Skip to content

fix: Use explicit import path for request-filtering-agent asar compat…#721

Open
rafarhat wants to merge 3 commits intoAzure:mainfrom
rafarhat:security-squashed
Open

fix: Use explicit import path for request-filtering-agent asar compat…#721
rafarhat wants to merge 3 commits intoAzure:mainfrom
rafarhat:security-squashed

Conversation

@rafarhat
Copy link
Copy Markdown
Member

@rafarhat rafarhat commented Feb 8, 2026

Use explicit import path for request-filtering-agent asar compatbility

Update Package Version to 0.15.14

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Thank you for contributing to the Azure IoT Explorer!

This checklist is used to make sure that common guidelines for a pull request are followed.

General Guidelines

  • If introducing new functionality or modified behavior, are they backed by unit tests?
  • Have all unit tests passed locally? (by running npm run test command)
  • Have you updated the README.md with new screenshots if significant changes have been made?
  • Have you update the package version if the current version in package.json is not higher than the version released?

rafarhat and others added 3 commits February 7, 2026 18:24
On Linux, dynamic import() of ESM modules from inside .asar archives
fails with ENOTDIR because the ESM loader bypasses Electron's patched
fs module. Fix by:

- Adding asarUnpack for request-filtering-agent and ipaddr.js so they
  are extracted as real files alongside the asar archive
- Redirecting the fallback import path from .asar/ to .asar.unpacked/
  on Linux where the ESM loader cannot resolve asar-internal paths
…ility

Replace ESM-only request-filtering-agent with CJS-compatible ssrf-req-filter
to eliminate complex dynamic import workarounds in the Electron main process.

- Remove 37-line dynamic import fallback chain (Function constructor hack,
  asar unpacking, silent degradation)
- Replace with simple static import and direct ssrf-req-filter(url) call
- Remove request-filtering-agent from asarUnpack (CJS works inside asar)
- Remove request-filtering-agent from Jest transformIgnorePatterns
- Same SSRF protection: DNS lookup + IP validation via ipaddr.js
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant