Fix codeQL error using URL params as part of the URL & remove commit added by mistake

Signed-off-by: ivgo <ivgo@spreadgroup.com>

plugins/vault-backend/src/service/VaultBuilder.tsx

@@ -152,8 +152,8 @@ export class VaultBuilder {
       res.json({ status: 'ok' });
     });
 
-    router.get('/v1/secrets', async (req, res) => {
-      const path = req.query.path;
+    router.get('/v1/secrets/:path', async (req, res) => {
+      const { path } = req.params;
       if (typeof path !== 'string') {
         throw new InputError(`Invalid path: ${path}`);
       }

plugins/vault-backend/src/service/vaultApi.ts

@@ -85,16 +85,17 @@ export class VaultClient implements VaultApi {
     query: { [key in string]: any },
     method: string = 'GET',
   ): Promise<T | undefined> {
-    const url = `${this.vaultConfig.baseUrl}/${path}?${new URLSearchParams(
-      query,
-    ).toString()}`;
-    const response = await fetch(url, {
-      method,
-      headers: {
-        Accept: 'application/json',
-        'X-Vault-Token': this.vaultConfig.token,
+    const url = new URL(path, this.vaultConfig.baseUrl);
+    const response = await fetch(
+      `${url.toString()}?${new URLSearchParams(query).toString()}`,
+      {
+        method,
+        headers: {
+          Accept: 'application/json',
+          'X-Vault-Token': this.vaultConfig.token,
+        },
       },
-    });
+    );
     if (response.status === 200) {
       return (await response.json()) as T;
     }

plugins/vault/src/api.test.ts

@@ -42,11 +42,11 @@ describe('api', () => {
 
   const setupHandlers = () => {
     server.use(
-      rest.get(`${mockBaseUrl}/v1/secrets`, (req, res, ctx) => {
-        const path = req.url.searchParams.get('path');
-        if (path === 'test/success') {
+      rest.get(`${mockBaseUrl}/v1/secrets/:path`, (req, res, ctx) => {
+        const { path } = req.params;
+        if (path === 'test%2Fsuccess') {
           return res(ctx.json(mockSecretsResult));
-        } else if (path === 'test/error') {
+        } else if (path === 'test%2Ferror') {
           return res(ctx.json([]));
         }
         return res(ctx.status(400));

plugins/vault/src/api.ts

@@ -56,9 +56,13 @@ export class VaultClient implements VaultApi {
   }
 
   async listSecrets(secretPath: string): Promise<VaultSecret[]> {
-    const result = await this.callApi<VaultSecret[]>('v1/secrets', {
-      path: secretPath,
-    });
+    if (secretPath === '') {
+      return [];
+    }
+    const result = await this.callApi<VaultSecret[]>(
+      `v1/secrets/${encodeURIComponent(secretPath)}`,
+      {},
+    );
     if (!result) {
       return [];
     }

plugins/vault/src/components/EntityVaultTable/EntityVaultTable.test.tsx

@@ -83,11 +83,11 @@ describe('EntityVautTable', () => {
 
   const setupHandlers = () => {
     server.use(
-      rest.get(`${mockBaseUrl}/v1/secrets`, (req, res, ctx) => {
-        const path = req.url.searchParams.get('path');
-        if (path === 'test/success') {
+      rest.get(`${mockBaseUrl}/v1/secrets/:path`, (req, res, ctx) => {
+        const { path } = req.params;
+        if (path === 'test%2Fsuccess') {
           return res(ctx.json(mockSecretsResult));
-        } else if (path === 'test/error') {
+        } else if (path === 'test%2Ferror') {
           return res(ctx.json([]));
         }
         return res(ctx.status(400));

yarn.lock

@@ -18211,7 +18211,7 @@ minimatch@3.0.4:
   dependencies:
     brace-expansion "^1.1.7"
 
-minimatch@5.1.0, minimatch@^5.0.0, minimatch@^5.0.1:
+minimatch@5.1.0, minimatch@^5.0.0, minimatch@^5.0.1, minimatch@^5.1.0:
   version "5.1.0"
   resolved "https://registry.npmjs.org/minimatch/-/minimatch-5.1.0.tgz#1717b464f4971b144f6aabe8f2d0b8e4511e09c7"
   integrity sha512-9TPBGGak4nHfGZsPBohm9AWg6NoT7QTCehS3BIJABslyZbzxfV78QM2Y6+i741OPZIafFAaiiEMh5OyIrJPgtg==