Create allow list for urls #4

era commented 2022年10月04日 21:13:38 +02:00

Only allowed urls can be accessed on the plugins. Allow list is per plugin.

Basically on the configuration file for each plugin, users should specify any domain they wish to send requests to. If they try to send a request to a domain which is not specified there, the request should be denied.

For this to work, the Runtime should have the configuration for all the plugins.

Also, today we don't have a way to return error to users, we can just add for now a error field on HttpResponse as a quick workaround or we can modify the response to an object that has the HtthResponse and an error, something like:

record error {
	code: int,
 message: string,
}
record response {
	http: http-response,
 error: error,
}

Otherwise, if result is working for wit-bindgen we can use it: https://github.com/WebAssembly/component-model/blob/main/design/mvp/WIT.md

Only allowed urls can be accessed on the plugins. Allow list is per plugin. Basically on the configuration file for each plugin, users should specify any domain they wish to send requests to. If they try to send a request to a domain which is not specified there, the request should be denied. For this to work, the Runtime should have the configuration for all the plugins. Also, today we don't have a way to return error to users, we can just add for now a error field on HttpResponse as a quick workaround or we can modify the response to an object that has the HtthResponse and an error, something like: ``` record error { code: int, message: string, } record response { http: http-response, error: error, } ``` Otherwise, if result is working for wit-bindgen we can use it: https://github.com/WebAssembly/component-model/blob/main/design/mvp/WIT.md

era commented 2022年10月06日 09:49:22 +02:00

Since 5cb4d15ac6 all methods return Result so we now just have to check if the domain is allowed for the plugin and return an error if otherwise

Since https://codeberg.org/era/databook/commit/5cb4d15ac620f422722a7f650a26cd07408ffbce all methods return Result so we now just have to check if the domain is allowed for the plugin and return an error if otherwise

era commented 2022年10月06日 15:29:53 +02:00

09b598ffc4

https://codeberg.org/era/databook/commit/09b598ffc4000c0ed09df6c4c5ee17354fc74530