othmane/ohif-viewer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(config url): Hardening fetch options. (#5985)

Browse Source
This commit is contained in:
Joe Boccanfuso 2026-04-29 11:57:33 -04:00 committed by GitHub
parent 90abd00936
commit 468e5734a9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 30 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
extensions/default/src/utils/secureConfigFetch.js
View File

@ -97,16 +97,14 @@ function resolveConfigFetchPolicy(rawUrl, policy = {}) {
}
async function fetchConfigJson(normalizedPolicy) {
const { normalizedUrl, isAuthenticated, isSameOrigin } = normalizedPolicy;
const response = isAuthenticated || isSameOrigin
? await fetch(normalizedUrl)
: await fetch(normalizedUrl, {
method: 'GET',
mode: 'cors',
credentials: 'omit',
redirect: 'error',
referrerPolicy: 'no-referrer',
});
const { normalizedUrl } = normalizedPolicy;
const response = await fetch(normalizedUrl, {
method: 'GET',
mode: 'cors',
credentials: 'same-origin',
redirect: 'error',
referrerPolicy: 'no-referrer',
});
if (!response.ok) {
throw new Error(`Failed to fetch dynamic datasource configuration (${response.status})`);
@ -114,7 +112,4 @@ async function fetchConfigJson(normalizedPolicy) {
return response.json();
}
export {
resolveConfigFetchPolicy,
fetchConfigJson,
};
export { resolveConfigFetchPolicy, fetchConfigJson };

26
extensions/default/src/utils/secureConfigFetch.test.js
View File

@ -103,14 +103,14 @@ describe('secureConfigFetch', () => {
expect.objectContaining({
method: 'GET',
mode: 'cors',
credentials: 'omit',
credentials: 'same-origin',
redirect: 'error',
referrerPolicy: 'no-referrer',
})
);
});
it('uses simple fetch for unauthenticated same-origin requests', async () => {
it('uses hardened fetch options for unauthenticated same-origin requests', async () => {
global.fetch.mockResolvedValue({
status: 200,
ok: true,
@ -124,11 +124,18 @@ describe('secureConfigFetch', () => {
});
expect(global.fetch).toHaveBeenCalledWith(
`${window.location.origin}/protected/config.json`
`${window.location.origin}/protected/config.json`,
expect.objectContaining({
method: 'GET',
mode: 'cors',
credentials: 'same-origin',
redirect: 'error',
referrerPolicy: 'no-referrer',
})
);
});
it('uses simple fetch in authenticated environments', async () => {
it('uses hardened fetch options in authenticated environments', async () => {
global.fetch.mockResolvedValue({
status: 200,
ok: true,
@ -141,7 +148,16 @@ describe('secureConfigFetch', () => {
isSameOrigin: false,
});
expect(global.fetch).toHaveBeenCalledWith('https://trusted.example.com/config.json');
expect(global.fetch).toHaveBeenCalledWith(
'https://trusted.example.com/config.json',
expect.objectContaining({
method: 'GET',
mode: 'cors',
credentials: 'same-origin',
redirect: 'error',
referrerPolicy: 'no-referrer',
})
);
});
});
});