Repository navigation
fix(online): allow configuring the raw repository base - #30
Conversation
The online commands hard-code raw.githubusercontent.com for the public SUSTech Online Markdown. On networks where that host is unreachable, every online command fails with NETWORK_ERROR even though the rendered site is available. Resolve the raw base from SUSTECH_ONLINE_RAW_BASE (HTTPS, no query or fragment), defaulting to the current public repository URL. The allowlist origin and path are derived from the same base, so exact URL matching and redirect rejection remain enforced. Add tests for the default, a mirror override, invalid values, and import-time resolution, and document the variable in docs/ONLINE.md.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
|
Thanks @FortuneCatOfSummer — this is a clean fix for a real pain point on networks that cannot reach Follow-up: as you noted in #29, |
* fix(calendar): allow configuring the raw repository base The calendar client still hard-codes raw.githubusercontent.com, so `calendar day` and `tis schedule` fail on networks where that host is unreachable even after the online layer became configurable. Extract the HTTPS base resolution shared with the online layer and add SUSTECH_CALENDAR_RAW_BASE, defaulting to the public calendar repository. Values must be plain HTTPS URLs without a query or fragment; invalid values fail with CALENDAR_RAW_BASE_INVALID. Also make the online default-base test hermetic when SUSTECH_ONLINE_RAW_BASE is set in the caller's environment, and document both variables in the README. Refs #29, #30. * fix(core): reject credentials in configured raw bases A base URL such as https://user:token@mirror.example/repo would send the embedded secret to the mirror. Reject any URL with userinfo so SUSTECH_CALENDAR_RAW_BASE and SUSTECH_ONLINE_RAW_BASE cannot smuggle credentials into requests. Cover both resolvers with tests and update the README and online docs.
Summary
SUSTECH_ONLINE_RAW_BASE, defaultingto
https://raw.githubusercontent.com/SUSTech-CRA/sustech-online-ng/masterURL matching and redirect rejection remain unchanged
ONLINE_RAW_BASE_INVALIDdocs/ONLINE.mdCloses #29
Why
On networks that cannot reach
raw.githubusercontent.com, everyonlinecommand fails with
NETWORK_ERRORwhilesustech.onlinestays reachable.0.13.0 offers no way to point the raw reads at a mirror.
Behaviour
SUSTECH_ONLINE_RAW_BASE=https://ghfast.top/https://raw.githubusercontent.com/SUSTech-CRA/sustech-online-ng/master:raw reads go through the mirror; the allowlist accepts exactly the
constructed URL.
ONLINE_RAW_BASE_INVALIDinstead ofsilently reading another source.
Tests
npm run checknpm test— newsrc/test/online-raw-base.test.tscovers the default, amirror override, trailing-slash/whitespace trimming, invalid values, and
import-time resolution.
(
EPERM: symlink); the other 484 tests pass, including 38 online-relatedtests.
Security
Redirects are still rejected (
redirect: "error") and the final URL must matchthe constructed target exactly. The allowlist is derived from the configured
base rather than a second hard-coded host.