-
Notifications
You must be signed in to change notification settings - Fork 3.7k
Expand file tree
/
Copy pathutils.ts
More file actions
89 lines (83 loc) · 3.47 KB
/
Copy pathutils.ts
File metadata and controls
89 lines (83 loc) · 3.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
const DEFAULT_GITLAB_HOST = 'gitlab.com'
/**
* Error thrown when a user-supplied GitLab host is structurally unsafe to use
* as the target of a server-side request that carries the user's access token.
*/
export class UnsafeGitLabHostError extends Error {
constructor(rawHost: string) {
super(`Invalid GitLab host: ${rawHost}`)
this.name = 'UnsafeGitLabHostError'
}
}
/**
* Rejects a host that is structurally unsafe to fetch with the caller's token.
*
* The host is later interpolated into `https://<host>/api/v4`, so anything that
* could change the request's authority (userinfo `@`, an embedded path/query/
* fragment, whitespace, or control characters) must be rejected to prevent the
* `PRIVATE-TOKEN` header from being sent to an attacker-controlled origin. The
* allowed alphabet is hostname labels plus an optional `:port`, so self-managed
* hosts such as `gitlab.example.com` or `gitlab.example.com:8443` keep working.
* This is a structural guard only; DNS-based private-IP/SSRF checks remain the
* responsibility of the fetch layer.
*/
function assertSafeGitLabHostString(host: string, rawHost: string): void {
const hostnameWithoutPort = host.replace(/:\d+$/, '')
const allowedHostChars = /^[A-Za-z0-9.-]+$/
if (!allowedHostChars.test(hostnameWithoutPort)) {
throw new UnsafeGitLabHostError(rawHost)
}
if (hostnameWithoutPort.startsWith('.') || hostnameWithoutPort.endsWith('.')) {
throw new UnsafeGitLabHostError(rawHost)
}
if (hostnameWithoutPort.split('.').some((label) => label.length === 0)) {
throw new UnsafeGitLabHostError(rawHost)
}
}
/**
* Normalizes a GitLab host value: trims whitespace, strips any protocol prefix
* and trailing slashes, validates that the result is a bare host (optionally
* with a port), and falls back to gitlab.com when empty. Mirrors the GitLab
* connector so tools, triggers, and connectors resolve hosts identically.
*
* @throws {UnsafeGitLabHostError} when a non-empty host is structurally unsafe.
*/
export function normalizeGitLabHost(rawHost: unknown): string {
const raw = typeof rawHost === 'string' ? rawHost.trim() : ''
if (!raw) return DEFAULT_GITLAB_HOST
const host = raw
.replace(/^https?:\/\//i, '')
.replace(/\/+$/, '')
.trim()
if (!host) return DEFAULT_GITLAB_HOST
assertSafeGitLabHostString(host, String(rawHost))
return host
}
/**
* Builds the REST API v4 base URL for the configured host. Defaults to
* gitlab.com so existing workflows that never set a host keep working.
*
* @throws {UnsafeGitLabHostError} when a non-empty host is structurally unsafe.
*/
export function getGitLabApiBase(rawHost: unknown): string {
return `https://${normalizeGitLabHost(rawHost)}/api/v4`
}
/**
* A GitLab access/membership resource is scoped either to a project or a group.
* The two share an identical endpoint surface (`/members`, `/invitations`,
* `/access_requests`) that differs only in the leading path segment.
*/
export type GitLabResourceType = 'project' | 'group'
/**
* Builds the path segment for a project- or group-scoped access resource, e.g.
* `projects/mygroup%2Fmyproject` or `groups/42`. The id is URL-encoded so that
* URL-encoded paths (`mygroup/myproject`) and numeric ids both work.
*/
export function getGitLabResourcePath(
resourceType: GitLabResourceType,
resourceId: string | number
): string {
const encodedId = encodeURIComponent(String(resourceId).trim())
const segment = resourceType === 'group' ? 'groups' : 'projects'
return `${segment}/${encodedId}`
}