update electron to v43

electron/node_modules/builder-util-runtime/out/httpExecutor.js

@@ -1,22 +1,60 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.safeStringifyJson = exports.configureRequestOptions = exports.safeGetHeader = exports.DigestTransform = exports.configureRequestUrl = exports.configureRequestOptionsFromUrl = exports.HttpExecutor = exports.parseJson = exports.HttpError = exports.createHttpError = void 0;
+exports.DigestTransform = exports.HttpExecutor = exports.HttpError = void 0;
+exports.addSensitiveRedirectHeader = addSensitiveRedirectHeader;
+exports.addSensitiveFieldPattern = addSensitiveFieldPattern;
+exports.createHttpError = createHttpError;
+exports.parseJson = parseJson;
+exports.configureRequestOptionsFromUrl = configureRequestOptionsFromUrl;
+exports.configureRequestUrl = configureRequestUrl;
+exports.safeGetHeader = safeGetHeader;
+exports.configureRequestOptions = configureRequestOptions;
+exports.isSensitiveFieldName = isSensitiveFieldName;
+exports.hashSensitiveValue = hashSensitiveValue;
+exports.safeStringifyJson = safeStringifyJson;
 const crypto_1 = require("crypto");
 const debug_1 = require("debug");
 const fs_1 = require("fs");
 const stream_1 = require("stream");
 const url_1 = require("url");
 const CancellationToken_1 = require("./CancellationToken");
-const index_1 = require("./index");
+const error_1 = require("./error");
 const ProgressCallbackTransform_1 = require("./ProgressCallbackTransform");
-const debug = debug_1.default("electron-builder");
+const debug = (0, debug_1.default)("electron-builder");
+// ── Sensitive-data registries ────────────────────────────────────────────────
+// Normalise a header or field name: lowercase + strip all separators (- and _).
+// Shared by both registries so lookup is always separator-agnostic.
+const normalizeName = (name) => name.toLowerCase().replace(/[-_]/g, "");
+// HTTP header names (normalised) stripped on cross-origin redirects.
+// Stored normalised; lookup normalises the incoming key with normalizeName().
+const SENSITIVE_REDIRECT_HEADERS = new Set(["authorization", "proxyauthorization", "privatetoken", "xapikey", "xauthtoken", "xaccesstoken", "xgitlabtoken", "cookie", "xcsrftoken"]);
+// Substrings: a field name containing any of these (after normalization) is redacted.
+const SENSITIVE_FIELD_PATTERNS = ["token", "password", "secret", "authorization", "credential", "apikey", "passphrase", "auth"];
+// Suffixes: a field name ending with any of these (after normalization) is redacted.
+// Intentionally greedy — "publicKey" is also stripped; over-stripping debug logs is
+// acceptable, under-stripping a credential is not.
+const SENSITIVE_FIELD_SUFFIXES = ["key"];
+/**
+ * Register an additional HTTP header to strip on cross-origin redirects.
+ * Intended for custom publishers (e.g. GenericPublisher with a non-standard auth header).
+ */
+function addSensitiveRedirectHeader(header) {
+    SENSITIVE_REDIRECT_HEADERS.add(normalizeName(header));
+}
+/**
+ * Register an additional substring pattern used by {@link safeStringifyJson} to
+ * identify sensitive field names. Input is normalized (lowercased, separators stripped).
+ * Intended for custom publishers that store credentials under non-standard field names.
