segmentio / segmentio/analytics.js-integrations
Force https protocol in load-script when running on file: url (e.g., Electron)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 125
- Forks
- 136
- Avg merge
- 2h 45m
- Merged PRs (30d)
- 1
Description
The AppCues integration (and a few others) use the loadScript with a protocol relative url:
This sets the protocol to http if running loading via a file: url.
https://github.com/segmentio/load-script/blob/master/index.js#L27-L33
We are loading Segment into an Electron app, which loads pages via a file: url. However, we do not want to allow non-https external connections.
Is there a way around this? One idea would be to change the logic in loadScript to default to https instead of http in the file: url case.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with integrations/appcues/lib/index.js at the linked loadScript call, then read load-script/index.js lines 27-33 to understand the file: URL handling. Done means loading from an Electron file: URL no longer permits the unwanted non-HTTPS external connection; check any existing coverage around this behavior if present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, javascript
- Domain
- desktop-dev, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100