Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const validate = ({ element, resource, response }: FetchEnd) => {
const defaultValidators: Validator[] = [
validateNameAndValue,
validatePrefixes,
validateSecurityAttributes,
validateExpireDate,
validateMaxAgeAndExpires
];
// This check does not apply if URI starts with protocols others than http/https.
if (!isRegularProtocol(resource)) {
debug(`Check does not apply for URI: ${resource}`);
return;
}
const rawSetCookieHeaders: string | string[] = response.headers && response.headers['set-cookie'] || '';
if (!rawSetCookieHeaders) {
return;
}
/** The `chrome` connector concatenates all `set-cookie` headers to one string. */
const setCookieHeaders: string[] = Array.isArray(rawSetCookieHeaders) ? rawSetCookieHeaders : rawSetCookieHeaders.split(/\n|\r\n/);
const reportBatch = (errorMessages: ValidationMessages, codeLanguage: CodeLanguage, codeSnippet: string) => {
errorMessages.forEach(({ message, severity }) => {
const validate = async ({ element, resource, response }: FetchEnd, eventName: string) => {
const shouldCheckIfCompressedWith: CompressionCheckOptions = eventName === 'fetch::end::html' ? htmlOptions : resourceOptions;
/*
* We shouldn't validate error responses, and 204 (response with no body).
* Also some sites return body with 204 status code and that breaks `request`:
* https://github.com/request/request/issues/2669
*/
if (response.statusCode !== 200) {
return;
}
// It doesn't make sense for things that are not served over http(s)
if (!isRegularProtocol(resource)) {
return;
}
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
/*
* Check if this is a special case, and if it is, do the
* specific checks, but ignore all the checks that follow.
*/
if (await isSpecialCase(resource, element, response)) {
return;
}
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
context.report(
resource,
message,
{ element: appleTouchIcon, severity: Severity.error });
return;
}
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
/*
* The following checks don't make sense for non-HTTP(S).
*/
if (!isRegularProtocol(resource)) {
return;
}
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
/*
* If `href` exists and is not an empty string, try
* to figure out the full URL of the `apple-touch-icon`.
*/
const appleTouchIconURL = appleTouchIcon.resolveUrl(appleTouchIconHref);
// - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
let networkData: NetworkData;
const elementHrefHasRequiredProtocol = (element: HTMLElement): boolean => {
const hrefValue: string = element.getAttribute('href') || '';
return isRegularProtocol(hrefValue);
};
* `data:image/png;base64` and there won't be
* any descriptor as there are no spaces.
*
* The `data` will be the next item in `candidates`.
* Because data URIs don't have to be checked
* the next item can be skipped
*/
if (imageCandidate.startsWith('data:image')) {
i++;
continue;
}
const imageCandidateUrl = element.resolveUrl(imageCandidate.trim());
if (isRegularProtocol(imageCandidateUrl)) {
urls.push(imageCandidateUrl);
continue;
}
}
return urls;
};
const validate = async ({ element, resource, response }: FetchEnd) => {
if (!isRegularProtocol(resource)) {
debug(`Check does not apply for non HTTP(s) URIs`);
return;
}
const headerValue: string = normalizeString(response.headers && response.headers['strict-transport-security']);
if (!isHTTPS(resource) && headerValue) {
const message = getMessage('noOverHTTP', context.language);
context.report(resource, message, {
codeLanguage: 'http',
codeSnippet: `Strict-Transport-Security: ${headerValue}`,
element,
severity: Severity.warning
});
private async initiate(target: URL) {
if (!isRegularProtocol(target.href)) {
const error = new Error(`Target protocol is not valid (is ${target.protocol})`);
(error as any).type = 'InvalidTarget';
throw error;
}
const { browser, page } = await launch(this._options);
this._browser = browser;
this._page = page;
}