paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 45 Packages Projects Releases Wiki Activity

Merge pull request #4128 from backstage/rugvip/fetch

Browse Source 
backend-common: lock down UrlReader to only read from allowed URLs
This commit is contained in:
Patrik Oldsberg
2021-01-18 18:53:19 +01:00
committed by GitHub
parent c8e3e82ce2 a283dcc43b
commit 4211198c30
9 changed files with 179 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/rich-turtles-roll.md
+19
View File
@@ -0,0 +1,19 @@
---
'@backstage/backend-common': minor
---
Remove fallback option from `UrlReaders.create` and `UrlReaders.default`, as well as the default fallback reader.
To be able to read data from endpoints outside of the configured integrations, you now need to explicitly allow it by
adding an entry in the `backend.reading.allow` list. For example:
```yml
backend:
baseUrl: ...
reading:
allow:
- host: example.com
- host: '*.examples.org'
```
Apart from adding the above configuration, most projects should not need to take any action to migrate existing code. If you do happen to have your own fallback reader configured, this needs to be replaced with a reader factory that selects a specific set of URLs to work with. If you where wrapping the existing fallback reader, the new one that handles the allow list is created using `FetchUrlReader.factory`.