decentraland / deployments-to-sqs / 27715858908

90%

push

github

fix: validate content servers and entity ids against a content-server allowlist (#526)

mirror the asset-bundle-converter ssrf hardening (issue #306) at the
producer:

- fail fast at startup if CONTENT_SERVER_URLS contains a host that is not
  on the allowlist (sourced from the required ALLOWED_CONTENT_SERVER_HOSTS
  env var, set per-env in the definitions repo, with known defaults in
  .env.default).
- drop deployments whose entityId is not a bare cid before it reaches the
  storage layer, with a new entity_skipped_invalid_id metric.

related to decentraland/asset-bundle-converter#306

43 of 58 branches covered (74.14%)

Branch coverage included in aggregate %.

35 of 38 new or added lines in 3 files covered. (92.11%)

249 of 268 relevant lines covered (92.91%)

3.5 hits per line