Documentation
¶
Index ¶
- Variables
- func Fetch(ctx context.Context, url string) (*http.Response, error)
- func IsIPPrivate(ip net.IP) bool
- func NewDataClient() *http.Client
- func NewSecureClient(timeout time.Duration) *http.Client
- func RedactURLError(err error) error
- func SafeDialer(network, address string, c syscall.RawConn) error
Constants ¶
This section is empty.
Variables ¶
var DataClient = NewDataClient()
DataClient is for fetching operator-configured data sources and posting to operator-configured destinations.
It bounds the phases that must be fast — connecting, the TLS handshake, and waiting for the server to begin its reply — but deliberately does not cap the total duration of a request. A data pipeline legitimately downloads large files and uploads large batches, and an overall Timeout would abort those on a clock rather than on a fault. This is the same distinction the API server makes between ReadHeaderTimeout and ReadTimeout: bound the wait, not the work.
It also deliberately performs NO SSRF check, which is what separates it from DefaultClient. Hermod is self-hosted, and a source pointed at http://internal-api.local is an ordinary thing to configure; refusing private addresses here would break the deployments this software exists for. Use DefaultClient instead whenever the thing being fetched is code, or comes from somewhere the operator does not control.
var DefaultClient = NewSecureClient(10 * time.Second)
DefaultClient is a pre-configured secure and performant HTTP client.
Functions ¶
func IsIPPrivate ¶
IsIPPrivate reports whether the given IP address is in a private/local range.
func NewDataClient ¶
NewDataClient builds the client described by DataClient.
func NewSecureClient ¶
NewSecureClient returns an http.Client with reasonable timeouts and basic SSRF protection by preventing connections to local/private IP ranges.
func RedactURLError ¶ added in v1.15.1
RedactURLError keeps a request's credentials out of the error it failed with.
net/http reports a failed request as a *url.Error whose text quotes the whole request URL — `Post "https://api.telegram.org/bot<TOKEN>/sendMessage": dial tcp: ...` — and it removes a userinfo password from it and nothing else. Connectors that authenticate through the URL returned that error unchanged: Telegram's token is part of the path, the Graph API takes access_token in the query, and a Slack or Discord webhook URL is the credential itself. The error then went where errors go — the log table, the workflow's status, and the "Workflow Error" alert, which is sent to every notification channel — on any network failure at all.
The URL is cut to its scheme and host: which server could not be reached is what a transport failure is diagnosed by, and nothing after the host is needed for that. The error keeps its Op and its cause, so errors.Is and Timeout() answer as they did. url.Parse failures are *url.Error too, which matters because a token pasted with its trailing newline fails parsing, and the parse error quotes the URL.
Give it the error net/http returned. Anything that wrapped that error has already copied the URL into its own text, so a wrapped error comes back as the redacted *url.Error alone, without the wrapper's words. Errors that are not about a URL are returned unchanged.
Types ¶
This section is empty.
Source Files