semantic-release / semantic-release/gitlab

NO_PROXY implementation is incomplete

Open
#830 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature help wanted
Dominant language
JavaScript
Stars
344
Forks
89
Avg merge
16h 11m
Merged PRs (30d)
4

Description

The function shouldProxy was
// Copied from Rob Wu's great proxy-from-env library: https://github.com/Rob--W/proxy-from-env/blob/96d01f8fcfdccfb776735751132930bbf79c4a3a/index.js#L62

Sadly the implementation is incomplete and misses many use cases.
There is a great page at:

https://about.gitlab.com/blog/2021/01/27/we-need-to-talk-no-proxy/

Which gives a good discussion about NO_PROXY and the issues that have arisen from it. Rob Wu's implementation suffers many problems the article discusses.

For example given:

export HTTP_PROXY=something
export HTTPS_PROXY=something
export NO_PROXY=subdomain.domain.com

A gitlab server at gitlab.subdomain.domain.com would not bypass the proxy as the block:

    if (!/^[.*]/.test(parsedProxyHostname)) {
      // No wildcards, so stop proxying if there is an exact match.
      return hostname !== parsedProxyHostname;
    }

Would do a comparison:

if(!/^[.*]/.test(subdomain.domain.com)){
   return gitlab.subdomain.domain.com !== subdomain.domain.com
}

resulting in a true response and hence the gitlab server being pushed through to the proxy.
Often proxies do not allow access to internal services hence this results in errors occurring in the semantic-release/gitlab plugin:

[12:06:30 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/gitlab"
[12:06:30 AM] [semantic-release] [@semantic-release/gitlab] › ℹ  Verify GitLab authentication (https://gitlab.subdomain.domain.com/api/v4)
[12:06:30 AM] [semantic-release] › ✘  Failed step "verifyConditions" of plugin "@semantic-release/gitlab"
[12:06:30 AM] [semantic-release] › ✘  An error occurred while running semantic-release: RequestError: Bad response: 403

This bug report is to request a fix to the shouldProxy method to correctly handle NO_PROXY values which list [sub]domains without wild cards.

It seems the proxy-from-env still has the bug, but with the core code not being maintained for 5 years, and even nodejs commenting that it was incomplete when they implemented NO_PROXY support, the recommendation would be to either update the existing code base or convert the codebase to use an alternative library.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with shouldProxy in lib/resolve-config.js around the linked lines, then read the GitLab NO_PROXY discussion and the proxy-from-env reference. The fix is complete when the subdomain example and the other NO_PROXY cases described by the issue bypass the proxy correctly, with relevant behavior covered by tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.