fix(init): only send GITHUB_TOKEN to github hosts

Author: danielroe

packages/nuxt-cli/src/utils/starter-templates.ts

@@ -22,16 +22,36 @@ export interface TemplateData {
 tar: string
 }
 
-constfetchOptions={
-// A proxy CONNECT plus TLS handshake on a corporate link regularly costs more
-// than 3s. The template list is prefetched and has a static fallback, so a
-// slightly longer deadline only ever delays the prompt on a broken network.
-timeout: 5000,
-headers: {
-'user-agent': '@nuxt/cli',
- ...process.env.GITHUB_TOKEN ? {authorization: `token ${process.env.GITHUB_TOKEN}`} : {},
-},
-}asconst
+constGITHUB_HOSTS=newSet(['api.github.com','github.com','raw.githubusercontent.com','objects.githubusercontent.com'])
+
+/**
+ * Whether `url` is a GitHub host the `GITHUB_TOKEN` may be sent to. The listing
+ * response chooses the download URLs, so the token follows the host allowlist
+ * rather than the response.
+ */
+functionisGitHubURL(url: string): boolean{
+try{
+constparsed=newURL(url)
+returnparsed.protocol==='https:'&&GITHUB_HOSTS.has(parsed.hostname)
+}
+catch{
+returnfalse
+}
+}
+
+exportfunctionfetchOptionsFor(url: string){
+consttoken=process.env.GITHUB_TOKEN
+return{
+// A proxy CONNECT plus TLS handshake on a corporate link regularly costs more
+// than 3s. The template list is prefetched and has a static fallback, so a
+// slightly longer deadline only ever delays the prompt on a broken network.
+timeout: 5000,
+headers: {
+'user-agent': '@nuxt/cli',
+ ...token&&isGitHubURL(url) ? {authorization: `token ${token}`} : {},
+},
+}
+}
 
 exportconstTEMPLATES_API_URL='https://api.github.com/repos/nuxt/starter/contents/templates?ref=templates'
 
@@ -43,23 +63,27 @@ export async function getTemplates() {
 }
 
 exportasyncfunctionfetchTemplates(){
-consttemplates={}asRecord<string,TemplateData>
+consttemplates=Object.create(null)asRecord<string,TemplateData>
 
 constfiles=awaitfetchJson<Array<{name: string,type: string,download_url?: string}>>(
 TEMPLATES_API_URL,
-fetchOptions,
+fetchOptionsFor(TEMPLATES_API_URL),
 )
 
+if(!Array.isArray(files)){
+returntemplates
+}
+
 awaitPromise.all(files.map(async(file)=>{
-if(!file.download_url||file.type!=='file'||!file.name.endsWith('.json')){
+if(!file?.download_url||file.type!=='file'||typeoffile.name!=='string'||!file.name.endsWith('.json')){
 return
 }
 consttemplateName=file.name.replace('.json','')
-if(hiddenTemplates.includes(templateName)){
+if(hiddenTemplates.includes(templateName)||!isGitHubURL(file.download_url)){
 return
 }
 templates[templateName]=undefinedasunknownasTemplateData
-templates[templateName]=awaitfetchJson<TemplateData>(file.download_url,fetchOptions)
+templates[templateName]=awaitfetchJson<TemplateData>(file.download_url,fetchOptionsFor(file.download_url))
 }))
 
 returntemplates

packages/nuxt-cli/test/unit/utils/starter-templates.spec.ts

@@ -1,7 +1,9 @@
+importprocessfrom'node:process'
+
 import{afterEach,describe,expect,it,vi}from'vitest'
 
 import{describeNetworkError}from'../../../src/utils/network'
-import{fetchTemplates,TEMPLATES_API_URL}from'../../../src/utils/starter-templates'
+import{fetchOptionsFor,fetchTemplates,TEMPLATES_API_URL}from'../../../src/utils/starter-templates'
 
 functionrespondAfter(delay: number){
 returnvi.fn((url: string|URL|Request,init?: RequestInit)=>{
@@ -12,7 +14,7 @@ function respondAfter(delay: number) {
 // the host rather than a substring, which any URL could contain anywhere.
 constisListing=newURL(urlinstanceofRequest ? url.url : String(url)).host==='api.github.com'
 constbody=isListing
- ? [{name: 'minimal.json',type: 'file',download_url: 'https://raw.example.com/minimal.json'}]
+ ? [{name: 'minimal.json',type: 'file',download_url: 'https://raw.githubusercontent.com/nuxt/starter/templates/templates/minimal.json'}]
  : {name: 'minimal',description: 'Minimal starter',defaultDir: 'nuxt-app',url: '',tar: ''}
 
 returnnewPromise<Response>((resolve,reject)=>{
@@ -57,3 +59,58 @@ describe('fetchTemplates', () => {
 expect(describeNetworkError(error,TEMPLATES_API_URL)).toContain('timed out')
 },15_000)
 })
+
+describe('github token handling',()=>{
+consttoken=process.env.GITHUB_TOKEN
+
+afterEach(()=>{
+vi.unstubAllGlobals()
+if(token===undefined){
+deleteprocess.env.GITHUB_TOKEN
+}
+else{
+process.env.GITHUB_TOKEN=token
+}
+})
+
+it('should send the token to github and to nowhere else',()=>{
+process.env.GITHUB_TOKEN='secret-token'
+
+expect(fetchOptionsFor(TEMPLATES_API_URL).headers).toHaveProperty('authorization','token secret-token')
+expect(fetchOptionsFor('https://evil.example.com/minimal.json').headers).not.toHaveProperty('authorization')
+expect(fetchOptionsFor('http://api.github.com/x').headers).not.toHaveProperty('authorization')
+expect(fetchOptionsFor('https://api.github.com.evil.example.com/x').headers).not.toHaveProperty('authorization')
+})
+
+it('should skip a template whose download url is not on github',async()=>{
+process.env.GITHUB_TOKEN='secret-token'
+constrequested: string[]=[]
+vi.stubGlobal('fetch',vi.fn((url: string|URL|Request)=>{
+consthref=urlinstanceofRequest ? url.url : String(url)
+requested.push(href)
+constbody=href===TEMPLATES_API_URL
+ ? [{name: 'evil.json',type: 'file',download_url: 'https://evil.example.com/evil.json'}]
+ : {name: 'evil',description: '',defaultDir: 'nuxt-app',url: '',tar: ''}
+returnPromise.resolve(newResponse(JSON.stringify(body),{headers: {'content-type': 'application/json'}}))
+}))
+
+awaitexpect(fetchTemplates()).resolves.toEqual({})
+expect(requested).toEqual([TEMPLATES_API_URL])
+})
+
+it('should not let a template name reach the prototype',async()=>{
+vi.stubGlobal('fetch',vi.fn((url: string|URL|Request)=>{
+consthref=urlinstanceofRequest ? url.url : String(url)
+constbody=href===TEMPLATES_API_URL
+ ? [{name: '__proto__.json',type: 'file',download_url: 'https://raw.githubusercontent.com/nuxt/starter/templates/templates/__proto__.json'}]
+ : {polluted: true}
+returnPromise.resolve(newResponse(JSON.stringify(body),{headers: {'content-type': 'application/json'}}))
+}))
+
+consttemplates=awaitfetchTemplates()
+
+expect(({}asRecord<string,unknown>).polluted).toBeUndefined()
+expect(Object.getPrototypeOf(templates)).toBeNull()
+expect(Object.hasOwn(templates,'__proto__')).toBe(true)
+})
+})