miniflare - npm Package Compare versions

Comparing version 3.20231030.1 to 3.20231030.2

dist/src/workers/core/entry.worker.js

@@ -26,2 +26,3 @@ // ../../node_modules/.pnpm/kleur@4.1.5/node_modules/kleur/colors.mjs
   // API Proxy
+  OP_SECRET: "MF-Op-Secret",
   OP: "MF-Op",
@@ -43,3 +44,4 @@ OP_TARGET: "MF-Op-Target",
   DATA_LIVE_RELOAD_SCRIPT: "MINIFLARE_LIVE_RELOAD_SCRIPT",
-  DURABLE_OBJECT_NAMESPACE_PROXY: "MINIFLARE_PROXY"
+  DURABLE_OBJECT_NAMESPACE_PROXY: "MINIFLARE_PROXY",
+  DATA_PROXY_SECRET: "MINIFLARE_PROXY_SECRET"
 }, ProxyOps = {
@@ -161,2 +163,3 @@ // Get the target or a property of the target
 import assert2 from "node:assert";
+import { Buffer as Buffer2 } from "node:buffer";
 
@@ -611,2 +614,6 @@ // ../../node_modules/.pnpm/devalue@4.3.2/node_modules/devalue/src/utils.js
 var ProxyServer = class {
+  constructor(_state, env) {
+    this.env = env;
+    this.heap.set(ProxyAddresses.GLOBAL, globalThis), this.heap.set(ProxyAddresses.ENV, env);
+  }
   nextHeapAddress = ProxyAddresses.USER_START;
@@ -640,5 +647,2 @@ heap = /* @__PURE__ */ new Map();
   nativeReviver = { Native: this.revivers.Native };
-  constructor(_state, env) {
-    this.heap.set(ProxyAddresses.GLOBAL, globalThis), this.heap.set(ProxyAddresses.ENV, env);
-  }
   async fetch(request) {
@@ -656,2 +660,8 @@ try {
   async #fetch(request) {
+    let secretHex = request.headers.get(CoreHeaders.OP_SECRET);
+    if (secretHex == null)
+      return new Response(null, { status: 401 });
+    let expectedSecret = this.env[CoreBindings.DATA_PROXY_SECRET], secretBuffer = Buffer2.from(secretHex, "hex");
+    if (!crypto.subtle.timingSafeEqual(secretBuffer, expectedSecret))
+      return new Response(null, { status: 401 });
     let opHeader = request.headers.get(CoreHeaders.OP), targetHeader = request.headers.get(CoreHeaders.OP_TARGET), keyHeader = request.headers.get(CoreHeaders.OP_KEY), allowAsync = request.headers.get(CoreHeaders.OP_SYNC) === null, argsSizeHeader = request.headers.get(CoreHeaders.OP_STRINGIFIED_SIZE), contentLengthHeader = request.headers.get("Content-Length");
@@ -694,3 +704,3 @@ if (targetHeader === null)
         let originalUrl = request.headers.get(CoreHeaders.ORIGINAL_URL), url = new URL(originalUrl ?? request.url);
-        return request = new Request(url, request), request.headers.delete(CoreHeaders.OP), request.headers.delete(CoreHeaders.OP_TARGET), request.headers.delete(CoreHeaders.OP_KEY), request.headers.delete(CoreHeaders.ORIGINAL_URL), request.headers.delete(CoreHeaders.DISABLE_PRETTY_ERROR), func.call(target, request);
+        return request = new Request(url, request), request.headers.delete(CoreHeaders.OP_SECRET), request.headers.delete(CoreHeaders.OP), request.headers.delete(CoreHeaders.OP_TARGET), request.headers.delete(CoreHeaders.OP_KEY), request.headers.delete(CoreHeaders.ORIGINAL_URL), request.headers.delete(CoreHeaders.DISABLE_PRETTY_ERROR), func.call(target, request);
       }
@@ -697,0 +707,0 @@ let args;

dist/src/workers/shared/index.worker.js

@@ -162,3 +162,4 @@ // src/workers/shared/blob.worker.ts
   MAYBE_SERVICE_BLOBS: "MINIFLARE_BLOBS",
-  MAYBE_SERVICE_LOOPBACK: "MINIFLARE_LOOPBACK"
+  MAYBE_SERVICE_LOOPBACK: "MINIFLARE_LOOPBACK",
+  MAYBE_JSON_ENABLE_CONTROL_ENDPOINTS: "MINIFLARE_ENABLE_CONTROL_ENDPOINTS"
 }, LogLevel = /* @__PURE__ */ ((LogLevel3) => (LogLevel3[LogLevel3.NONE = 0] = "NONE", LogLevel3[LogLevel3.ERROR = 1] = "ERROR", LogLevel3[LogLevel3.WARN = 2] = "WARN", LogLevel3[LogLevel3.INFO = 3] = "INFO", LogLevel3[LogLevel3.DEBUG = 4] = "DEBUG", LogLevel3[LogLevel3.VERBOSE = 5] = "VERBOSE", LogLevel3))(LogLevel || {});
@@ -530,5 +531,7 @@
   async fetch(req) {
-    let controlOp = req?.cf?.miniflare?.controlOp;
-    if (controlOp !== void 0)
-      return this.#handleControlOp(controlOp);
+    if (this.env[SharedBindings.MAYBE_JSON_ENABLE_CONTROL_ENDPOINTS] === !0) {
+      let controlOp = req?.cf?.miniflare?.controlOp;
+      if (controlOp !== void 0)
+        return this.#handleControlOp(controlOp);
+    }
     let name = req.cf?.miniflare?.name;
@@ -535,0 +538,0 @@ assert5(name !== void 0, "Expected `cf.miniflare.name`"), this.#name = name;

dist/src/workers/shared/object-entry.worker.js

@@ -6,3 +6,4 @@ // src/workers/shared/constants.ts
   MAYBE_SERVICE_BLOBS: "MINIFLARE_BLOBS",
-  MAYBE_SERVICE_LOOPBACK: "MINIFLARE_LOOPBACK"
+  MAYBE_SERVICE_LOOPBACK: "MINIFLARE_LOOPBACK",
+  MAYBE_JSON_ENABLE_CONTROL_ENDPOINTS: "MINIFLARE_ENABLE_CONTROL_ENDPOINTS"
 };
@@ -9,0 +10,0 @@

package.json

 {
   "name": "miniflare",
-  "version": "3.20231030.1",
+  "version": "3.20231030.2",
   "description": "Fun, full-featured, fully-local simulator for Cloudflare Workers",
@@ -5,0 +5,0 @@ "keywords": [

No alert changes

Improved metrics

Total package byte prevSize

1493421

increased by0.36%

Lines of code

29779

increased by0.31%

No dependency changes