Skip to content

Deprecate "back" magic string in redirects - #5935

Merged
blakeembrey merged 2 commits into
expressjs:4.xfrom
blakeembrey:be/deprecate-back-string
Sep 11, 2024
Merged

Deprecate "back" magic string in redirects#5935
blakeembrey merged 2 commits into
expressjs:4.xfrom
blakeembrey:be/deprecate-back-string

Conversation

@blakeembrey

@blakeembreyblakeembrey commented Sep 10, 2024

Copy link
Copy Markdown
Member

Related to #5933, deprecates this and directs users to read security best practices for open redirects.

@blakeembrey
blakeembrey requested a review from a teamSeptember 10, 2024 03:35
@blakeembreyblakeembrey changed the title Deprecate back magic stringDeprecate "back" magic string in redirectsSep 10, 2024
LinusU
LinusU approved these changes Sep 11, 2024
View reviewed changes

@LinusULinusU left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great! 👍

@wesleytodd

wesleytodd commented Sep 11, 2024

Copy link
Copy Markdown
Member

We are preparing a release to fix some mis-aligned versions. Do we want to ship this deprecation as well?

@blakeembrey
blakeembrey changed the base branch from master to 4.xSeptember 11, 2024 18:55
@blakeembrey

blakeembrey commented Sep 11, 2024

Copy link
Copy Markdown
MemberAuthor

Yes, I think we should. Changed the base, feel free to merge.

@blakeembrey

blakeembrey commented Sep 11, 2024

Copy link
Copy Markdown
MemberAuthor

The only question is whether you'd prefer I use a link shortener instead? That way we can change the URL if docs move around.

@wesleytodd

wesleytodd commented Sep 11, 2024

Copy link
Copy Markdown
Member

Hm, yeah I guess that makes sense. We can always add a html redirect page at that url if we wanted. Do you want to use the link shortener you used for the path to regex ones?

@blakeembrey

blakeembrey commented Sep 11, 2024

Copy link
Copy Markdown
MemberAuthor

Done, I'm just using dub.co but they only support git.new for GitHub URLs, so it's dub.sh for this one. We can buy a custom short domain if we care a lot about this too, or alias a sub-domain of the existing express domain later.

@wesleytodd

wesleytodd commented Sep 11, 2024

Copy link
Copy Markdown
Member

Sounds good to me, we good to merge this?

@blakeembrey
blakeembrey merged commit 77ada90 into expressjs:4.xSep 11, 2024
@blakeembrey
blakeembrey deleted the be/deprecate-back-string branch September 11, 2024 19:24
aviator-appBot referenced this pull request in nordic-game-lab/ad-server Sep 11, 2024
@aviator-app
Update dependency express to v4.21.0 (#24)
b885ac2
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [express](http://expressjs.com/) ([source](https://redirect.github.com/expressjs/express)) | [`4.20.0` -> `4.21.0`](https://renovatebot.com/diffs/npm/express/4.20.0/4.21.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>expressjs/express (express)</summary>
### [`v4.21.0`](https://redirect.github.com/expressjs/express/releases/tag/4.21.0)
[Compare Source](https://redirect.github.com/expressjs/express/compare/4.20.0...4.21.0)
#### What's Changed
- Deprecate `"back"` magic string in redirects by [@&#8203;blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5935](https://redirect.github.com/expressjs/express/pull/5935)
- finalhandler@1.3.1 by [@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5954](https://redirect.github.com/expressjs/express/pull/5954)
- fix(deps): serve-static@1.16.2 by [@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5951](https://redirect.github.com/expressjs/express/pull/5951)
- Upgraded dependency qs to 6.13.0 to match qs in body-parser by [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) in [https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
#### New Contributors
- [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) made their first contribution in [https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
**Full Changelog**: expressjs/express@4.20.0...4.21.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/nordic-game-lab/ad-server).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC43NC4xIiwidXBkYXRlZEluVmVyIjoiMzguNzQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21lcmdlIl19-->
This was referenced Sep 11, 2024
Open
Open
Open
aviator-appBot referenced this pull request in nordic-game-lab/advertising-sdk Sep 12, 2024
@aviator-app
Update dependency express to v4.21.0 (#27)
685d3ec
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [express](http://expressjs.com/) ([source](https://redirect.github.com/expressjs/express)) | [`4.20.0` -> `4.21.0`](https://renovatebot.com/diffs/npm/express/4.20.0/4.21.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) |
---
### Release Notes
<details>
<summary>expressjs/express (express)</summary>
### [`v4.21.0`](https://redirect.github.com/expressjs/express/releases/tag/4.21.0)
[Compare Source](https://redirect.github.com/expressjs/express/compare/4.20.0...4.21.0)
#### What's Changed
- Deprecate `"back"` magic string in redirects by [@&#8203;blakeembrey](https://redirect.github.com/blakeembrey) in [https://github.com/expressjs/express/pull/5935](https://redirect.github.com/expressjs/express/pull/5935)
- finalhandler@1.3.1 by [@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5954](https://redirect.github.com/expressjs/express/pull/5954)
- fix(deps): serve-static@1.16.2 by [@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in [https://github.com/expressjs/express/pull/5951](https://redirect.github.com/expressjs/express/pull/5951)
- Upgraded dependency qs to 6.13.0 to match qs in body-parser by [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) in [https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
#### New Contributors
- [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) made their first contribution in [https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
**Full Changelog**: expressjs/express@4.20.0...4.21.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/nordic-game-lab/advertising-sdk).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC43NC4xIiwidXBkYXRlZEluVmVyIjoiMzguNzQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21lcmdlIl19-->
renovateBot referenced this pull request in line/line-bot-sdk-nodejs Sep 12, 2024
@renovate
Update dependency express to v4.21.0 (#964)
52bc71a
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [express](http://expressjs.com/)
([source](https://redirect.github.com/expressjs/express)) | [`4.20.0` ->
`4.21.0`](https://renovatebot.com/diffs/npm/express/4.20.0/4.21.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
---
### Release Notes
<details>
<summary>expressjs/express (express)</summary>
###
[`v4.21.0`](https://redirect.github.com/expressjs/express/releases/tag/4.21.0)
[Compare
Source](https://redirect.github.com/expressjs/express/compare/4.20.0...4.21.0)
#### What's Changed
- Deprecate `"back"` magic string in redirects by
[@&#8203;blakeembrey](https://redirect.github.com/blakeembrey) in
[https://github.com/expressjs/express/pull/5935](https://redirect.github.com/expressjs/express/pull/5935)
- finalhandler@1.3.1 by
[@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in
[https://github.com/expressjs/express/pull/5954](https://redirect.github.com/expressjs/express/pull/5954)
- fix(deps): serve-static@1.16.2 by
[@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in
[https://github.com/expressjs/express/pull/5951](https://redirect.github.com/expressjs/express/pull/5951)
