Skip to content

feat: pre-request sdk object cleanups - INS-3379 - #7150

Closed
ihexxa wants to merge 28 commits into
developfrom
pre-script-sdk-cleanup
Closed

feat: pre-request sdk object cleanups - INS-3379#7150
ihexxa wants to merge 28 commits into
developfrom
pre-script-sdk-cleanup

Conversation

@ihexxa

@ihexxa ihexxa commented Mar 7, 2024

Copy link
Copy Markdown
Contributor

Please review this PR (#7147) firstly as current one is based on it

This one has been broken down to following smaller PRs:

#7170
#7171
#7172
#7173
#7174

Changes:

  • enabled manipulation certificate and proxy through insomnia.request
  • added a test for above
  • added a simple interpolator for replaceIn method
  • other cleanups
  • cover auth transforming in tests
  • add more modules to require
  • introduce eval for compatibility of existing usages
  • organize snippets into categories
  • restart the hidden window if it is down

How to test

Pls run this script and check outputs.

// eval the express and set it
const evalResult = eval('8+8');
insomnia.environment.set('evalResult', evalResult);

// require uuid and generate an id
const uuid = require('uuid');
insomnia.environment.set('uuid', uuid.NIL);

// print current proxy and modify it
console.log(insomnia.request.proxy.getProxyUrl());
insomnia.request.proxy.update({
        host: 'localhost',
        match: '<all_urls>',
        port: 8888,
        tunnel: false,
        authenticate: false,
        username: '',
        password: '',
});

// print current certificate and modify it
// print the original one
console.log('key:', insomnia.request.certificate.key.src);
console.log('cert:', insomnia.request.certificate.cert.src);
console.log('passphrass:', insomnia.request.certificate.passphrass);
console.log('pfx:', insomnia.request.certificate.pfx.src);
// update
insomnia.request.certificate.update({
    disabled: true,
    key: {src: 'invalid.key'},
    cert: {src: 'invalid.cert'},
    passphrase: '',
    pfx: {src: ''},
});

@ihexxa ihexxa self-assigned this Mar 7, 2024
@ihexxa
ihexxa marked this pull request as draft March 7, 2024 13:58

const evalInterceptor = (script: string) => {
invariant(script && typeof script === 'string', 'eval is called with invalid or empty value');
const result = eval(script);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.browser.security.eval-detected.eval-detected

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is as expected as it is used to provide compatibility with existing scripts.

@ihexxa
ihexxa force-pushed the pre-script-sdk-cleanup branch 6 times, most recently from 9d0c981 to 31f573b Compare March 13, 2024 02:36
@ihexxa
ihexxa force-pushed the pre-script-sdk-cleanup branch from db12a9f to 0881b71 Compare March 13, 2024 03:03
@ihexxa

ihexxa commented Mar 27, 2024

Copy link
Copy Markdown
Contributor Author

Most PRs derived from this PR are merged, so closing this one.

@ihexxa ihexxa closed this Mar 27, 2024
@jackkav
jackkav deleted the pre-script-sdk-cleanup branch January 29, 2025 23:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants