errors: remove input from ERR_INVALID_URL message #38614
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
errors
|
FWIW the input was added to the error in #11934 |
|
@nodejs/url |
jasnell
approved these changes
May 10, 2021
moander
force-pushed
the
patch-2
branch
3 times, most recently
from
cb10e91
to
09df9e4
Compare
TimothyGu
approved these changes
May 11, 2021
joyeecheung
approved these changes
May 11, 2021
joyeecheung
reviewed
May 11, 2021
RaisinTen
reviewed
May 11, 2021
RaisinTen
reviewed
May 11, 2021
lpinca
approved these changes
May 11, 2021
Trott
approved these changes
May 12, 2021
RaisinTen
approved these changes
May 12, 2021
There was a problem hiding this comment.
The commit message should be
- errors: removed input from ERR_INVALID_URL message
+ errors: remove input from ERR_INVALID_URL messageas we use an imperative verb (https://github.com/nodejs/node/blob/master/doc/guides/contributing/pull-requests.md#commit-message-guidelines) but this can be fixed while landing.
moander
force-pushed
the
patch-2
branch
2 times, most recently
from
34fc705
to
f7da77c
Compare
RaisinTen
reviewed
May 13, 2021
Avoid potentially huge messages and leaked secrets.
RaisinTen
changed the title
This comment has been minimized.
This comment has been minimized.
RaisinTen
added
the
author ready
|
Landed in 417c31b |
jasnell
pushed a commit
that referenced
this pull request
May 17, 2021
Avoid potentially huge messages and leaked secrets. PR-URL: #38614 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tiancheng "Timothy" Gu <[email protected]> Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Darshan Sen <[email protected]>
targos
pushed a commit
that referenced
this pull request
May 18, 2021
Avoid potentially huge messages and leaked secrets. PR-URL: #38614 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tiancheng "Timothy" Gu <[email protected]> Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Darshan Sen <[email protected]>
2 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The dynamic part in the message, if any, should be the reason explaining why the url is invalid and not the url it self.
Migrating from
url.parse()tonew URL()you may start to seeERR_INVALID_URLerrors in logs and http responses where the message contains the full input url. I decided to propose this change after discovering a secret being exposed. It will produce more compact errors but it may also help avoid user error like this to become a common attack surface during migration to whatwg.ERR_INVALID_URLalso seems to stand out from the other more compact errors found inerrors.jsso I hope this change is welcome.What do you guys think?