Repository navigation
Harden the public-content guard and the remote e2e secrets handling - #18
Merged
Merged
Conversation
… when unset A configured denylist with no active entry matched nothing and let every change through without output; it is now an error that names the setting without printing any entry. When no denylist is configured the guard still runs the public rules, but now says so on every run, including from the pre-commit and pre-push hooks with nothing to scan.
Git reports such files as binary, so staged and ranged diffs held no hunks for them, and the full-tree scan skipped any buffer with a NUL. A private address inside one was never seen. Diffs now use --text and --no-textconv, and the full-tree scan decodes NUL-bearing files one byte per character instead of skipping them.
A trace keeps the headers of every request, so a failing run left the Basic credential of the sign-in requests in the test output and the HTML report. The setup, teardown, remote and crawl projects now run untraced; the smoke project keeps its failure traces.
A failed not.toContain(password) prints the received string, which here is the stored text holding the password, into the terminal, the HTML report and the error context files. The storage and cookie assertions now compare a boolean and carry a message instead.
The proxy presents the target's own Host, Origin and Referer, so a dev server listening on every interface is a relay to the target for anyone on the network. With API_PROXY naming a target that is not on this machine the default bind is now 127.0.0.1; DEV_HOST remains the explicit override.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the public-content guard and the remote e2e tooling.
--text, and--allno longer skips files with a NUL byte, so a file marked-diffor holding a NUL byte is no longer invisible to the guard.API_PROXYnames a target that is not on this machine;DEV_HOSTis the explicit override. Documented in the README.Tests added for an empty denylist, the hook warning, a NUL-bearing file in
--staged,--alland--range, a-diffattributed markdown file, and the dev host default.