Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat!: Limit ARCJET_BASE_URL to small set of allowed URLs #83

Merged
merged 3 commits into from
Dec 22, 2023
Merged

feat!: Limit ARCJET_BASE_URL to small set of allowed URLs #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
aec9bb7
feat!: Limit ARCJET_BASE_URL to small set of allowed URLs
blaine-arcjet Dec 21, 2023
5b918bf
skip check in non-prod
blaine-arcjet Dec 22, 2023
42a976f
update tests
blaine-arcjet Dec 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 23 additions & 3 deletions arcjet/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,10 +171,30 @@ export type RemoteClientOptions = {
sdkVersion?: string;
};

const baseUrlAllowed = [
"https://decide.arcjet.com",
"https://decide.arcjettest.com",
"https://decide.arcjet.orb.local:4082",
];

export function defaultBaseUrl() {
return process.env["ARCJET_BASE_URL"]
? process.env["ARCJET_BASE_URL"] // If ARCJET_BASE_URL is set, use it
: "https://decide.arcjet.com"; // Otherwise use the default
// TODO(#90): Remove this production conditional before 1.0.0
if (process.env["NODE_ENV"] === "production") {
// Use ARCJET_BASE_URL if it is set and belongs to our allowlist; otherwise
// use the hardcoded default.
if (
typeof process.env["ARCJET_BASE_URL"] === "string" &&
baseUrlAllowed.includes(process.env["ARCJET_BASE_URL"])
) {
return process.env["ARCJET_BASE_URL"];
} else {
return "https://decide.arcjet.com";
}
} else {
return process.env["ARCJET_BASE_URL"]
? process.env["ARCJET_BASE_URL"]
: "https://decide.arcjet.com";
}
}

export function createRemoteClient(
Expand Down
37 changes: 33 additions & 4 deletions arcjet/test/index.node.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,21 +125,50 @@ class ArcjetInvalidDecision extends ArcjetDecision {
}

describe("defaultBaseUrl", () => {
test("uses process.env.ARCJET_BASE_URL if set", () => {
test("uses process.env.ARCJET_BASE_URL if set and allowed", () => {
jest.replaceProperty(process, "env", {
NODE_ENV: "production",
ARCJET_BASE_URL: "https://decide.arcjet.orb.local:4082",
});
expect(defaultBaseUrl()).toEqual("https://decide.arcjet.orb.local:4082");
});

test("does not use process.env.ARCJET_BASE_URL if not allowed", () => {
jest.replaceProperty(process, "env", {
NODE_ENV: "production",
ARCJET_BASE_URL: "http://localhost:1234",
});
expect(defaultBaseUrl()).toEqual("http://localhost:1234");
expect(defaultBaseUrl()).toEqual("https://decide.arcjet.com");
});

test("does not use process.env.ARCJET_BASE_URL if empty string", () => {
jest.replaceProperty(process, "env", { ARCJET_BASE_URL: "" });
expect(defaultBaseUrl()).not.toEqual("");
jest.replaceProperty(process, "env", {
NODE_ENV: "production",
ARCJET_BASE_URL: "",
});
expect(defaultBaseUrl()).toEqual("https://decide.arcjet.com");
});

test("uses production url if process.env.ARCJET_BASE_URL not set", () => {
expect(defaultBaseUrl()).toEqual("https://decide.arcjet.com");
});

// TODO(#90): Remove these tests once production conditional is removed
test("uses process.env.ARCJET_BASE_URL if set (in development)", () => {
jest.replaceProperty(process, "env", {
NODE_ENV: "development",
ARCJET_BASE_URL: "http://localhost:1234",
});
expect(defaultBaseUrl()).toEqual("http://localhost:1234");
});

test("does not use process.env.ARCJET_BASE_URL if empty string (in development)", () => {
jest.replaceProperty(process, "env", {
NODE_ENV: "development",
ARCJET_BASE_URL: "",
});
expect(defaultBaseUrl()).toEqual("https://decide.arcjet.com");
});
});

describe("createRemoteClient", () => {
Expand Down