mattcasters commented on PR #8270: URL: https://github.com/apache/hop/pull/8270#issuecomment-5559791559
Second pass on the review-feedback commits. Ready to merge. The earlier findings are addressed: - RSS/GitHub fetches go through `NotificationHttp.requestable()` (absolute http(s) with a host) and an 8MB stream cap. A loopback/private-IP denylist is deliberately not added; the HTTP transform has no such policy either, and a pre-resolution check loses to DNS rebinding. - Hop Web sign-in burst is collapsed by process-wide `NotificationFetchCache` (in-flight wait, per-session copies, failures not cached). - RSS credentials are host-scoped; GitHub uses `Authorization: Bearer`; a token-only source no longer fails on a missing username. - Per-source `daysToGoBack` is applied (0/blank = global). - Discovered plugin sources no longer get a 60-minute interval written on Save; `toPersist()` drops untouched discovered rows so they do not outlive the plugin. - Source dialog is a scrolled `GuiCompositeWidgets` form on `NotificationSourceModel`. - Relative timestamps and source tooltips are in the resource bundle. - Feed HTML is stripped in `FeedText.plainText()` and ampersands are escaped for SWT mnemonics. - Unread bell icon is registered as a Hop Web alternate toolbar resource. One leftover from that pass is already on the branch: `NotificationFetchCache` was keyed only by source id, so a Hop Web session that had not reloaded after an edit could refill the cache and hand the old feed to the session that just saved. `e553f56c4d` keys by source id plus provider description (RSS URL / GitHub repo). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
