feat: add security.allowedRemoteOrigins#4692
Open
2heal1 wants to merge 3 commits intomodule-federation:mainfrom
Open
feat: add security.allowedRemoteOrigins#46922heal1 wants to merge 3 commits intomodule-federation:mainfrom
2heal1 wants to merge 3 commits intomodule-federation:mainfrom
Conversation
🦋 Changeset detectedLatest commit: 543aea9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 45 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
✅ Deploy Preview for module-federation-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
@module-federation/devtools
@module-federation/cli
create-module-federation
@module-federation/data-prefetch
@module-federation/dts-plugin
@module-federation/enhanced
@module-federation/error-codes
@module-federation/esbuild
@module-federation/managers
@module-federation/manifest
@module-federation/metro
@module-federation/metro-plugin-rnc-cli
@module-federation/metro-plugin-rnef
@module-federation/modern-js
@module-federation/modern-js-v3
@module-federation/native-federation-tests
@module-federation/native-federation-typescript
@module-federation/nextjs-mf
@module-federation/node
@module-federation/retry-plugin
@module-federation/rsbuild-plugin
@module-federation/rspack
@module-federation/rspress-plugin
@module-federation/runtime
@module-federation/runtime-core
@module-federation/runtime-tools
@module-federation/sdk
@module-federation/storybook-addon
@module-federation/third-party-dts-extractor
@module-federation/treeshake-frontend
@module-federation/treeshake-server
@module-federation/typescript
@module-federation/utilities
@module-federation/webpack-bundler-runtime
@module-federation/bridge-react
@module-federation/bridge-react-webpack-plugin
@module-federation/bridge-shared
@module-federation/bridge-vue3
@module-federation/inject-external-runtime-core-plugin
commit: |
Contributor
Bundle Size Report19 package(s) changed, 21 unchanged. Package dist + ESM entry
Bundle targets
Consumer scenarios
Total dist (raw): 6.35 MB (+23.2 kB (+0.4%)) Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95fbbeaadf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+37
to
+39
| entryUrl.startsWith('//') || | ||
| entryUrl.startsWith('http://') || | ||
| entryUrl.startsWith('https://'); |
There was a problem hiding this comment.
parseNetworkRemoteUrl only classifies inputs as network URLs when they start with lowercase http://, https://, or //. URL schemes are case-insensitive, so an entry like HTTP://evil.example/remoteEntry.js parses and loads as HTTP but returns undefined here, causing assertRemoteOriginAllowed to skip enforcement and allowing security.allowedRemoteOrigins to be bypassed for those inputs.
Useful? React with 👍 / 👎.
Comment on lines
+411
to
+413
| if (allowedRemoteOrigins && allowedRemoteOrigins.length) { | ||
| assertRemoteOriginAllowed(remoteInfo.entry, allowedRemoteOrigins); | ||
| } |
There was a problem hiding this comment.
getRemoteEntry validates remoteInfo.entry before checking the remoteEntryExports fast path and before any getEntryUrl rewrite is applied, so flows that depend on URL rewriting (for example retry-domain rotation via getEntryUrl in packages/retry-plugin/src/script-retry.ts) are rejected on the original URL even when the rewritten URL would be allowed. This also throws for callers that already provide remoteEntryExports and do not need a network fetch.
Useful? React with 👍 / 👎.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
add an optional remote origin allowlist for remote entry loading without changing the default behavior
Related Issue
Types of changes
Checklist