@tableau/taco-toolkit
Version:
Tableau Connector Toolkit
121 lines • 7.7 kB
JavaScript
;
var __values = (this && this.__values) || function(o) {
var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
if (m) return m.call(o);
if (o && typeof o.length === "number") return {
next: function () {
if (o && i >= o.length) o = void 0;
return { value: o && o[i++], done: !o };
}
};
throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
};
var __read = (this && this.__read) || function (o, n) {
var m = typeof Symbol === "function" && o[Symbol.iterator];
if (!m) return o;
var i = m.call(o), r, ar = [], e;
try {
while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
}
catch (error) { e = { error: error }; }
finally {
try {
if (r && !r.done && (m = i["return"])) m.call(i);
}
finally { if (e) throw e.error; }
}
return ar;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.checkApiPermission = void 0;
function checkApiPermission(apiPermission, url, method) {
var e_1, _a;
try {
for (var _b = __values(Object.entries(apiPermission)), _c = _b.next(); !_c.done; _c = _b.next()) {
var _d = __read(_c.value, 2), rule = _d[0], methods = _d[1];
if (testRule(url, rule) && (method === 'OPTIONS' || methods.includes(method))) {
return true;
}
}
}
catch (e_1_1) { e_1 = { error: e_1_1 }; }
finally {
try {
if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
}
finally { if (e_1) throw e_1.error; }
}
return false;
}
exports.checkApiPermission = checkApiPermission;
function testRule(url, rule) {
var urlParts = splitUrl(url);
// if the url is invalid, no need to match the regex
if (!urlParts) {
return false;
}
var regExps = getRuleRegExps(rule);
// if the rule is not in a valid url, it means the rule is too loose to prevent
// SSRF attack. For now, we fallback to use the old matching function to avoid
// breaking any exisitng connector during runtime. A validation check will happen
// during connector build time to block new usages to be added.
if (!regExps) {
return unsafeMatch(url, rule);
}
var _a = __read(regExps, 2), originRegex = _a[0], pathRegex = _a[1];
var _b = __read(urlParts, 2), urlOrigin = _b[0], urlPath = _b[1];
if (!originRegex.test(urlOrigin)) {
return false;
}
return pathRegex.test(urlPath);
}
/**
* Create RegExps for the given rule string. The function returns two RegExps,
* one for the origin section and one for the path section, including search + hash.
*/
function getRuleRegExps(rule) {
var url;
try {
url = new URL(rule);
}
catch (e) {
return;
}
var originRule = decodeURIComponent(url.origin);
var originRegexString = originRule.split('*').map(escapeRegex).join('[\\w-.:]*');
var pathRule = rule.replace(originRule, '') + '*';
var pathRegexString = pathRule.split('*').map(escapeRegex).join('.*');
return [new RegExp("^".concat(originRegexString, "$")), new RegExp("^".concat(pathRegexString, "$"))];
}
/**
* Split url string into origin (protocol://domain) and the remaining string (path + search + hash)
*/
function splitUrl(urlString) {
var url;
try {
url = new URL(urlString);
}
catch (e) {
return;
}
var urlOrigin = decodeURIComponent(url.origin);
var originRegex = new RegExp(escapeRegex(urlOrigin), 'i');
var urlPath = urlString.replace(originRegex, '');
return [urlOrigin, urlPath];
}
/**
* This is a legacy permission matching function. Currently, it is only used as
* a fallback when any connector permission setting pattern doesn't match valid
* URL pattern for backward compatibility.
*
* Note that this matching cannot effectively prevent SSRF attack.
