refactor: extract parseUrlPatterns from ssl-bump.ts into domain-patterns.ts#4946
Conversation
parseUrlPatterns from ssl-bump.ts into domain-patterns.ts
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (4 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Refactors URL glob→regex parsing (parseUrlPatterns) out of src/ssl-bump.ts into src/domain-patterns.ts so SSL key-material logic and domain/URL pattern utilities are separated, with call sites and tests updated accordingly.
Changes:
- Moved
parseUrlPatterns(andURL_CHAR_PATTERN) fromssl-bump.tsintodomain-patterns.ts. - Updated
config-writer.tsto importparseUrlPatternsfromdomain-patterns.tswhile keeping SSL primitives inssl-bump.ts. - Relocated and updated unit tests/mocks to reflect the new module boundary.
Show a summary per file
| File | Description |
|---|---|
| src/ssl-bump.ts | Removes URL pattern parsing utilities to keep module focused on SSL key-material management. |
| src/domain-patterns.ts | Adds parseUrlPatterns alongside other domain/pattern utilities. |
| src/config-writer.ts | Updates imports to pull URL parsing from domain-patterns.ts. |
| src/ssl-bump.test.ts | Removes the parseUrlPatterns test suite from SSL bump tests. |
| src/domain-patterns.test.ts | Adds parseUrlPatterns tests to the domain/pattern test suite. |
| src/config-writer.test.ts | Updates mocks to mock parseUrlPatterns from ./domain-patterns instead of ./ssl-bump. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 2
| // Pattern constant for the safer URL character class (matches the implementation) | ||
| const URL_CHAR_PATTERN = '[^\\s]*'; | ||
|
|
||
| describe('parseUrlPatterns', () => { | ||
| it('should escape regex special characters except wildcards', () => { | ||
| const patterns = parseUrlPatterns(['https://github.com/user']); | ||
| expect(patterns).toEqual(['^https://github\\.com/user$']); | ||
| }); | ||
|
|
||
| it('should convert * wildcard to safe regex pattern', () => { | ||
| const patterns = parseUrlPatterns(['https://github.com/myorg/*']); | ||
| expect(patterns).toEqual([`^https://github\\.com/myorg/${URL_CHAR_PATTERN}`]); | ||
| }); | ||
|
|
||
| it('should handle multiple wildcards', () => { | ||
| const patterns = parseUrlPatterns(['https://api-*.example.com/*']); | ||
| expect(patterns).toEqual([`^https://api-${URL_CHAR_PATTERN}\\.example\\.com/${URL_CHAR_PATTERN}`]); | ||
| }); |
| // Preserve existing .* patterns by using a placeholder before escaping | ||
| const WILDCARD_PLACEHOLDER = '\x00WILDCARD\x00'; | ||
| p = p.replace(/\.\*/g, WILDCARD_PLACEHOLDER); | ||
|
|
||
| // Escape regex special characters except * | ||
| p = p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'); | ||
|
|
||
| // Convert * wildcards to safe pattern (prevents ReDoS) | ||
| p = p.replace(/\*/g, URL_CHAR_PATTERN); | ||
|
|
||
| // Restore preserved patterns from placeholder | ||
| p = p.replace(new RegExp(WILDCARD_PLACEHOLDER, 'g'), URL_CHAR_PATTERN); | ||
|
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
• GitHub API connectivity: ✅ Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: PASS
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Hostname wildcards (e.g., api-* in https://api-*.example.com/path) now use [^\s/]* instead of [^\s]*, preventing them from matching '/' and crossing into the path portion. Path wildcards continue to use [^\s]*. This prevents a security issue where https://api-*.example.com/* could match https://api-evil.attacker.com/.example.com/anything. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
🔬 Smoke Test Results — FAIL
PR: refactor: extract Overall: FAIL — pre-step outputs (
|
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASSTest Results:
Mode: Direct BYOK ( cc:
|
|
Merged PRs:
✅ GitHub browser check Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: ❌ Tests did not pass — Python and Node.js versions differ between host and chroot environments.
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL —
|
Smoke Test: Copilot PAT Auth — Results
Overall: FAIL — pre-step outputs ( Auth mode: PAT (COPILOT_GITHUB_TOKEN)
|
Smoke Test Results: Gemini Engine Validation
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
|
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall: PASS
|
parseUrlPatterns(URL glob→regex conversion) had no dependency on SSL primitives yet lived inssl-bump.ts, alongside CA/key-material management. This moves it todomain-patterns.tswhere its siblings (wildcardToRegex,parseDomainWithProtocol,validateDomainOrPattern) already live.Changes
src/ssl-bump.ts— removeparseUrlPatternsandURL_CHAR_PATTERN; module is now SSL key-material onlysrc/domain-patterns.ts— addparseUrlPatterns+URL_CHAR_PATTERNat end of filesrc/config-writer.ts— split import:parseUrlPatternsfrom./domain-patterns, SSL functions remain from./ssl-bumpsrc/ssl-bump.test.ts— removeparseUrlPatternsdescribe block and unused constantsrc/domain-patterns.test.ts— addparseUrlPatternsto imports and test suitesrc/config-writer.test.ts— moveparseUrlPatternsmock from./ssl-bumpto a newjest.mock('./domain-patterns'); update alljest.requireMockcall sites accordingly