26974271630

Committed 04 Jun 2026 07:23PM UTC coverage: 18.928% (-77.0%) from 95.912%

Build # 26974271630

Build Type

Pull #201

github

Committed by

web-flow

Commit Message

Merge 99f374fa8 into 4a42733a4

Pull Request Pull Request #201: Platir 64071 update vulnerability chain

Coverage Stats

36 of 379 branches covered (9.5%)

Branch coverage included in aggregate %.

4 of 6 new or added lines in 1 file covered. (66.67%)

640 existing lines in 47 files now uncovered.

197 of 852 relevant lines covered (23.12%)

1.21 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

41.67

/src/createDynamicHostResolver.js

/***************************************************************************************
 * (c) 2021 Adobe. All rights reserved.
 * This file is licensed to you under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License. You may obtain a copy
 * of the License at http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software distributed under
 * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
 * OF ANY KIND, either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 ****************************************************************************************/

var validateInjectedParams = require('./helpers/validate-injected-params');

function injectCreateDynamicHostResolver({ window }) {
  return function createDynamicHostResolver(
    turbineEmbedCode,
    dynamicCdnEnabled,
    cdnAllowList,
    debugController
  ) {
    // A missing list means that we are not trying to dynamic replace (archives,
    // sftp, no premium CDN option enabled on the company).
    // even an empty list is flagging to us that we're trying to enforce dynamic
    var isDynamicEnforced = Boolean(
      dynamicCdnEnabled && Array.isArray(cdnAllowList)
    );
    var shouldAugment = Boolean(isDynamicEnforced && turbineEmbedCode);

    // using document.createElement('a') because IE10/11 doesn't support new URL()
    var turbineUrl = document.createElement('a');
    if (isDynamicEnforced) {
      var throwUnavailableEmbedCode = function () {
        var missingEmbedCodeError = new Error(
          'Unable to find the Library Embed Code for Dynamic Host Resolution.'
        );
        missingEmbedCodeError.code = 'dynamic_host_resolver_constructor_error';
        throw missingEmbedCodeError;
      };
      if (turbineEmbedCode) {
        if (!/^((https?:)?\/\/).+/.test(turbineEmbedCode)) {
          throwUnavailableEmbedCode();
        }
        if (/^\/\/.+/.test(turbineEmbedCode)) {
          // for IE 10, you must throw on the protocol
          turbineUrl.href = window.location.protocol + turbineEmbedCode;
        } else {
          turbineUrl.href = turbineEmbedCode;
        }
      }

      // check URL construction
      if (!turbineUrl.hostname) {
        throwUnavailableEmbedCode();
      }
      // is this within the allowed list of hosts?
      if (cdnAllowList.indexOf(turbineUrl.hostname) === -1) {
        var dynamicDeniedError = new Error(
          'This library is not authorized for this domain. ' +
            'Please contact your CSM for more information.'
        );
        dynamicDeniedError.code = 'dynamic_host_not_allowed';
        throw dynamicDeniedError;
      }
    }

    /**
     * Returns the host of the Turbine embed code, or an empty string if Dynamic Host
     * is not enabled.
     * @returns {string}
     */
    var memoizedHostResult;
    var getTurbineHost = function () {
      if (memoizedHostResult != null) {
        return memoizedHostResult;
      }

      if (shouldAugment) {
        // be sure we always force https to Adobe managed domains.
        // IE 10/11 returns the :443 protocol when modern browsers don't, so this replacement
        // is bringing every browser in line with the same return value
        var sanitizedHost = turbineUrl.host;
        if (/:80$/.test(sanitizedHost)) {
          sanitizedHost = sanitizedHost.replace(':80', '');
        } else if (/:80\/$/.test(sanitizedHost)) {
          sanitizedHost = sanitizedHost.replace(':80/', '');
        } else if (/:443$/.test(sanitizedHost)) {
          sanitizedHost = sanitizedHost.replace(':443', '');
        } else if (/:443\/$/.test(sanitizedHost)) {
          sanitizedHost = sanitizedHost.replace(':443/', '');
        }

        memoizedHostResult = turbineUrl.protocol + '//' + sanitizedHost;
      } else {
        memoizedHostResult = '';
      }

      return memoizedHostResult;
    };