+ */
+function addSensitiveFieldPattern(pattern) {
+    SENSITIVE_FIELD_PATTERNS.push(pattern.toLowerCase().replace(/[-_]/g, ""));
+}
 function createHttpError(response, description = null) {
     return new HttpError(response.statusCode || -1, `${response.statusCode} ${response.statusMessage}` +
         (description == null ? "" : "\n" + JSON.stringify(description, null, "  ")) +
         "\nHeaders: " +
         safeStringifyJson(response.headers), description);
 }
-exports.createHttpError = createHttpError;
 const HTTP_STATUS_CODES = new Map([
     [429, "Too many requests"],
     [400, "Bad request"],
@@ -48,7 +86,6 @@ exports.HttpError = HttpError;
 function parseJson(result) {
     return result.then(it => (it == null || it.length === 0 ? null : JSON.parse(it)));
 }
-exports.parseJson = parseJson;
 class HttpExecutor {
     constructor() {
         this.maxRedirects = 10;
@@ -58,7 +95,9 @@ class HttpExecutor {
         const json = data == null ? undefined : JSON.stringify(data);
         const encodedData = json ? Buffer.from(json) : undefined;
         if (encodedData != null) {
-            debug(json);
+            if (debug.enabled) {
+                debug(safeStringifyJson(data));
+            }
             const { headers, ...opts } = options;
             options = {
                 method: "post",
@@ -74,7 +113,8 @@ class HttpExecutor {
     }
     doApiRequest(options, cancellationToken, requestProcessor, redirectCount = 0) {
         if (debug.enabled) {
-            debug(`Request: ${safeStringifyJson(options)}`);
+            const { headers: _headers, auth: _auth, ...safeOptions } = options;
+            debug(`Request: ${safeStringifyJson(safeOptions)}`);
         }
         return cancellationToken.createPromise((resolve, reject, onCancel) => {
             const request = this.createRequest(options, (response) => {
@@ -108,7 +148,8 @@ class HttpExecutor {
     handleResponse(response, options, cancellationToken, resolve, reject, redirectCount, requestProcessor) {
         var _a;
         if (debug.enabled) {
-            debug(`Response: ${response.statusCode} ${response.statusMessage}, request options: ${safeStringifyJson(options)}`);
+            const { headers: _headers, auth: _auth, ...safeOptions } = options;
+            debug(`Response: ${response.statusCode} ${response.statusMessage}, request options: ${safeStringifyJson(safeOptions)}`);
         }
         // we handle any other >= 400 error on request end (read detailed message in the response body)
         if (response.statusCode === 404) {
@@ -147,7 +188,7 @@ Please double check that your authentication token is correct. Due to security r
                     reject(createHttpError(response, `method: ${options.method || "GET"} url: ${options.protocol || "https:"}//${options.hostname}${options.port ? `:${options.port}` : ""}${options.path}
 
           Data:
-          ${isJson ? JSON.stringify(JSON.parse(data)) : data}
+          ${isJson ? safeStringifyJson(JSON.parse(data)) : data}
           `));
                 }
                 else {
@@ -161,7 +202,7 @@ Please double check that your authentication token is correct. Due to security r
     }
     async downloadToBuffer(url, options) {
         return await options.cancellationToken.createPromise((resolve, reject, onCancel) => {
-            let result = null;
+            const responseChunks = [];
             const requestOptions = {
                 headers: options.headers || undefined,
                 // because PrivateGitHubProvider requires HttpExecutor.prepareRedirectUrlOptions logic, so, we need to redirect manually
@@ -175,49 +216,24 @@ Please double check that your authentication token is correct. Due to security r
                 onCancel,
                 callback: error => {
                     if (error == null) {
-                        resolve(result);
+                        resolve(Buffer.concat(responseChunks));
                     }
                     else {
                         reject(error);
                     }
                 },
                 responseHandler: (response, callback) => {
-                    const contentLength = safeGetHeader(response, "content-length");
-                    let position = -1;
-                    if (contentLength != null) {
-                        const size = parseInt(contentLength, 10);
-                        if (size > 0) {
-                            if (size > 524288000) {
-                                callback(new Error("Maximum allowed size is 500 MB"));
-                                return;
-                            }
-                            result = Buffer.alloc(size);
-                            position = 0;
-                        }
-                    }
+                    let receivedLength = 0;
                     response.on("data", (chunk) => {
-                        if (position !== -1) {
-                            chunk.copy(result, position);
-                            position += chunk.length;
-                        }
-                        else if (result == null) {
-                            result = chunk;
-                        }
-                        else {
-                            if (result.length > 524288000) {
-                                callback(new Error("Maximum allowed size is 500 MB"));
-                                return;
-                            }
-                            result = Buffer.concat([result, chunk]);
+                        receivedLength += chunk.length;
+                        if (receivedLength > 524288000) {
+                            callback(new Error("Maximum allowed size is 500 MB"));
+                            return;
                         }
+                        responseChunks.push(chunk);
                     });
                     response.on("end", () => {
-                        if (result != null && position !== -1 && position !== result.length) {
-                            callback(new Error(`Received data length ${position} is not equal to expected ${result.length}`));
-                        }
-                        else {
-                            callback(null);
-                        }
+                        callback(null);
                     });
                 },
             }, 0);
@@ -270,21 +286,71 @@ Please double check that your authentication token is correct. Due to security r
     static prepareRedirectUrlOptions(redirectUrl, options) {
         const newOptions = configureRequestOptionsFromUrl(redirectUrl, { ...options });
         const headers = newOptions.headers;
-        if (headers === null || headers === void 0 ? void 0 : headers.authorization) {
-            const parsedNewUrl = new url_1.URL(redirectUrl);
-            if (parsedNewUrl.hostname.endsWith(".amazonaws.com") || parsedNewUrl.searchParams.has("X-Amz-Credential")) {
-                delete headers.authorization;
+        if (headers == null) {
+            return newOptions;
+        }
+        const originalUrl = HttpExecutor.reconstructOriginalUrl(options);
+        const parsedRedirectUrl = parseUrl(redirectUrl, options);
+        if (HttpExecutor.isCrossOriginRedirect(originalUrl, parsedRedirectUrl)) {
+            if (debug.enabled) {
+                debug(`Cross-origin redirect (${originalUrl.host} → ${parsedRedirectUrl.host}): stripping sensitive headers`);
+            }
+            for (const key of Object.keys(headers)) {
+                if (SENSITIVE_REDIRECT_HEADERS.has(normalizeName(key))) {
+                    delete headers[key];
+                }
             }
         }
         return newOptions;
     }
-    static retryOnServerError(task, maxRetries = 3) {
+    static reconstructOriginalUrl(options) {
+        const protocol = options.protocol || "https:";
+        if (!options.hostname) {
+            throw new Error("Missing hostname in request options");
+        }
+        const hostname = options.hostname;
+        const port = options.port ? `:${options.port}` : "";
+        const path = options.path || "/";
+        return new url_1.URL(`${protocol}//${hostname}${port}${path}`);
+    }
+    static isCrossOriginRedirect(originalUrl, redirectUrl) {
+        // Case-insensitive hostname comparison
+        if (originalUrl.hostname.toLowerCase() !== redirectUrl.hostname.toLowerCase()) {
+            return true;
+        }
+        // Special case: allow http -> https redirect on same host with standard ports
+        // This matches the behavior of Python requests library for backward compatibility
+        // url.port returns an empty string if the port is omitted
+        // or explicitly set to the default port for a given protocol.
+        if (originalUrl.protocol === "http:" &&
+            // This can be replaced with `!originalUrl.port`, but for the sake of clarity.
+            ["80", ""].includes(originalUrl.port) &&
+            redirectUrl.protocol === "https:" &&
+            // This can be replaced with `!redirectUrl.port`, but for the sake of clarity.
+            ["443", ""].includes(redirectUrl.port)) {
+            return false;
+        }
+        // According to RFC 7235, a change in protocol or port constitutes a cross-origin request.
+        // Forwarding authentication headers to a different origin can be a security risk.
+        // For example, https://example.com:443 and http://example.com:80 are different origins.
+        // We only make an exception for HTTP -> HTTPS upgrades on standard ports for backward compatibility.
+        // Strip auth on any other protocol change
+        if (originalUrl.protocol !== redirectUrl.protocol) {
+            return true;
+        }
+        // Strip auth on port change (accounting for default ports)
+        const originalPort = originalUrl.port;
+        const redirectPort = redirectUrl.port;
+        return originalPort !== redirectPort;
+    }
+    static async retryOnServerError(task, maxRetries = 3) {
         for (let attemptNumber = 0;; attemptNumber++) {
             try {
-                return task();
+                return await task();
             }
             catch (e) {
