Skip to content

Commit

Permalink
chore: sanitize url's to only allow github (#5776)
Browse files Browse the repository at this point in the history
# Description

## Problem\*

Resolves #5737

## Summary\*



## Additional Context



## Documentation\*

Check one:
- [x] No documentation needed.
- [ ] Documentation included in this PR.
- [ ] **[For Experimental Features]** Documentation to be submitted in a
separate PR.

# PR Checklist\*

- [x] I have tested the changes locally.
- [x] I have formatted the changes with [Prettier](https://prettier.io/)
and/or `cargo fmt` on default settings.
  • Loading branch information
michaeljklein authored Aug 21, 2024
1 parent d995e06 commit 50a6b90
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,8 @@ export class GithubDependencyResolver implements DependencyResolver {
}

async #fetchZipFromGithub(dependency: Pick<GitDependencyConfig, 'git' | 'tag'>): Promise<string> {
if (!dependency.git.startsWith('https://github.com')) {
const git_host = new URL(dependency.git);
if (git_host !== null && git_host.host != 'github.com') {
throw new Error('Only github dependencies are supported');
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,8 @@ describe('GithubDependencyResolver', () => {
{ git: 'https://github.com/', tag: 'v1' },
{ git: 'https://github.com/foo', tag: 'v1' },
{ git: 'https://example.com', tag: 'v1' },
{ git: 'https://github.saobby.my.eu.org.otherdomain.com', tag: 'v1' },
{ git: 'https://github.saobby.my.eu.org.otherdomain.com/example/repo', tag: 'v1' },
]).it('throws if the Github URL is invalid %j', (dep) => {
expect(() => resolveGithubCodeArchive(dep, 'zip')).to.throw();
});
Expand Down
2 changes: 1 addition & 1 deletion compiler/wasm/test/fixtures/with-deps/src/main.nr
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
use lib_a::divide;
fn main(x: u64, y: pub u64) {
divide(x, y);
let _ = divide(x, y);
}

0 comments on commit 50a6b90

Please sign in to comment.