GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — lib,esm: handle bypass network-import via data: by RafaelGSS · Pull Request #53764 · nodejs/node

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Jul 8, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This commit didn't land cleanly on main from v22.x 110902f. So, I'm opening a manual PR to make sure we won't break anything.

cc: @aduh95 @GeoffreyBooth

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bricss reacted with rocket emoji
All reactions
  • 🚀 1 reaction
@nodejs-github-bot

nodejs-github-bot commented Jul 8, 2024

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/loaders
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nodejs-github-bot nodejs-github-bot added esm Issues and PRs related to the ECMAScript Modules implementation. needs-ci PRs that need a full CI run. labels Jul 8, 2024
@RafaelGSS
RafaelGSS requested review from aduh95 and marco-ippolito July 8, 2024 18:50
@RafaelGSS

RafaelGSS commented Jul 8, 2024

Copy link
Copy Markdown
Member Author

The validation needs to accept H1 links as well.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

anonrig
anonrig reviewed Jul 8, 2024
View reviewed changes
Comment thread lib/internal/modules/esm/resolve.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

@RafaelGSS
RafaelGSS force-pushed the backport-network-import-via-data branch from 5c74da6 to 61b1f42 Compare July 8, 2024 19:12
RafaelGSS
RafaelGSS commented Jul 8, 2024
View reviewed changes
Comment thread lib/internal/modules/esm/resolve.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

@RafaelGSS
RafaelGSS force-pushed the backport-network-import-via-data branch from 61b1f42 to 9dc1933 Compare July 8, 2024 21:45
@RafaelGSS
lib,esm: handle bypass network-import via data:
15c2d8d
PR-URL: nodejs-private/node-private#522
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=2092749
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
CVE-ID: CVE-2024-22020
@RafaelGSS
RafaelGSS force-pushed the backport-network-import-via-data branch from 9dc1933 to 15c2d8d Compare July 8, 2024 21:49
anonrig
anonrig approved these changes Jul 8, 2024
View reviewed changes
@RafaelGSS RafaelGSS added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jul 8, 2024
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Jul 8, 2024
@nodejs-github-bot

nodejs-github-bot commented Jul 8, 2024

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/60188/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@RafaelGSS RafaelGSS added the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Jul 9, 2024
aduh95
aduh95 approved these changes Jul 9, 2024
View reviewed changes
Comment thread lib/internal/modules/esm/resolve.js
return { __proto__: null, url: parsed.href };
}
}

@aduh95 aduh95 Jul 9, 2024

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: unrelated line removal

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
marco-ippolito
marco-ippolito approved these changes Jul 9, 2024
View reviewed changes
mcollina
mcollina approved these changes Jul 9, 2024
View reviewed changes

@mcollina mcollina left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@RafaelGSS RafaelGSS added the commit-queue PRs queued for automated landing through the Commit Queue. label Jul 12, 2024
@nodejs-github-bot nodejs-github-bot added commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. and removed commit-queue PRs queued for automated landing through the Commit Queue. labels Jul 12, 2024
@nodejs-github-bot

nodejs-github-bot commented Jul 12, 2024

Copy link
Copy Markdown
Collaborator
Commit Queue failed
- Loading data for nodejs/node/pull/53764
✔  Done loading data for nodejs/node/pull/53764
----------------------------------- PR info ------------------------------------
Title      lib,esm: handle bypass network-import via data: (#53764)
Author     Rafael Gonzaga <[email protected]> (@RafaelGSS)
Branch     RafaelGSS:backport-network-import-via-data -> nodejs:main
Labels     esm, author ready, needs-ci
Commits    1
 - lib,esm: handle bypass network-import via data:
Committers 1
 - RafaelGSS <[email protected]>
PR-URL: https://github.com/nodejs/node/pull/53764
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2092749
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/53764
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=2092749
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Mon, 08 Jul 2024 18:48:45 GMT
   ✔  Approvals: 4
   ✔  - Yagiz Nizipli (@anonrig): https://github.com/nodejs/node/pull/53764#pullrequestreview-2164507162
   ✔  - Antoine du Hamel (@aduh95) (TSC): https://github.com/nodejs/node/pull/53764#pullrequestreview-2165404578
   ✔  - Marco Ippolito (@marco-ippolito) (TSC): https://github.com/nodejs/node/pull/53764#pullrequestreview-2165583758
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/53764#pullrequestreview-2165697861
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2024-07-08T23:19:20Z: https://ci.nodejs.org/job/node-test-pull-request/60188/
- Querying data for job/node-test-pull-request/60188/
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 53764
From https://github.com/nodejs/node
 * branch                  refs/pull/53764/merge -> FETCH_HEAD
✔  Fetched commits as fc233627ed44..15c2d8d75ed8
--------------------------------------------------------------------------------
[main ad0ac2de27] lib,esm: handle bypass network-import via data:
 Author: RafaelGSS <[email protected]>
 Date: Wed Jan 10 14:50:18 2024 -0300
 3 files changed, 164 insertions(+), 64 deletions(-)
 create mode 100644 test/fixtures/es-modules/import-data-url.mjs
   ✔  Patches applied
--------------------------------------------------------------------------------
   ⚠  Found Reviewed-By: Antoine du Hamel <[email protected]>, skipping..
   ⚠  Found Reviewed-By: Marco Ippolito <[email protected]>, skipping..
--------------------------------- New Message ----------------------------------
lib,esm: handle bypass network-import via data:

PR-URL: https://github.com/nodejs-private/node-private/pull/522
Refs: https://hackerone.com/bugs?subject=nodejs&amp;report_id=2092749
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
CVE-ID: CVE-2024-22020
PR-URL: #53764
Fixes: https://hackerone.com/bugs?subject=nodejs&amp;report_id=2092749
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>

[main 6f2a2306fc] lib,esm: handle bypass network-import via data:
Author: RafaelGSS <[email protected]>
Date: Wed Jan 10 14:50:18 2024 -0300
3 files changed, 164 insertions(+), 64 deletions(-)
create mode 100644 test/fixtures/es-modules/import-data-url.mjs
✖ 6f2a2306fcf219dcd27189810a543b542800cbc4
✔ 0:0 no Co-authored-by metadata co-authored-by-is-trailer
✖ 7:7 Fixes must be a GitHub URL. fixes-url
✔ 0:0 blank line after title line-after-title
✔ 0:0 line-lengths are valid line-length
✔ 0:0 metadata is at end of message metadata-end
✔ 6:8 PR-URL is valid. pr-url
✔ 0:0 reviewers are valid reviewers
✔ 0:0 valid subsystems subsystem
✔ 0:0 Title is formatted correctly. title-format
✔ 0:0 Title is <= 50 columns. title-length

ℹ Please fix the commit message and try again.
Please manually ammend the commit message, by running
git commit --amend
Once commit message is fixed, finish the landing command running
git node land --continue

https://github.com/nodejs/node/actions/runs/9907895685

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@RafaelGSS RafaelGSS added commit-queue PRs queued for automated landing through the Commit Queue. and removed commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. labels Jul 12, 2024
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Jul 12, 2024
@nodejs-github-bot
nodejs-github-bot merged commit 24648b5 into nodejs:main Jul 12, 2024
@nodejs-github-bot

nodejs-github-bot commented Jul 12, 2024

Copy link
Copy Markdown
Collaborator

Landed in 24648b5

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@aduh95 aduh95 added the backported-to-v18.x label Jul 12, 2024
@aduh95 aduh95 added backported-to-v20.x backported-to-v22.x PRs backported to the v22.x-staging branch. labels Jul 12, 2024
ehsankhfr pushed a commit to ehsankhfr/node that referenced this pull request Jul 18, 2024
@RafaelGSS @ehsankhfr
lib,esm: handle bypass network-import via data:
fba9247
PR-URL: https://github.com/nodejs-private/node-private/pull/522
Refs: https://hackerone.com/bugs?subject=nodejs&report_id=2092749
Reviewed-By: Antoine du Hamel <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
CVE-ID: CVE-2024-22020
PR-URL: nodejs#53764
Reviewed-By: Yagiz Nizipli <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
@aduh95 aduh95 mentioned this pull request Oct 14, 2024
2024-10-16, Version 23.0.0 (Current) #55338
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mcollina mcollina mcollina approved these changes
@anonrig anonrig anonrig approved these changes
@aduh95 aduh95 aduh95 approved these changes
@marco-ippolito marco-ippolito marco-ippolito approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. backported-to-v22.x PRs backported to the v22.x-staging branch. esm Issues and PRs related to the ECMAScript Modules implementation. needs-ci PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@RafaelGSS @nodejs-github-bot @mcollina @anonrig @aduh95 @marco-ippolito
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.