                 if (attemptNumber < maxRetries && ((e instanceof HttpError && e.isServerError()) || e.code === "EPIPE")) {
+                    await new Promise(r => setTimeout(r, 1000 * (attemptNumber + 1)));
                     continue;
                 }
                 throw e;
@@ -293,12 +359,26 @@ Please double check that your authentication token is correct. Due to security r
     }
 }
 exports.HttpExecutor = HttpExecutor;
+function parseUrl(url, options) {
+    try {
+        // Would throw exception if url is not absolute
+        return new url_1.URL(url);
+    }
+    catch {
+        // Relative URL - construct base URL from original options
+        const hostname = options.hostname;
+        const protocol = options.protocol || "https:";
+        const port = options.port ? `:${options.port}` : "";
+        const baseUrl = `${protocol}//${hostname}${port}`;
+        return new url_1.URL(url, baseUrl);
+    }
+}
 function configureRequestOptionsFromUrl(url, options) {
     const result = configureRequestOptions(options);
-    configureRequestUrl(new url_1.URL(url), result);
+    const parsedUrl = parseUrl(url, options);
+    configureRequestUrl(parsedUrl, result);
     return result;
 }
-exports.configureRequestOptionsFromUrl = configureRequestOptionsFromUrl;
 function configureRequestUrl(url, options) {
     options.protocol = url.protocol;
     options.hostname = url.hostname;
@@ -310,8 +390,11 @@ function configureRequestUrl(url, options) {
     }
     options.path = url.pathname + url.search;
 }
-exports.configureRequestUrl = configureRequestUrl;
 class DigestTransform extends stream_1.Transform {
+    // noinspection JSUnusedGlobalSymbols
+    get actual() {
+        return this._actual;
+    }
     constructor(expected, algorithm = "sha512", encoding = "base64") {
         super();
         this.expected = expected;
@@ -319,11 +402,7 @@ class DigestTransform extends stream_1.Transform {
         this.encoding = encoding;
         this._actual = null;
         this.isValidateOnEnd = true;
-        this.digester = crypto_1.createHash(algorithm);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    get actual() {
-        return this._actual;
+        this.digester = (0, crypto_1.createHash)(algorithm);
     }
     // noinspection JSUnusedGlobalSymbols
     _transform(chunk, encoding, callback) {
@@ -346,10 +425,10 @@ class DigestTransform extends stream_1.Transform {
     }
     validate() {
         if (this._actual == null) {
-            throw index_1.newError("Not finished yet", "ERR_STREAM_NOT_FINISHED");
+            throw (0, error_1.newError)("Not finished yet", "ERR_STREAM_NOT_FINISHED");
         }
         if (this._actual !== this.expected) {
-            throw index_1.newError(`${this.algorithm} checksum mismatch, expected ${this.expected}, got ${this._actual}`, "ERR_CHECKSUM_MISMATCH");
+            throw (0, error_1.newError)(`${this.algorithm} checksum mismatch, expected ${this.expected}, got ${this._actual}`, "ERR_CHECKSUM_MISMATCH");
         }
         return null;
     }
@@ -375,7 +454,6 @@ function safeGetHeader(response, headerKey) {
         return value;
     }
 }
-exports.safeGetHeader = safeGetHeader;
 function configurePipes(options, response) {
     if (!checkSha2(safeGetHeader(response, "X-Checksum-Sha2"), options.options.sha2, options.callback)) {
         return;
@@ -394,7 +472,7 @@ function configurePipes(options, response) {
     else if (options.options.sha2 != null) {
         streams.push(new DigestTransform(options.options.sha2, "sha256", "hex"));
     }
-    const fileOut = fs_1.createWriteStream(options.destination);
+    const fileOut = (0, fs_1.createWriteStream)(options.destination);
     streams.push(fileOut);
     let lastStream = response;
     for (const stream of streams) {
@@ -433,21 +511,19 @@ function configureRequestOptions(options, token, method) {
     }
     return options;
 }
-exports.configureRequestOptions = configureRequestOptions;
+function isSensitiveFieldName(name) {
+    const normalized = normalizeName(name);
+    return SENSITIVE_FIELD_PATTERNS.some(p => normalized.includes(p)) || SENSITIVE_FIELD_SUFFIXES.some(s => normalized.endsWith(s));
+}
+function hashSensitiveValue(value) {
+    return `${(0, crypto_1.createHash)("sha256").update(value).digest("hex")} (sha256 hash)`;
+}
 function safeStringifyJson(data, skippedNames) {
     return JSON.stringify(data, (name, value) => {
-        if (name.endsWith("Authorization") ||
-            name.endsWith("authorization") ||
-            name.endsWith("Password") ||
-            name.endsWith("PASSWORD") ||
-            name.endsWith("Token") ||
-            name.includes("password") ||
-            name.includes("token") ||
-            (skippedNames != null && skippedNames.has(name))) {
-            return "<stripped sensitive data>";
+        if (isSensitiveFieldName(name) || (skippedNames != null && skippedNames.has(name))) {
+            return typeof value === "string" ? hashSensitiveValue(value) : "<stripped sensitive data>";
         }
         return value;
     }, 2);
 }
-exports.safeStringifyJson = safeStringifyJson;
 //# sourceMappingURL=httpExecutor.js.map