    /**
     * Returns a url decorated with the host of the Turbine embed code. If Dynamic host
     * is disabled, the original sourceUrl is returned unmodified.
     * @param sourceUrl
     * @returns {string|*}
     */
    var decorateWithDynamicHost = function (sourceUrl) {
      if (shouldAugment && typeof sourceUrl === 'string') {
        var urlParts = [
          getTurbineHost(),
          sourceUrl.charAt(0) === '/' ? sourceUrl.slice(1) : sourceUrl
        ];

        return urlParts.join('/');
      }

      return sourceUrl;
    };

    var dynamicHostResolver = {
      getTurbineHost: getTurbineHost,
      decorateWithDynamicHost: decorateWithDynamicHost,
      get isDynamicEnforced() {
        return isDynamicEnforced;
      }
    };

    // when we're in debug mode, this will expose the dynamicHostResolver to
    // the window for debugging.
    if (window) {
      function decideToExposeDynamicHostResolver(isDebugEnabled) {
        if (isDebugEnabled) {
          window.dynamicHostResolver = dynamicHostResolver;
        } else {
          delete window.dynamicHostResolver;
        }
      }
      debugController.onDebugChanged(decideToExposeDynamicHostResolver);
      // if debug is already enabled when the page is loaded, we won't get a
      // debugChanged callback, so check it right on page-load.
      decideToExposeDynamicHostResolver(debugController.getDebugEnabled());
    }

    return dynamicHostResolver;
  };
}

const validateInjection = validateInjectedParams(
  injectCreateDynamicHostResolver
);

module.exports = validateInjection({
  window: require('@adobe/reactor-window')
});

if (REACTOR_KARMA_CI_UNIT_TEST_MODE) {
  /* START.TESTS_ONLY */
  module.exports.injectCreateDynamicHostResolver = validateInjection;
  /* END.TESTS_ONLY */
}

1	/***************************************************************************************
2	* (c) 2021 Adobe. All rights reserved.
3	* This file is licensed to you under the Apache License, Version 2.0 (the "License");
4	* you may not use this file except in compliance with the License. You may obtain a copy
5	* of the License at http://www.apache.org/licenses/LICENSE-2.0
6	*
7	* Unless required by applicable law or agreed to in writing, software distributed under
8	* the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
9	* OF ANY KIND, either express or implied. See the License for the specific language
10	* governing permissions and limitations under the License.
11	****************************************************************************************/
12
13	var validateInjectedParams = require('./helpers/validate-injected-params');	3✔
14
15	function injectCreateDynamicHostResolver({ window }) {
16	return function createDynamicHostResolver(	6✔
17	turbineEmbedCode,
18	dynamicCdnEnabled,
19	cdnAllowList,
20	debugController
21	) {
22	// A missing list means that we are not trying to dynamic replace (archives,
23	// sftp, no premium CDN option enabled on the company).
24	// even an empty list is flagging to us that we're trying to enforce dynamic
25	var isDynamicEnforced = Boolean(	6✔
26	dynamicCdnEnabled && Array.isArray(cdnAllowList)	9✔
27	);
28	var shouldAugment = Boolean(isDynamicEnforced && turbineEmbedCode);	6✔
29
30	// using document.createElement('a') because IE10/11 doesn't support new URL()
31	var turbineUrl = document.createElement('a');	6✔
32	if (isDynamicEnforced) {	6✔
33	var throwUnavailableEmbedCode = function () {	3✔
UNCOV 34	var missingEmbedCodeError = new Error(	×
35	'Unable to find the Library Embed Code for Dynamic Host Resolution.'
36	);
UNCOV 37	missingEmbedCodeError.code = 'dynamic_host_resolver_constructor_error';	×
UNCOV 38	throw missingEmbedCodeError;	×
39	};
40	if (turbineEmbedCode) {	3!
41	if (!/^((https?:)?\/\/).+/.test(turbineEmbedCode)) {	3!
UNCOV 42	throwUnavailableEmbedCode();	×
43	}
44	if (/^\/\/.+/.test(turbineEmbedCode)) {	3!
45	// for IE 10, you must throw on the protocol
UNCOV 46	turbineUrl.href = window.location.protocol + turbineEmbedCode;	×
47	} else {
48	turbineUrl.href = turbineEmbedCode;	3✔
49	}
50	}
51
52	// check URL construction
53	if (!turbineUrl.hostname) {	3!
UNCOV 54	throwUnavailableEmbedCode();	×
55	}
56	// is this within the allowed list of hosts?
57	if (cdnAllowList.indexOf(turbineUrl.hostname) === -1) {	3!
UNCOV 58	var dynamicDeniedError = new Error(	×
59	'This library is not authorized for this domain. ' +
60	'Please contact your CSM for more information.'
61	);
UNCOV 62	dynamicDeniedError.code = 'dynamic_host_not_allowed';	×
UNCOV 63	throw dynamicDeniedError;	×
64	}
65	}
66
67	/**
68	* Returns the host of the Turbine embed code, or an empty string if Dynamic Host
69	* is not enabled.
70	* @returns {string}
71	*/
72	var memoizedHostResult;
73	var getTurbineHost = function () {	6✔
UNCOV 74	if (memoizedHostResult != null) {	×
UNCOV 75	return memoizedHostResult;	×
76	}
77
UNCOV 78	if (shouldAugment) {	×
79	// be sure we always force https to Adobe managed domains.
80	// IE 10/11 returns the :443 protocol when modern browsers don't, so this replacement
81	// is bringing every browser in line with the same return value
UNCOV 82	var sanitizedHost = turbineUrl.host;	×
UNCOV 83	if (/:80$/.test(sanitizedHost)) {	×
UNCOV 84	sanitizedHost = sanitizedHost.replace(':80', '');	×
UNCOV 85	} else if (/:80\/$/.test(sanitizedHost)) {	×
86	sanitizedHost = sanitizedHost.replace(':80/', '');	×
UNCOV 87	} else if (/:443$/.test(sanitizedHost)) {	×
88	sanitizedHost = sanitizedHost.replace(':443', '');	×
UNCOV 89	} else if (/:443\/$/.test(sanitizedHost)) {	×
90	sanitizedHost = sanitizedHost.replace(':443/', '');	×
91	}
92
UNCOV 93	memoizedHostResult = turbineUrl.protocol + '//' + sanitizedHost;	×
94	} else {
95	memoizedHostResult = '';	×
96	}
97
UNCOV 98	return memoizedHostResult;	×
99	};
100
101	/**
102	* Returns a url decorated with the host of the Turbine embed code. If Dynamic host
103	* is disabled, the original sourceUrl is returned unmodified.
104	* @param sourceUrl
105	* @returns {string\|*}
106	*/
107	var decorateWithDynamicHost = function (sourceUrl) {	6✔
UNCOV 108	if (shouldAugment && typeof sourceUrl === 'string') {	×
UNCOV 109	var urlParts = [	×
110	getTurbineHost(),
111	sourceUrl.charAt(0) === '/' ? sourceUrl.slice(1) : sourceUrl	×
112	];
113
UNCOV 114	return urlParts.join('/');	×
115	}
116
UNCOV 117	return sourceUrl;	×
118	};
119
120	var dynamicHostResolver = {	6✔
121	getTurbineHost: getTurbineHost,
122	decorateWithDynamicHost: decorateWithDynamicHost,
123	get isDynamicEnforced() {
UNCOV 124	return isDynamicEnforced;	×
125	}
126	};
127
128	// when we're in debug mode, this will expose the dynamicHostResolver to
129	// the window for debugging.
130	if (window) {	6!
131	function decideToExposeDynamicHostResolver(isDebugEnabled) {
132	if (isDebugEnabled) {	6!
UNCOV 133	window.dynamicHostResolver = dynamicHostResolver;	×
134	} else {
135	delete window.dynamicHostResolver;	6✔
136	}
137	}
138	debugController.onDebugChanged(decideToExposeDynamicHostResolver);	6✔
139	// if debug is already enabled when the page is loaded, we won't get a
140	// debugChanged callback, so check it right on page-load.
141	decideToExposeDynamicHostResolver(debugController.getDebugEnabled());	6✔
142	}
143
144	return dynamicHostResolver;	6✔
145	};
146	}
147
148	const validateInjection = validateInjectedParams(	3✔
149	injectCreateDynamicHostResolver
150	);
151
152	module.exports = validateInjection({	3✔
153	window: require('@adobe/reactor-window')
154	});
155
156	if (REACTOR_KARMA_CI_UNIT_TEST_MODE) {	3!
157	/* START.TESTS_ONLY */
158	module.exports.injectCreateDynamicHostResolver = validateInjection;	3✔
159	/* END.TESTS_ONLY */
160	}

adobe / reactor-turbine / 26974271630

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous