[CSL-3352] Enforce HTTPS on ServiceUrl

spec/src/constructorio.js

@@ -31,7 +31,7 @@ describe('ConstructorIO', () => {
   });
 
   it('Should return an instance with custom options when valid API key is provided', () => {
-    const serviceUrl = 'http://constructor.io';
+    const serviceUrl = 'https://constructor.io';
     const version = 'custom-version';
     const apiToken = 'token';
     const securityToken = 'security-token';
@@ -53,6 +53,17 @@ describe('ConstructorIO', () => {
     expect(instance.options).to.have.property('networkParameters').to.equal(networkParameters);
   });
 
+  it('Should return an instance with correct serviceUrl when a http serviceUrl is passed', () => {
+    const serviceUrl = 'http://constructor.io';
+    const instance = new ConstructorIO({
+      ...validOptions,
+      serviceUrl,
+    });
+
+    expect(instance).to.be.an('object');
+    expect(instance.options).to.have.property('serviceUrl').to.equal('https://constructor.io');
+  });
+
   it('Should remove any trailing slashes from the serviceUrl', () => {
     const serviceUrl = 'https://constructor.io/';
     const instance = new ConstructorIO({

spec/src/utils/helpers.js

@@ -12,6 +12,7 @@ const {
   combineCustomHeaders,
   toSnakeCase,
   toSnakeCaseKeys,
+  addHTTPSToString,
 } = require('../../../test/utils/helpers'); // eslint-disable-line import/extensions
 
 chai.use(chaiAsPromised);
@@ -248,5 +249,33 @@ describe('ConstructorIO - Utils - Helpers', () => {
         expect(combineCustomHeaders(globalOptions, methodOptions)).to.deep.equal(methodOptions.headers);
       });
     });
+
+    describe('addHTTPSToString', () => {
+      it('Should return the url without any modification', () => {
+        const testUrl = 'https://www.constructor.io';
+
+        expect(addHTTPSToString(testUrl)).to.equal(testUrl);
+      });
+
+      it('Should return url with no protocol with https at the beginning', () => {
+        const testUrl = 'www.constructor.io';
+        const expectedUrl = 'https://www.constructor.io';
+
+        expect(addHTTPSToString(testUrl)).to.equal(expectedUrl);
+      });
+
+      it('Should return url with an http protocol with https at the beginning', () => {
+        const testUrl = 'http://www.constructor.io';
+        const expectedUrl = 'https://www.constructor.io';
+
+        expect(addHTTPSToString(testUrl)).to.equal(expectedUrl);
+      });
+
+      it('Should return null if param is not a string', () => {
+        const testUrl = {};
+
+        expect(addHTTPSToString(testUrl)).to.equal(null);
+      });
+    });
   }
 });

src/constructorio.js

@@ -11,6 +11,7 @@ const Catalog = require('./modules/catalog');
 const Tasks = require('./modules/tasks');
 const Quizzes = require('./modules/quizzes');
 const { version: packageVersion } = require('../package.json');
+const utils = require('./utils/helpers');
 
 /**
  * Class to instantiate the ConstructorIO client.
@@ -50,12 +51,14 @@ class ConstructorIO {
       throw new Error('API key is a required parameter of type string');
     }
 
+    const normalizedServiceUrl = serviceUrl && serviceUrl.replace(/\/$/, '');
+
     this.options = {
       apiKey,
       apiToken: apiToken || '',
       securityToken: securityToken || '',
       version: version || global.CLIENT_VERSION || `cio-node-${packageVersion}`,
-      serviceUrl: (serviceUrl && serviceUrl.replace(/\/$/, '')) || 'https://ac.cnstrc.com',
+      serviceUrl: utils.addHTTPSToString(normalizedServiceUrl) || 'https://ac.cnstrc.com',
       fetch: fetch || nodeFetch,
       networkParameters: networkParameters || {},
     };

src/utils/helpers.js

@@ -114,6 +114,26 @@ const utils = {
 
     return false;
   },
+  addHTTPSToString(url) {
+    if (typeof url !== 'string') {
+      return null;
+    }
+
+    const doesUrlIncludeHTTPS = url.startsWith('https://');
+    const doesUrlStartWithHTTP = url.startsWith('http://');
+
+    if (!doesUrlIncludeHTTPS && doesUrlStartWithHTTP) {
+      return url.replace('http', 'https');
+    }
+
+    if (!doesUrlStartWithHTTP && !doesUrlIncludeHTTPS) {
+      const urlWithHttps = `https://${url}`;
+
+      return urlWithHttps;
+    }
+
+    return url;
+  },
 };
 
 module.exports = utils;