mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-10-02 08:35:07 +08:00
43 lines
1.9 KiB
TypeScript
43 lines
1.9 KiB
TypeScript
/* The loopback network jail the e2e suites give their children: env
|
|
* proxies at a REFUSED loopback port with no_proxy carved out for
|
|
* 127.0.0.1, so the local mock stays reachable and any URL that escapes
|
|
* toward the real internet fails fast at connect time — without ever
|
|
* leaving the machine.
|
|
*
|
|
* What respects it: Node's global fetch (undici) under NODE_USE_ENV_PROXY=1,
|
|
* and scriptc's own fetch implements the same opt-in with relay parity
|
|
* (fetch.test.ts's proxy-optin case) — so the jail is lane-symmetric.
|
|
* Verified for the vercel CLI by capturing `CONNECT api.vercel.com:443`
|
|
* arriving at a loopback stand-in proxy (vercel-e2e.test.ts's beforeAll).
|
|
*
|
|
* What does NOT respect it: raw node:http(s) clients never consult proxy
|
|
* env (the vercel update-check worker's https.get is the live example —
|
|
* neutralized there with NO_UPDATE_NOTIFIER=1). A suite jailing a child
|
|
* with such a path must disable it separately or accept the escape. */
|
|
import { createServer } from "node:http";
|
|
|
|
/** A URL on a loopback port that was just bound and released: connecting
|
|
* to it refuses. */
|
|
export async function refusedLoopbackUrl(): Promise<string> {
|
|
const probe = createServer(() => {});
|
|
await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
|
|
const addr = probe.address();
|
|
if (addr === null || typeof addr !== "object") throw new Error("no probe address");
|
|
const url = `http://127.0.0.1:${addr.port}`;
|
|
await new Promise<void>((resolve) => probe.close(() => resolve()));
|
|
return url;
|
|
}
|
|
|
|
/** The jail's env block, spread into a child's environment. */
|
|
export function jailEnv(refusedUrl: string): Record<string, string> {
|
|
return {
|
|
NODE_USE_ENV_PROXY: "1",
|
|
http_proxy: refusedUrl,
|
|
https_proxy: refusedUrl,
|
|
HTTP_PROXY: refusedUrl,
|
|
HTTPS_PROXY: refusedUrl,
|
|
no_proxy: "127.0.0.1",
|
|
NO_PROXY: "127.0.0.1",
|
|
};
|
|
}
|