- Upgraded dependency qs to 6.13.0 to match qs in body-parser by
[@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) in
[https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
#### New Contributors
- [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) made
their first contribution in
[https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
**Full Changelog**:
expressjs/express@4.20.0...4.21.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/line/line-bot-sdk-nodejs).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC43NC4xIiwidXBkYXRlZEluVmVyIjoiMzguNzQuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJkZXBlbmRlbmN5IHVwZ3JhZGUiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This was referenced Sep 12, 2024
Open
Open
Open
Open
patricebender referenced this pull request in cap-js/cds-dbs Sep 12, 2024
@renovate
chore(deps): update dependency express to v4.21.0 (#807)
99a12f3
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [express](http://expressjs.com/)
([source](https://redirect.github.com/expressjs/express)) | [`4.20.0` ->
`4.21.0`](https://renovatebot.com/diffs/npm/express/4.20.0/4.21.0) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/express/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express/4.20.0/4.21.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
---
### Release Notes
<details>
<summary>expressjs/express (express)</summary>
###
[`v4.21.0`](https://redirect.github.com/expressjs/express/releases/tag/4.21.0)
[Compare
Source](https://redirect.github.com/expressjs/express/compare/4.20.0...4.21.0)
#### What's Changed
- Deprecate `"back"` magic string in redirects by
[@&#8203;blakeembrey](https://redirect.github.com/blakeembrey) in
[https://github.com/expressjs/express/pull/5935](https://redirect.github.com/expressjs/express/pull/5935)
- finalhandler@1.3.1 by
[@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in
[https://github.com/expressjs/express/pull/5954](https://redirect.github.com/expressjs/express/pull/5954)
- fix(deps): serve-static@1.16.2 by
[@&#8203;wesleytodd](https://redirect.github.com/wesleytodd) in
[https://github.com/expressjs/express/pull/5951](https://redirect.github.com/expressjs/express/pull/5951)
- Upgraded dependency qs to 6.13.0 to match qs in body-parser by
[@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) in
[https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
#### New Contributors
- [@&#8203;agadzinski93](https://redirect.github.com/agadzinski93) made
their first contribution in
[https://github.com/expressjs/express/pull/5946](https://redirect.github.com/expressjs/express/pull/5946)
**Full Changelog**:
expressjs/express@4.20.0...4.21.0
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/cap-js/cds-dbs).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC43NC4xIiwidXBkYXRlZEluVmVyIjoiMzguNzQuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This was referenced Sep 12, 2024
Closed
Closed
Closed
@sachinthapa572sachinthapa572 mentioned this pull request Nov 11, 2024
Merged
@PugChungusPugChungus mentioned this pull request Nov 11, 2024
Open
@miwashimiwashi mentioned this pull request Nov 11, 2024
Open
@jaebelle1jaebelle1 mentioned this pull request Nov 11, 2024
Open
@mog-rnmog-rn mentioned this pull request Nov 11, 2024
Open
@BenDrKoBenDrKo mentioned this pull request Nov 11, 2024
Open
@MikeTeddyOmondiMikeTeddyOmondi mentioned this pull request Nov 11, 2024
Open
@rish2497rish2497 mentioned this pull request Nov 11, 2024
Open
@HyunMinHHyunMinH mentioned this pull request Nov 11, 2024
Open
@regreavesregreaves mentioned this pull request Nov 11, 2024
Open
@Kritune-DevKritune-Dev mentioned this pull request Nov 12, 2024
Open
@WatercloneWaterclone mentioned this pull request Nov 12, 2024
Open
@Emmanuel97423Emmanuel97423 mentioned this pull request Nov 12, 2024
Open
@surajit03surajit03 mentioned this pull request Nov 12, 2024
Open
@ManuelDevWebManuelDevWeb mentioned this pull request Nov 12, 2024
Open
@BriceLgsBriceLgs mentioned this pull request Nov 12, 2024
Open
@Dmitry-WhiteDmitry-White mentioned this pull request Nov 12, 2024
Open
@ali8889ali8889 mentioned this pull request Nov 12, 2024
Open
@BackinR2D2BackinR2D2 mentioned this pull request Nov 12, 2024
Open
@etherio97etherio97 mentioned this pull request Nov 12, 2024
Open
@reinaldoalmeidareinaldoalmeida mentioned this pull request Nov 12, 2024
Open
@pizzahutmachinepizzahutmachine mentioned this pull request Nov 12, 2024
Open
@NOUIYNOUIY mentioned this pull request Nov 12, 2024
Open
@eriklopesseriklopess mentioned this pull request Nov 13, 2024
Open
@pradumchintamanipradumchintamani mentioned this pull request Nov 13, 2024
Open
@paladinmansouripaladinmansouri mentioned this pull request Nov 13, 2024
Open
@LeoMuchukiLeoMuchuki mentioned this pull request Nov 13, 2024
Open
This was referenced Nov 13, 2024
Open
Open
@DariusZdrobaDariusZdroba mentioned this pull request Aug 5, 2025
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LinusULinusULinusU approved these changes
@wesleytoddwesleytoddwesleytodd approved these changes
@UlisesGasconUlisesGasconUlisesGascon approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@blakeembrey@wesleytodd@LinusU@UlisesGascon