Skip to content

Normalize workers assets path#7318

Merged
edmundhung merged 2 commits intomainfrom
walshy/normalize-workers-assets-path
Nov 22, 2024
Merged

Normalize workers assets path#7318
edmundhung merged 2 commits intomainfrom
walshy/normalize-workers-assets-path

Conversation

@WillTaylorDev
Copy link
Contributor

Prevents same-schema redirect attacks by collapsing multiple slashes in the path.

  • Tests
    • TODO (before merge)
    • Tests included
    • Tests not necessary because:
  • E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
    • I don't know
    • Required
    • Not required because: n/a
  • Public documentation
    • TODO (before merge)
    • Cloudflare docs PR(s):
    • Documentation not necessary because: n/a

@WillTaylorDev WillTaylorDev requested review from a team as code owners November 21, 2024 19:16
@changeset-bot
Copy link

changeset-bot bot commented Nov 21, 2024

🦋 Changeset detected

Latest commit: 8bc25be

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@cloudflare/workers-shared Minor
wrangler Patch
@cloudflare/vitest-pool-workers Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch from bf42f5e to 0e06721 Compare November 21, 2024 19:17
@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2024

A wrangler prerelease is available for testing. You can install this latest build in your project with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-wrangler-7318

You can reference the automatically updated head of this PR with:

npm install --save-dev https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/prs/7318/npm-package-wrangler-7318

Or you can use npx with this latest build directly:

npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-wrangler-7318 dev path/to/script.js
Additional artifacts:
npx https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-create-cloudflare-7318 --no-auto-update
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-kv-asset-handler-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-miniflare-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-pages-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-vitest-pool-workers-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workers-editor-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workers-shared-7318
npm install https://prerelease-registry.devprod.cloudflare.dev/workers-sdk/runs/11974732616/npm-package-cloudflare-workflows-shared-7318

Note that these links will no longer work once the GitHub Actions artifact expires.


wrangler@3.89.0 includes the following runtime dependencies:

Package Constraint Resolved
miniflare workspace:* 3.20241106.1
workerd 1.20241106.1 1.20241106.1
workerd --version 1.20241106.1 2024-11-06

Please ensure constraints are pinned, and miniflare/workerd minor versions match.

@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch 3 times, most recently from f252909 to 1fabad5 Compare November 22, 2024 14:14
@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch 2 times, most recently from 3f2348a to eedc302 Compare November 22, 2024 14:38
@WillTaylorDev WillTaylorDev force-pushed the walshy/normalize-workers-assets-path branch from eedc302 to 8bc25be Compare November 22, 2024 14:43
@edmundhung edmundhung added the skip-pr-description-validation Skip validation of the required PR description format label Nov 22, 2024
@edmundhung edmundhung merged commit 6ba5903 into main Nov 22, 2024
@edmundhung edmundhung deleted the walshy/normalize-workers-assets-path branch November 22, 2024 15:29
};
const BASE_URL = "http://example.com";

describe("[Asset Worker] `test redirects`", () => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

redirects? or rewrites?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I'll update in my next PR shortly!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip-pr-description-validation Skip validation of the required PR description format

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants