fix: accept forwarded header on signature, increase migrations timeou…

…t, disable host validation on queue
supabase · Apr 13, 2024 · 37b424d · 37b424d
1 parent 6af2407
commit 37b424d
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 1 deletion.
diff --git a/src/database/migrations/migrate.ts b/src/database/migrations/migrate.ts
@@ -187,7 +187,7 @@ async function connectAndMigrate(options: {
 
   const dbConfig: ClientConfig = {
     connectionString: databaseUrl,
-    connectionTimeoutMillis: 10_000,
+    connectionTimeoutMillis: 60_000,
     options: `-c search_path=${searchPath}`,
     ssl,
   }

diff --git a/src/queue/events/base-event.ts b/src/queue/events/base-event.ts
@@ -166,6 +166,7 @@ export abstract class BaseEvent<T extends Omit<BasePayload, '$version'>> {
       superUser: adminUser,
       host: payload.tenant.host,
       tenantId: payload.tenant.ref,
+      disableHostCheck: true,
     })
 
     const db = new StorageKnexDB(client, {

diff --git a/src/storage/protocols/s3/signature-v4.ts b/src/storage/protocols/s3/signature-v4.ts
@@ -261,6 +261,14 @@ export class SignatureV4 {
             if (xForwardedHost) {
               return `host:${xForwardedHost.toLowerCase()}`
             }
+
+            const forwarded = this.getHeader(request, 'forwarded')
+            if (forwarded) {
+              const extractedHost = /host="?([^";]+)/.exec(forwarded)?.[1]
+              if (extractedHost) {
+                return `host:${extractedHost.toLowerCase()}`
+              }
+            }
           }
 
           return `${header.toLowerCase()}:${