Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(Git Projects): Insomnia files can be anywhere inside the repository #8432

Open
wants to merge 20 commits into
base: develop
Choose a base branch
from
Open

feat(Git Projects): Insomnia files can be anywhere inside the repository #8432

wants to merge 20 commits into from

Conversation

gatzjames
Copy link
Contributor

@gatzjames gatzjames commented Feb 27, 2025 •
edited
Loading

Highlights:

  • Insomnia Files can be located anywhere inside the repo
  • Users can select the repository folder in which a new file will be created - defaults to repository root
  • Users can select the filename of the files that will be created - defaults to the collection name as a safe to use filename.
  • Provide the same folder and filename selection for when importing files to a git project
  • Fixes an issue with handling merge conflicts

Closes INS-5069

@gatzjames gatzjames self-assigned this Feb 27, 2025
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 27, 2025
View reviewed changes
packages/insomnia/src/main/git-service.ts
const recursivelyFindInsomniaFiles = async (fsClient: PromiseFsClient, dir: string, files: string[] = []) => {
const dirFiles = await fsClient.promises.readdir(dir);
for (const file of dirFiles) {
const fullPath = path.join(dir, file);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
packages/insomnia/src/main/git-service.ts
const recursivelyFindInsomniaFiles = async (fsClient: PromiseFsClient, dir: string, files: string[] = []) => {
const dirFiles = await fsClient.promises.readdir(dir);
for (const file of dirFiles) {
const fullPath = path.join(dir, file);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
packages/insomnia/src/main/git-service.ts
const recursivelyGetDirectoryTree = async (directoryContents: string[], parentPath: string) => {
const tree: (GitRepoDirectory | GitRepoFile)[] = await Promise.all(
directoryContents.map(async (file: string) => {
const fileOrDirPath = path.join(parentPath, file);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
packages/insomnia/src/main/git-service.ts
const recursivelyGetDirectoryTree = async (directoryContents: string[], parentPath: string) => {
const tree: (GitRepoDirectory | GitRepoFile)[] = await Promise.all(
directoryContents.map(async (file: string) => {
const fileOrDirPath = path.join(parentPath, file);

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
@gatzjames gatzjames force-pushed the feat/git-project-insomnia-file-heuristics branch from 2aae939 to af9f4d2 Compare February 27, 2025 15:28
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 4, 2025
View reviewed changes
packages/insomnia/src/ui/routes/actions.tsx
const safeToUseFileNameWithExtension = safeToUseInsomniaFileNameWithExt(fileName);

await models.workspaceMeta.update(workspaceMeta, {
gitRepoPath: path.join(formData.get('folderPath')?.toString() || '', safeToUseFileNameWithExtension),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
packages/insomnia/src/ui/routes/actions.tsx
const safeToUseFileNameWithExtension = safeToUseInsomniaFileNameWithExt(fileName);

await models.workspaceMeta.update(workspaceMeta, {
gitRepoPath: path.join(formData.get('folderPath')?.toString() || '', safeToUseFileNameWithExtension),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
@gatzjames gatzjames force-pushed the feat/git-project-insomnia-file-heuristics branch 2 times, most recently from bc8acd6 to 7db47d3 Compare March 6, 2025 18:56
github-advanced-security[bot]
github-advanced-security bot found potential problems Mar 6, 2025
View reviewed changes
packages/insomnia/src/ui/routes/actions.tsx
}

await models.workspaceMeta.update(workspaceMeta, {
gitRepoPath: path.join(existingPathDir, safeToUseInsomniaFileNameWithExt(fileName)),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
packages/insomnia/src/ui/routes/actions.tsx
}

await models.workspaceMeta.update(workspaceMeta, {
gitRepoPath: path.join(existingPathDir, safeToUseInsomniaFileNameWithExt(fileName)),

Check warning

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal Warning

Detected possible user input going into a path.join or path.resolve function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
@gatzjames gatzjames force-pushed the feat/git-project-insomnia-file-heuristics branch from f002a71 to 35f4669 Compare March 7, 2025 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jackkav jackkav jackkav left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@gatzjames gatzjames

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@gatzjames @jackkav