errors: remove input from ERR_INVALID_URL message#38614
Closed
moander wants to merge 1 commit intonodejs:masterfrom
Closed
errors: remove input from ERR_INVALID_URL message#38614moander wants to merge 1 commit intonodejs:masterfrom
moander wants to merge 1 commit intonodejs:masterfrom
Conversation
github-actions
bot
added
errors
Member
|
FWIW the input was added to the error in #11934 |
Member
|
@nodejs/url |
jasnell
approved these changes
May 10, 2021
moander
force-pushed
the
patch-2
branch
3 times, most recently
from
cb10e91 to
09df9e4
Compare
TimothyGu
approved these changes
May 11, 2021
joyeecheung
approved these changes
May 11, 2021
joyeecheung
reviewed
May 11, 2021
RaisinTen
reviewed
May 11, 2021
RaisinTen
reviewed
May 11, 2021
lpinca
approved these changes
May 11, 2021
Member
lpinca
left a comment
lpinca
left a comment
There was a problem hiding this comment.
LGTM with the failing test fixed.
Trott
approved these changes
May 12, 2021
RaisinTen
approved these changes
May 12, 2021
Member
RaisinTen
left a comment
RaisinTen
left a comment
There was a problem hiding this comment.
The commit message should be
- errors: removed input from ERR_INVALID_URL message
+ errors: remove input from ERR_INVALID_URL messageas we use an imperative verb (https://github.com/nodejs/node/blob/master/doc/guides/contributing/pull-requests.md#commit-message-guidelines) but this can be fixed while landing.
moander
force-pushed
the
patch-2
branch
2 times, most recently
from
34fc705 to
f7da77c
Compare
RaisinTen
reviewed
May 13, 2021
Avoid potentially huge messages and leaked secrets.
RaisinTen
changed the title
This comment has been minimized.
This comment has been minimized.
RaisinTen
added
the
author ready
Collaborator
Member
|
Landed in 417c31b |
jasnell
pushed a commit
that referenced
this pull request
May 17, 2021
Avoid potentially huge messages and leaked secrets. PR-URL: #38614 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>
targos
pushed a commit
that referenced
this pull request
May 18, 2021
Avoid potentially huge messages and leaked secrets. PR-URL: #38614 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dynamic part in the message, if any, should be the reason explaining why the url is invalid and not the url it self.
Migrating from
url.parse()tonew URL()you may start to seeERR_INVALID_URLerrors in logs and http responses where the message contains the full input url. I decided to propose this change after discovering a secret being exposed. It will produce more compact errors but it may also help avoid user error like this to become a common attack surface during migration to whatwg.ERR_INVALID_URLalso seems to stand out from the other more compact errors found inerrors.jsso I hope this change is welcome.What do you guys think?