gentlemanhal / ring-curl Goto Github PK

https://circleci.com/blog/january-4-2023-security-alert/

For now I've just deleted them all the the pipeline, as we haven't actually made any changes to this repo in a long time I'm not actually sure if the pipeline even still works. If it does it certainly isn't following best practices (I know this as I recently updated the Nevergreen pipeline)

honestly it might be better to just switch to using GitHub actions?

I think this is because the deploy step has built a new jar without any source.

We have a manual step between building / testing and deploying as we don't want to automatically push every commit to clojars. So we copy the built jar to the workspace and the idea was once the deploy step was triggered it would use that. This has worked correctly when creating the release on GitHub but the lein deploy step seems to have built a new jar. This new jar doesn't contain any source files as we didn't copy them to the workspace between steps!

The helper function ring-curl.clj-http/convert does not preserve :query-params. This is not necessarily an issue with the core library because the user can always choose their own middleware when converting from a clj-http request to a ring request. However, it might be good to fix this for general use cases.

It looks like within the ring-curl.clj-http namespace moving wrap-query-params to the end of the middleware vector fixes the issue. This is because wrap-url will wipe out the :query-string if the :url doesn't contain a query string segment.

See the following snippet for an example. We expect http://localhost/test?k=v, but we get http://localhost/test.

(ns llama.tmp
  (:require [ring-curl.clj-http]
            [ring-curl.core]
            [clj-http.client]))

(ring-curl.core/to-curl
  (ring-curl.clj-http/convert
    {:url          "http://localhost/test"
     :query-params {"k" "v"}}))
;; => curl -v -X GET "http://localhost/test"

Can be fixed by using the following ring-curl.clj-http/middleware:

(def middleware
  [wrap-basic-auth
   wrap-oauth
   wrap-user-info
   wrap-url
   wrap-accept
   wrap-accept-encoding
   wrap-content-type
   wrap-form-params
   wrap-nested-params
   wrap-method
   wrap-query-params])