| 1 | /** Hosts the importer downloads release assets from: GitHub's, plus an optional GitHub Enterprise host. */ |
| 2 | const IMPORT_HOSTS = ["github.com", "api.github.com", "objects.githubusercontent.com", "release-assets.githubusercontent.com"]; |
| 3 | |
| 4 | export function importHostAllowed(host: string, gheHost?: string): boolean { |
| 5 | const h = host.toLowerCase().replace(/\.$/, ""); |
| 6 | const ghe = gheHost?.trim().toLowerCase(); |
| 7 | return IMPORT_HOSTS.includes(h) || (!!ghe && h === ghe); |
| 8 | } |
| 9 | |
| 10 | /** |
| 11 | * The headers to keep when a redirect leaves the original host: only plain |
| 12 | * content negotiation. Authorization, cookies, tokens and anything else that |
| 13 | * could carry a credential are dropped. |
| 14 | */ |
| 15 | export function withoutCredentials(headers: Record<string, string>): Record<string, string> { |
| 16 | const keep = new Set(["accept", "accept-encoding", "accept-language", "user-agent", "x-github-api-version"]); |
| 17 | return Object.fromEntries(Object.entries(headers).filter(([k]) => keep.has(k.toLowerCase()))); |
| 18 | } |