*/
function unsafeMatch(url, rule) {
rule = rule + '*';
var regexString = rule.split('*').map(escapeRegex).join('.*');
return new RegExp("^".concat(regexString, "$")).test(url);
}
function escapeRegex(rulePart) {
return rulePart.replace(/[.?+^$[\]\\(){}|-]/g, '\\$&');
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGVybWlzc2lvbi1jaGVjay5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zaGFyZWQvdXRpbHMvcGVybWlzc2lvbi1jaGVjay50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFHQSxTQUFnQixrQkFBa0IsQ0FBQyxhQUE0QixFQUFFLEdBQVcsRUFBRSxNQUFrQjs7O1FBQzlGLEtBQThCLElBQUEsS0FBQSxTQUFBLE1BQU0sQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUEsZ0JBQUEsNEJBQUU7WUFBbEQsSUFBQSxLQUFBLG1CQUFlLEVBQWQsSUFBSSxRQUFBLEVBQUUsT0FBTyxRQUFBO1lBQ3ZCLElBQUksUUFBUSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFO2dCQUM3RSxPQUFPLElBQUksQ0FBQTthQUNaO1NBQ0Y7Ozs7Ozs7OztJQUNELE9BQU8sS0FBSyxDQUFBO0FBQ2QsQ0FBQztBQVBELGdEQU9DO0FBRUQsU0FBUyxRQUFRLENBQUMsR0FBVyxFQUFFLElBQVk7SUFDekMsSUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0lBQzlCLG9EQUFvRDtJQUNwRCxJQUFJLENBQUMsUUFBUSxFQUFFO1FBQ2IsT0FBTyxLQUFLLENBQUE7S0FDYjtJQUVELElBQU0sT0FBTyxHQUFHLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUNwQywrRUFBK0U7SUFDL0UsOEVBQThFO0lBQzlFLGlGQUFpRjtJQUNqRiwrREFBK0Q7SUFDL0QsSUFBSSxDQUFDLE9BQU8sRUFBRTtRQUNaLE9BQU8sV0FBVyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQTtLQUM5QjtJQUVLLElBQUEsS0FBQSxPQUEyQixPQUFPLElBQUEsRUFBakMsV0FBVyxRQUFBLEVBQUUsU0FBUyxRQUFXLENBQUE7SUFDbEMsSUFBQSxLQUFBLE9BQXVCLFFBQVEsSUFBQSxFQUE5QixTQUFTLFFBQUEsRUFBRSxPQUFPLFFBQVksQ0FBQTtJQUVyQyxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRTtRQUNoQyxPQUFPLEtBQUssQ0FBQTtLQUNiO0lBRUQsT0FBTyxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFBO0FBQ2hDLENBQUM7QUFFRDs7O0dBR0c7QUFDSCxTQUFTLGNBQWMsQ0FBQyxJQUFZO0lBQ2xDLElBQUksR0FBRyxDQUFBO0lBRVAsSUFBSTtRQUNGLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQTtLQUNwQjtJQUFDLE9BQU8sQ0FBQyxFQUFFO1FBQ1YsT0FBTTtLQUNQO0lBRUQsSUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ2pELElBQU0saUJBQWlCLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFBO0lBRWxGLElBQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxHQUFHLEdBQUcsQ0FBQTtJQUNuRCxJQUFNLGVBQWUsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUE7SUFFdkUsT0FBTyxDQUFDLElBQUksTUFBTSxDQUFDLFdBQUksaUJBQWlCLE1BQUcsQ0FBQyxFQUFFLElBQUksTUFBTSxDQUFDLFdBQUksZUFBZSxNQUFHLENBQUMsQ0FBQyxDQUFBO0FBQ25GLENBQUM7QUFFRDs7R0FFRztBQUNILFNBQVMsUUFBUSxDQUFDLFNBQWlCO0lBQ2pDLElBQUksR0FBRyxDQUFBO0lBRVAsSUFBSTtRQUNGLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQTtLQUN6QjtJQUFDLE9BQU8sQ0FBQyxFQUFFO1FBQ1YsT0FBTTtLQUNQO0lBRUQsSUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFBO0lBQ2hELElBQU0sV0FBVyxHQUFHLElBQUksTUFBTSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQTtJQUMzRCxJQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQTtJQUVsRCxPQUFPLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0FBQzdCLENBQUM7QUFFRDs7Ozs7O0dBTUc7QUFDSCxTQUFTLFdBQVcsQ0FBQyxHQUFXLEVBQUUsSUFBWTtJQUM1QyxJQUFJLEdBQUcsSUFBSSxHQUFHLEdBQUcsQ0FBQTtJQUNqQixJQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUE7SUFFL0QsT0FBTyxJQUFJLE1BQU0sQ0FBQyxXQUFJLFdBQVcsTUFBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFBO0FBQ2pELENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxRQUFnQjtJQUNuQyxPQUFPLFFBQVEsQ0FBQyxPQUFPLENBQUMscUJBQXFCLEVBQUUsTUFBTSxDQUFDLENBQUE7QUFDeEQsQ0FBQyJ9