure constraints are pinned, and miniflare/workerd minor versions match.

@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch 3 times, most recently from f252909 to 1fabad5 Compare November 22, 2024 14:14
@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch 2 times, most recently from 3f2348a to eedc302 Compare November 22, 2024 14:38
@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch from eedc302 to 8bc25be Compare November 22, 2024 14:43
@edmundhung edmundhung added the skip-pr-description-validation Skip validation of the required PR description format label Nov 22, 2024
@edmundhung edmundhung merged commit 6ba5903 into main Nov 22, 2024
36 checks passed
@edmundhung edmundhung deleted the walshy/normalize-workers-assets-path branch November 22, 2024 15:29
};
const BASE_URL = "http://example.com";

describe("[Asset Worker] `test redirects`", () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

redirects? or rewrites?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I'll update in my next PR shortly!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
skip-pr-description-validation Skip validation of the required PR description format
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

6 participants