Skip to content

feat: add epic web stack #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 16 commits into from
Feb 27, 2025
Merged

feat: add epic web stack #3

merged 16 commits into from
Feb 27, 2025

Conversation

ScriptedAlchemy
Copy link
Collaborator

No description provided.

@ScriptedAlchemy
chore: add examples
a1d0591
@ScriptedAlchemy
feat: enhance documentation and configuration for React Router plugin
f8da5cb 
- Completely rewrote README.md with comprehensive documentation
- Updated example project configuration and routes
- Improved dev server and plugin configuration handling
- Added more detailed styling and interactive elements to documentation pages
- Refined plugin options and configuration management
- Enhanced server-side rendering and custom server support
@ScriptedAlchemy
chore: update ignores
67dd4df
@ScriptedAlchemy
fix: route feature detection
432afd3
@ScriptedAlchemy
fix: route feature detection
c89a7d7
@ScriptedAlchemy
chore: upgrade tailwind
403ec8d
@ScriptedAlchemy
chore: update readme
3f04ae3
@ScriptedAlchemy
feat(example): add epic stack
fa23fb4
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 12, 2025
View reviewed changes
examples/epic-stack/tests/mocks/index.ts
// Note: a request handler with passthrough is not suited with this type of url
// until there is a more permissible url catching system
// like requested at https://github.com/mswjs/msw/issues/1804
if (request.url.includes('.sentry.io')) {

Check failure

Code scanning / CodeQL

Incomplete URL substring sanitization High test

'
.sentry.io
Loading
' can be anywhere in the URL, and arbitrary hosts may come before or after it.

Copilot Autofix

AI 8 months ago

To fix the problem, we need to parse the URL and check the host value explicitly instead of using a substring check. This ensures that the check handles arbitrary subdomain sequences correctly and prevents bypassing the check by embedding the allowed host in unexpected parts of the URL.

The best way to fix the problem without changing existing functionality is to use the URL class to parse the URL and then check if the host matches the allowed host. We will replace the substring check with a more robust check that verifies the host value.

Suggested changeset 1
examples/epic-stack/tests/mocks/index.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/examples/epic-stack/tests/mocks/index.ts b/examples/epic-stack/tests/mocks/index.ts
--- a/examples/epic-stack/tests/mocks/index.ts
+++ b/examples/epic-stack/tests/mocks/index.ts
@@ -13,3 +13,4 @@
 		//       like requested at https://github.com/mswjs/msw/issues/1804
-		if (request.url.includes('.sentry.io')) {
+		const url = new URL(request.url);
+		if (url.host.endsWith('.sentry.io')) {
 			return
EOF
@@ -13,3 +13,4 @@
// like requested at https://github.com/mswjs/msw/issues/1804
if (request.url.includes('.sentry.io')) {
const url = new URL(request.url);
if (url.host.endsWith('.sentry.io')) {
return
Copilot is powered by AI and may make mistakes. Always verify output.
@ScriptedAlchemy
feat(example): add epic stack
4d633a5
@ScriptedAlchemy
fix(plugin): improve package.json asset handling in webpack compilation
27d53dd
@ScriptedAlchemy
chore: add .nvmrc with Node.js 22 version
7b63a96
@ScriptedAlchemy
feat(example): add epic stack
602f3bb
@ScriptedAlchemy
feat(example): add epic stack
4f91a62
@ScriptedAlchemy
Merge branch 'main' into epic-web
2b3d670 
# Conflicts:
#	README.md
#	examples/custom-node-server/package.json
#	examples/custom-node-server/server.js
#	package.json
#	pnpm-lock.yaml
#	pnpm-workspace.yaml
#	src/index.ts
#	tests/features.test.ts
#	tests/index.test.ts
@ScriptedAlchemy
feat(example): add epic stack
5489b6a
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 14, 2025
View reviewed changes
examples/epic-stack/server/index.ts
if (req.path.endsWith('/') && req.path.length > 1) {
const query = req.url.slice(req.path.length)
const safepath = req.path.slice(0, -1).replace(/\/+/g, '/')
res.redirect(302, safepath + query)

Check warning

Code scanning / CodeQL

Server-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Copilot Autofix

AI 8 months ago

To fix the problem, we need to ensure that the redirection URL is validated before performing the redirection. One way to do this is to check that the redirection URL does not redirect to a different host by parsing it relative to a base URL with a known host and verifying that the host stays the same.

We will implement a function isLocalUrl to check if the URL is local and use this function to validate the safepath + query before performing the redirection.

Suggested changeset 1
examples/epic-stack/server/index.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/examples/epic-stack/server/index.ts b/examples/epic-stack/server/index.ts
--- a/examples/epic-stack/server/index.ts
+++ b/examples/epic-stack/server/index.ts
@@ -8,2 +8,3 @@
 import express, { type RequestHandler } from 'express'
+import { URL } from 'url'
 import rateLimit from 'express-rate-limit'
@@ -65,2 +66,12 @@
 
+	function isLocalUrl(path) {
+		try {
+			return (
+				new URL(path, "https://example.com").origin === "https://example.com"
+			);
+		} catch (e) {
+			return false;
+		}
+	}
+
 	// no ending slashes for SEO reasons
@@ -71,3 +82,8 @@
 			const safepath = req.path.slice(0, -1).replace(/\/+/g, '/')
-			res.redirect(302, safepath + query)
+			const target = safepath + query
+			if (isLocalUrl(target)) {
+				res.redirect(302, target)
+			} else {
+				res.redirect(302, '/')
+			}
 		} else {
EOF
@@ -8,2 +8,3 @@
import express, { type RequestHandler } from 'express'
import { URL } from 'url'
import rateLimit from 'express-rate-limit'
@@ -65,2 +66,12 @@

function isLocalUrl(path) {
try {
return (
new URL(path, "https://example.com").origin === "https://example.com"
);
} catch (e) {
return false;
}
}

// no ending slashes for SEO reasons
@@ -71,3 +82,8 @@
const safepath = req.path.slice(0, -1).replace(/\/+/g, '/')
res.redirect(302, safepath + query)
const target = safepath + query
if (isLocalUrl(target)) {
res.redirect(302, target)
} else {
res.redirect(302, '/')
}
} else {
Copilot is powered by AI and may make mistakes. Always verify output.
@ScriptedAlchemy ScriptedAlchemy merged commit d08d707 into main Feb 27, 2025
1 of 2 checks passed
@ScriptedAlchemy ScriptedAlchemy deleted the epic-web branch February 27, 2025 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ScriptedAlchemy