fix(contentful): createUrl now enforces https protocol (gatsbyjs#33236)

Co-authored-by: Ward Peeters <ward@coding-tech.com>
herecydev · Oct 29, 2021 · 38650cc · 38650cc
1 parent 6036e16
commit 38650cc
Show file tree

Hide file tree

Showing 6 changed files with 314 additions and 362 deletions.
diff --git a/packages/gatsby-source-contentful/package.json b/packages/gatsby-source-contentful/package.json
@@ -25,7 +25,6 @@
     "lodash": "^4.17.21",
     "node-fetch": "^2.6.1",
     "p-queue": "^6.6.2",
-    "qs": "^6.10.1",
     "retry-axios": "^2.4.0"
   },
   "devDependencies": {

diff --git a/packages/gatsby-source-contentful/src/__tests__/__snapshots__/extend-node-type.js.snap b/packages/gatsby-source-contentful/src/__tests__/__snapshots__/extend-node-type.js.snap
diff --git a/packages/gatsby-source-contentful/src/__tests__/extend-node-type.js b/packages/gatsby-source-contentful/src/__tests__/extend-node-type.js
diff --git a/packages/gatsby-source-contentful/src/download-contentful-assets.js b/packages/gatsby-source-contentful/src/download-contentful-assets.js
@@ -1,4 +1,5 @@
 const { createRemoteFileNode } = require(`gatsby-source-filesystem`)
+const { createUrl } = require(`./extend-node-type`)
 
 /**
  * @name distributeWorkload
@@ -64,7 +65,7 @@ const downloadContentfulAssets = async gatsbyFunctions => {
         )
         return Promise.resolve()
       }
-      const url = `https://${node.file.url.slice(2)}`
+      const url = createUrl(node.file.url)
 
       // Avoid downloading the asset again if it's been cached
       // Note: Contentful Assets do not provide useful metadata

diff --git a/packages/gatsby-source-contentful/src/extend-node-type.js b/packages/gatsby-source-contentful/src/extend-node-type.js
@@ -2,6 +2,7 @@
 const fs = require(`fs`)
 const path = require(`path`)
 const crypto = require(`crypto`)
+const { URLSearchParams } = require(`url`)
 
 const sortBy = require(`lodash/sortBy`)
 const {
@@ -14,7 +15,6 @@ const {
   GraphQLJSON,
   GraphQLList,
 } = require(`gatsby/graphql`)
-const qs = require(`qs`)
 const { stripIndent } = require(`common-tags`)
 
 const cacheImage = require(`./cache-image`)
@@ -86,7 +86,8 @@ const getBase64Image = (imageProps, reporter) => {
     width: 20,
     height: Math.floor(20 * aspectRatio),
   }
-  const requestUrl = `https:${createUrl(imageProps.baseUrl, imageOptions)}`
+
+  const requestUrl = createUrl(imageProps.baseUrl, imageOptions)
 
   // Prefer to return data sync if we already have it
   const alreadyFetched = resolvedBase64Cache.get(requestUrl)
@@ -197,8 +198,14 @@ const createUrl = (imgUrl, options = {}) => {
     r: cornerRadius || undefined,
   }
 
-  // Note: qs will ignore keys that are `undefined`. `qs.stringify({a: undefined, b: null, c: 1})` => `b=&c=1`
-  return `${imgUrl}?${qs.stringify(urlArgs)}`
+  const searchParams = new URLSearchParams()
+  for (const paramKey in urlArgs) {
+    if (typeof urlArgs[paramKey] !== `undefined`) {
+      searchParams.append(paramKey, urlArgs[paramKey] ?? ``)
+    }
+  }
+
+  return `https:${imgUrl}?${searchParams.toString()}`
 }
 exports.createUrl = createUrl
 

diff --git a/yarn.lock b/yarn.lock
@@ -21113,7 +21113,7 @@ qs@6.7.0:
   resolved "https://registry.yarnpkg.com/qs/-/qs-6.7.0.tgz#41dc1a015e3d581f1621776be31afb2876a9b1bc"
   integrity sha512-VCdBRNFTX1fyE7Nb6FYoURo/SPe62QCaAyzJvUjwRaIsc+NePBEniHlvxFmmX56+HZphIGtV0XeCirBtpDrTyQ==
 
-qs@^6.1.0, qs@^6.10.1, qs@^6.4.0, qs@^6.5.1, qs@^6.5.2, qs@^6.9.4:
+qs@^6.1.0, qs@^6.4.0, qs@^6.5.1, qs@^6.5.2, qs@^6.9.4:
   version "6.10.1"
   resolved "https://registry.yarnpkg.com/qs/-/qs-6.10.1.tgz#4931482fa8d647a5aab799c5271d2133b981fb6a"
   integrity sha512-M528Hph6wsSVOBiYUnGf+K/7w0hNshs/duGsNXPUCLH5XAqjEtiPGwNONLV0tBH8NoGb0mvD5JubnUTrujKDTg==