From 79914402e6c424762ae2985aed7b71d40096619d Mon Sep 17 00:00:00 2001 From: Emiliano Sanchez Date: Tue, 1 Feb 2022 13:21:01 -0300 Subject: [PATCH 1/2] fixed node-fetch vulnerability, and fetch API rejection handling --- package-lock.json | 35 +++++++++++++++++++++++++++++---- package.json | 2 +- src/services/splitHttpClient.ts | 2 +- 3 files changed, 33 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7be002a0..00e802b2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5031,10 +5031,37 @@ "dev": true }, "node-fetch": { - "version": "2.6.1", - "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz", - "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==", - "dev": true + "version": "2.6.7", + "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz", + "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==", + "dev": true, + "requires": { + "whatwg-url": "^5.0.0" + }, + "dependencies": { + "tr46": { + "version": "0.0.3", + "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", + "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o=", + "dev": true + }, + "webidl-conversions": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", + "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE=", + "dev": true + }, + "whatwg-url": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", + "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=", + "dev": true, + "requires": { + "tr46": "~0.0.3", + "webidl-conversions": "^3.0.0" + } + } + } }, "node-int64": { "version": "0.4.0", diff --git a/package.json b/package.json index 9310f51f..9cce3f8a 100644 --- a/package.json +++ b/package.json @@ -64,7 +64,7 @@ "jest-localstorage-mock": "^2.4.3", "js-yaml": "^3.14.0", "lodash": "^4.17.21", - "node-fetch": "^2.6.1", + "node-fetch": "^2.6.7", "redis-server": "1.2.2", "rimraf": "^3.0.2", "ts-jest": "^27.0.5", diff --git a/src/services/splitHttpClient.ts b/src/services/splitHttpClient.ts index ee031149..d9ec90f7 100644 --- a/src/services/splitHttpClient.ts +++ b/src/services/splitHttpClient.ts @@ -49,7 +49,7 @@ export function splitHttpClientFactory(settings: Pick { - const resp = error.response; + const resp = error && error.response; let msg = ''; if (resp) { // An HTTP error From 3a5141a6f587636bc5362521a6bd2e98f47bb0c6 Mon Sep 17 00:00:00 2001 From: Emiliano Sanchez Date: Thu, 3 Feb 2022 17:35:04 -0300 Subject: [PATCH 2/2] added isBrowserClient flag to SDK clients --- src/sdkClient/client.ts | 3 ++- src/sdkClient/clientCS.ts | 4 +++- src/types.ts | 6 +++++- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/sdkClient/client.ts b/src/sdkClient/client.ts index a572047e..5b0b7de2 100644 --- a/src/sdkClient/client.ts +++ b/src/sdkClient/client.ts @@ -123,6 +123,7 @@ export function clientFactory(params: IClientFactoryParams): SplitIO.IClient | S getTreatmentWithConfig, getTreatments, getTreatmentsWithConfig, - track + track, + isBrowserClient: false } as SplitIO.IClient | SplitIO.IAsyncClient; } diff --git a/src/sdkClient/clientCS.ts b/src/sdkClient/clientCS.ts index 8cf0d6a2..16648bc6 100644 --- a/src/sdkClient/clientCS.ts +++ b/src/sdkClient/clientCS.ts @@ -23,6 +23,8 @@ export function clientCSDecorator(log: ILogger, client: SplitIO.IClient, key: Sp getTreatmentsWithConfig: clientCS.getTreatmentsWithConfig.bind(clientCS, key), // Key is bound to the `track` method. Same thing happens with trafficType but only if provided - track: trafficType ? clientCS.track.bind(clientCS, key, trafficType) : clientCS.track.bind(clientCS, key) + track: trafficType ? clientCS.track.bind(clientCS, key, trafficType) : clientCS.track.bind(clientCS, key), + + isBrowserClient: true }) as SplitIO.ICsClient; } diff --git a/src/types.ts b/src/types.ts index 9a94dd45..46451a60 100644 --- a/src/types.ts +++ b/src/types.ts @@ -381,6 +381,10 @@ interface IBasicClient extends IStatusInterface { * @returns {Promise} */ destroy(): Promise + + // Whether the client implements the client-side API, i.e, with bound key, (true), or the server-side API (false). + // Exposed for internal purposes only. Not considered part of the public API, and might be renamed eventually. + isBrowserClient: boolean } /** * Common definitions between SDK instances for different environments interface. @@ -1139,7 +1143,7 @@ export namespace SplitIO { /** * Removes from client's in memory attributes storage the attribute with the given key * @function removeAttribute - * @param {string} attributeName + * @param {string} attributeName * @returns {boolean} true if attribute was removed and false otherways */ removeAttribute(attributeName: string): boolean,