mirror of
https://github.com/Ride-The-Lightning/RTL.git
synced 2026-08-13 12:33:07 +02:00
a8baba12bb
request has been deprecated since 2020 with an unfixed SSRF advisory and pins vulnerable copies of form-data (critical), qs, tough-cookie and uuid - 8 of the 13 remaining production audit findings, none fixable by version bumps (issue #1634, item 1). All 36 backend files that imported request-promise now use a small compatibility wrapper (server/utils/request.ts) backed by axios, which is already a production dependency. The wrapper accepts the existing options shape (qs, form - object or pre-encoded string, body, baseUrl/uri, rejectUnauthorized, json), resolves with the response body directly, and rejects with a plain object mirroring request-promise's StatusCodeError/RequestError shape, so CommonService.handleError works unchanged (ECONNREFUSED -> 503, Eclair StatusCodeError -> 500, nested error body extraction). Auth headers are excluded from rejected errors so they cannot leak into logs. Callers without json: true (block explorer, currency rates) still get raw text bodies, and LND's line-delimited /v2/router/send stream still surfaces as a string for the existing parser. Only behavioral code change: CLN verifyMessage used request-promise's callback style and was ported to the same promise style as signMessage; four Eclair handlers gained explicit returns to satisfy noImplicitReturns once the import became typed. Production npm audit drops from 13 findings (2 critical) to 6 low, all in the crypto-browserify/elliptic chain tracked in #1634. Verified against the docker regtest fixture with 43 API checks across LND, Core Lightning and Eclair: reads, invoice creation, a routed LND payment over the streaming endpoint, cross-implementation payments from CLN and Eclair, message sign/verify, channel backup to disk, and bad-invoice/node-unreachable error mapping. Lint and both production builds are clean.
80 lines
3.3 KiB
JavaScript
80 lines
3.3 KiB
JavaScript
import axios from 'axios';
|
|
import * as https from 'https';
|
|
// Drop-in replacement for the deprecated request-promise, backed by axios.
|
|
// Accepts the same options shape used across the controllers ({ url, baseUrl,
|
|
// uri, qs, form, body, headers, rejectUnauthorized, json }), resolves with the
|
|
// response body directly and rejects with a plain, serializable object that
|
|
// mirrors request-promise's StatusCodeError/RequestError shape expected by
|
|
// CommonService.handleError. Auth headers are intentionally excluded from the
|
|
// rejected error so they can never leak into logs or API error responses.
|
|
const insecureAgent = new https.Agent({ rejectUnauthorized: false });
|
|
const buildConfig = (options, method) => {
|
|
const config = {
|
|
url: options.url && options.url !== '' ? options.url : options.uri,
|
|
method: method || options.method || 'GET',
|
|
headers: options.headers ? { ...options.headers } : {}
|
|
};
|
|
if (options.baseUrl) {
|
|
config.baseURL = options.baseUrl;
|
|
}
|
|
if (options.qs && Object.keys(options.qs).length > 0) {
|
|
config.params = options.qs;
|
|
}
|
|
if (options.rejectUnauthorized === false) {
|
|
config.httpsAgent = insecureAgent;
|
|
}
|
|
if (options.form !== null && options.form !== undefined) {
|
|
if (typeof options.form === 'string') {
|
|
// Pre-encoded (or raw JSON string for LND's wallet endpoints), send as-is.
|
|
config.data = options.form;
|
|
}
|
|
else {
|
|
const params = new URLSearchParams();
|
|
Object.entries(options.form).forEach(([key, value]) => {
|
|
if (value !== null && value !== undefined) {
|
|
params.append(key, String(value));
|
|
}
|
|
});
|
|
config.data = params;
|
|
}
|
|
config.headers['Content-Type'] = 'application/x-www-form-urlencoded';
|
|
}
|
|
else if (options.body !== null && options.body !== undefined) {
|
|
config.data = options.body;
|
|
}
|
|
if (options.json !== true) {
|
|
// Callers without json: true (block explorer, currency rates) JSON.parse the body themselves.
|
|
config.responseType = 'text';
|
|
config.transformResponse = [(data) => data];
|
|
}
|
|
return config;
|
|
};
|
|
const toRequestPromiseError = (err, config) => {
|
|
const errOptions = { url: config.url, method: config.method };
|
|
if (err.response) {
|
|
return {
|
|
name: 'StatusCodeError',
|
|
statusCode: err.response.status,
|
|
message: err.response.status + ' - ' + JSON.stringify(err.response.data),
|
|
error: err.response.data,
|
|
options: errOptions
|
|
};
|
|
}
|
|
const message = err.message && err.message !== '' ? err.message : err.code;
|
|
return {
|
|
name: 'RequestError',
|
|
message: message,
|
|
error: { code: err.code, message: message },
|
|
options: errOptions
|
|
};
|
|
};
|
|
const call = (options, method) => {
|
|
const config = buildConfig(options, method);
|
|
return axios.request(config).then((response) => response.data).catch((err) => Promise.reject(toRequestPromiseError(err, config)));
|
|
};
|
|
const request = (options) => call(options);
|
|
request.get = (options) => call(options, 'GET');
|
|
request.post = (options) => call(options, 'POST');
|
|
request.put = (options) => call(options, 'PUT');
|
|
request.delete = (options) => call(options, 'DELETE');
|
|
export default request;
|