Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ import { Method, Environments } from 'method-node';
const method = new Method({
apiKey: '<API_KEY>',
env: Environments.dev,
// Optional: override the base URL for local mocks or self-hosted gateways
baseURL: 'http://localhost:4010',
});
```

Expand Down
11 changes: 10 additions & 1 deletion src/configuration.ts
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@
export interface IConfigurationOpts {
apiKey: string;
env: TEnvironments;
baseURL?: string;
httpsAgent?: any;
onRequest?: TOnRequest;
onResponse?: TOnResponse;
Expand All @@ -76,7 +77,8 @@
constructor(opts: IConfigurationOpts) {
Configuration._validateConfiguration(opts);

this.baseURL = `https://${opts.env}.methodfi.com`;
const baseURL = opts.baseURL ?? `https://${opts.env}.methodfi.com`;
this.baseURL = baseURL.replace(/\/+$/, '');

Check failure

Code scanning / CodeQL

Polynomial regular expression used on uncontrolled data High

This
regular expression
that depends on
library input
may run slow on strings with many repetitions of '/'.
This
regular expression
that depends on
library input
may run slow on strings with many repetitions of '/'.
this.apiKey = opts.apiKey;
this.httpsAgent = opts.httpsAgent || null;
this.onRequest = opts.onRequest || null;
Expand All @@ -94,5 +96,12 @@
private static _validateConfiguration(opts: IConfigurationOpts): void {
if (!Environments[opts.env]) throw new Error(`Invalid env: ${opts.env}`);
if (!opts.apiKey) throw new Error(`Invalid apiKey: ${opts.apiKey}`);
if (opts.baseURL) {
try {
new URL(opts.baseURL);
Comment on lines +99 to +101

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject empty baseURL values

If a caller passes baseURL: '' (e.g., from an unset env var), the opts.baseURL check is falsy so validation is skipped, but the constructor still uses the empty string because ?? does not fall back on ''. This results in Configuration.baseURL being empty, and later new URL(${request.baseURL}${request.url}) in src/resource.ts throws for relative-only URLs, breaking all requests at runtime. Consider treating empty/whitespace strings as invalid or falling back to the env default.

Useful? React with 👍 / 👎.

} catch (error) {
throw new Error(`Invalid baseURL: ${opts.baseURL}`);
}
}
}
};
Loading