milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Let modifyNpmInfoRequestHeaders return the header collection as well.

Browse source
This commit is contained in:
Sander Declerck 2025-11-24 15:22:41 +01:00
parent 5834229427
commit 44ee58aa9b
No known key found for this signature in database
3 changed files with 18 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
packages/safe-chain/src/registryProxy/interceptors/interceptorBuilder.js
View file

@ -10,14 +10,14 @@ import { EventEmitter } from "events";
* @typedef {Object} RequestInterceptionContext * @typedef {Object} RequestInterceptionContext
* @property {string} targetUrl * @property {string} targetUrl
* @property {(packageName: string | undefined, version: string | undefined) => void} blockMalware * @property {(packageName: string | undefined, version: string | undefined) => void} blockMalware
* @property {(modificationFunc: (headers: NodeJS.Dict<string | string[]>) => void) => void} modifyRequestHeaders * @property {(modificationFunc: (headers: NodeJS.Dict<string | string[]>) => NodeJS.Dict<string | string[]>) => void} modifyRequestHeaders
* @property {(modificationFunc: (body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer) => void} modifyBody * @property {(modificationFunc: (body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer) => void} modifyBody
* @property {() => RequestInterceptionHandler} build * @property {() => RequestInterceptionHandler} build
* *
* *
* @typedef {Object} RequestInterceptionHandler * @typedef {Object} RequestInterceptionHandler
* @property {{statusCode: number, message: string} | undefined} blockResponse * @property {{statusCode: number, message: string} | undefined} blockResponse
* @property {(headers: NodeJS.Dict<string | string[]> | undefined) => void} modifyRequestHeaders * @property {(headers: NodeJS.Dict<string | string[]> | undefined) => NodeJS.Dict<string | string[]> | undefined} modifyRequestHeaders
* @property {() => boolean} modifiesResponse * @property {() => boolean} modifiesResponse
* @property {(body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer} modifyBody * @property {(body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer} modifyBody
*/ */
@ -65,7 +65,7 @@ function buildInterceptor(requestHandlers) {
function createRequestContext(targetUrl, eventEmitter) { function createRequestContext(targetUrl, eventEmitter) {
/** @type {{statusCode: number, message: string} | undefined} */ /** @type {{statusCode: number, message: string} | undefined} */
let blockResponse = undefined; let blockResponse = undefined;
/** @type {Array<(headers: NodeJS.Dict<string | string[]>) => void>} */ /** @type {Array<(headers: NodeJS.Dict<string | string[]>) => NodeJS.Dict<string | string[]>>} */
let reqheaderModificationFuncs = []; let reqheaderModificationFuncs = [];
/** @type {Array<(body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer>} */ /** @type {Array<(body: Buffer, headers: NodeJS.Dict<string | string[]> | undefined) => Buffer>} */
let modifyBodyFuncs = []; let modifyBodyFuncs = [];
@ -91,15 +91,20 @@ function createRequestContext(targetUrl, eventEmitter) {
/** @returns {RequestInterceptionHandler} */ /** @returns {RequestInterceptionHandler} */
function build() { function build() {
/** @param {NodeJS.Dict<string | string[]> | undefined} headers */ /**
* @param {NodeJS.Dict<string | string[]> | undefined} headers
* @returns {NodeJS.Dict<string | string[]> | undefined}
*/
function modifyRequestHeaders(headers) { function modifyRequestHeaders(headers) {
if (!headers) return; if (headers) {
for (const func of reqheaderModificationFuncs) { for (const func of reqheaderModificationFuncs) {
func(headers); func(headers);
} }
} }
return headers;
}
/** /**
* @param {Buffer} body * @param {Buffer} body
* @param {NodeJS.Dict<string | string[]> | undefined} headers * @param {NodeJS.Dict<string | string[]> | undefined} headers

2
packages/safe-chain/src/registryProxy/interceptors/npm/modifyNpmInfo.js
View file

@ -8,6 +8,7 @@ const state = {
/** /**
* @param {NodeJS.Dict<string | string[]>} headers * @param {NodeJS.Dict<string | string[]>} headers
* @returns {NodeJS.Dict<string | string[]>}
*/ */
export function modifyNpmInfoRequestHeaders(headers) { export function modifyNpmInfoRequestHeaders(headers) {
const accept = getHeaderValueAsString(headers, "accept"); const accept = getHeaderValueAsString(headers, "accept");
@ -17,6 +18,7 @@ export function modifyNpmInfoRequestHeaders(headers) {
// Force the registry to return the full metadata by changing the Accept header. // Force the registry to return the full metadata by changing the Accept header.
headers["accept"] = "application/json"; headers["accept"] = "application/json";
} }
return headers;
} }
/** /**

5
packages/safe-chain/src/registryProxy/mitmRequestHandler.js
View file

@ -151,11 +151,12 @@ function forwardRequest(req, hostname, res, requestHandler) {
* @returns {import("http").ClientRequest} * @returns {import("http").ClientRequest}
*/ */
function createProxyRequest(hostname, req, res, requestHandler) { function createProxyRequest(hostname, req, res, requestHandler) {
const headers = { ...req.headers }; /** @type {NodeJS.Dict<string | string[]> | undefined} */
let headers = { ...req.headers };
if (headers.host) { if (headers.host) {
delete headers.host; delete headers.host;
} }
requestHandler.modifyRequestHeaders(headers); headers = requestHandler.modifyRequestHeaders(headers);
/** @type {import("http").RequestOptions} */ /** @type {import("http").RequestOptions} */
const options = { const options = {