enable helix-run-query data embeds

[MarquiseRosier]

add run_query to to data_embed_whitelist

[trieloff]

That will need to look a bit different than the rest of the whitelist, as the whitelist is a domain filter. I'd probably tweak the function that checks if a URL is on the whitelist and have the _run_query pattern hardcoded.

Or: we come up with a way to interpret the domain name globs as URL globs if the contains a /.

[MarquiseRosier]

@trieloff If I can make a suggestion, I think we should whitelist certain queries for users; so I'm down for another whitelist and a separate test.

Then just do a
mm.some(url.host, ext_data_embed_whitelist) || mm.some(url, hlx_data_embed_whitelist)

I think we shouldn't mix hlx data embeds with external ones; and we should be careful about what people can publish especially because some of the queries aren't for public use anyway

[trieloff]

I don't think we need to whitelist specific queries and I wouldn't want to have a new configuration setting, just something like this:

    "DATA_EMBED_WHITELIST": {
      "type": "string",
      "description": "Comma-separated list of allowed hostnames for data embeds. Supports `*.example.com` as a subdomain wildcard. Use `*` to allow all embeds (potentially insecure and conflicting with `EMBED_WHITELIST`)",
      "default": "docs.google.com, *.sharepoint.com, */_query/*, https://adobeioruntime.net/api/v1/web/*/helix-services/run-query@v1/*"
    },

Then split the glob pattern at the first slash, evaluate the left part against the hostname (as we do now) and the right part (including the initial slash) against the pathname.

[MarquiseRosier]

good point, thanks for the additional help here, I think i'll lump all these whitelist based changes together:

#732

pr coming up

[MarquiseRosier]

This was completed with adobe/helix-data-embed#44