mirror of
https://github.com/baz-scm/awesome-reviewers.git
synced 2025-08-20 18:58:52 +03:00
24 lines
2.0 KiB
JSON
24 lines
2.0 KiB
JSON
[
|
|
{
|
|
"discussion_id": "2245817015",
|
|
"pr_number": 35953,
|
|
"pr_file": "plugin-server/src/cdp/consumers/cdp-source-webhooks.consumer.ts",
|
|
"created_at": "2025-07-31T16:10:29+00:00",
|
|
"commented_code": "import { createInvocation, createInvocationResult } from '../utils/invocation-utils'\n import { CdpConsumerBase } from './cdp-base.consumer'\n \n+const DISALLOWED_HEADERS = ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'cookie']",
|
|
"repo_full_name": "PostHog/posthog",
|
|
"discussion_comments": [
|
|
{
|
|
"comment_id": "2245817015",
|
|
"repo_full_name": "PostHog/posthog",
|
|
"pr_number": 35953,
|
|
"pr_file": "plugin-server/src/cdp/consumers/cdp-source-webhooks.consumer.ts",
|
|
"discussion_id": "2245817015",
|
|
"commented_code": "@@ -16,6 +16,8 @@ import { createAddLogFunction } from '../utils'\n import { createInvocation, createInvocationResult } from '../utils/invocation-utils'\n import { CdpConsumerBase } from './cdp-base.consumer'\n \n+const DISALLOWED_HEADERS = ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'cookie']",
|
|
"comment_created_at": "2025-07-31T16:10:29+00:00",
|
|
"comment_author": "Piccirello",
|
|
"comment_body": "May want to include the below, to be safe:\r\n\r\n- `x-csrftoken`\r\n- `authorization`\r\n- `proxy-authorization`\r\n- `referer`\r\n- `forwarded`\r\n- `x-real-ip`\r\n- `true-client-ip`\r\n\r\nThis list can change as our infra changes (e.g. if we start using Cloudflare that adds some additional headers). It would be much preferable to operate off of an allowlist. I don't have a great understanding of the current use case so it's hard to say exactly, but something like this\r\n```ts\r\nconst ALLOWED_HEADERS = ['Accept', 'Accept-Encoding', 'Accept-Language', 'Cache-Control', 'Pragma', 'Content-Type', 'Content-Length', 'Content-Encoding', 'Content-Language', 'User-Agent', 'Host', 'Date']\r\n```",
|
|
"pr_file_module": null
|
|
}
|
|
]
|
|
}
|
|
] |