Skip to content

Commit c172d8d

Browse files
authored
Merge branch 'cloudflare:production' into production
2 parents bfe497f + aaad839 commit c172d8d

File tree

249 files changed

+1836
-1247
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

249 files changed

+1836
-1247
lines changed

.github/CODEOWNERS

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -120,9 +120,9 @@
120120
/public/realtime/ @cloudflare/pcx-technical-writing @cloudflare/calls @roerohan @ravindra-dyte
121121
/src/content/docs/stream/ @tsmith512 @ToriLindsay @cloudflare/pcx-technical-writing @renandincer @third774
122122
/src/content/release-notes/stream.yaml @tsmith512 @ToriLindsay @cloudflare/pcx-technical-writing
123-
/src/content/docs/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @mikenomitch @korinne @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1 @cloudflare/wrangler
124-
/src/content/partials/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @mikenomitch @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1 @cloudflare/wrangler
125-
/src/assets/images/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1 @cloudflare/wrangler
123+
/src/content/docs/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @mikenomitch @korinne @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1
124+
/src/content/partials/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @mikenomitch @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1
125+
/src/assets/images/workers/ @cloudflare/workers-docs @GregBrimble @irvinebroque @WalshyDev @cloudflare/deploy-config @cloudflare/pcx-technical-writing @kodster28 @cloudflare/wrangler @cloudflare/workers-runtime-1
126126
/src/content/release-notes/workers.yaml @cloudflare/workers-docs @GregBrimble @WalshyDev @aninibread @cloudflare/deploy-config @cloudflare/pcx-technical-writing @irvinebroque @mikenomitch
127127
/src/content/docs/zaraz/ @ToriLindsay @kathayl @bjesus @jonnyparris @simonabadoiu @cloudflare/pcx-technical-writing
128128
/src/content/release-notes/zaraz.yaml @bjesus @jonnyparris @simonabadoiu @cloudflare/pcx-technical-writing

src/components/WranglerCLI.astro

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
import { z } from "astro:schema";
3+
import { PackageManagers } from "starlight-package-managers";
4+
import { commands, getCommand } from "~/util/wrangler";
5+
import WranglerArg from "./WranglerArg.astro";
6+
import Details from "./Details.astro";
7+
8+
function validateArg(value: any, expected: string): boolean {
9+
if (Array.isArray(expected)) {
10+
for (const choice of expected) {
11+
if (value === choice) {
12+
return true;
13+
}
14+
}
15+
16+
return false;
17+
}
18+
19+
return typeof value === expected;
20+
}
21+
22+
type Props = z.input<typeof props>;
23+
24+
const props = z.object({
25+
command: z.string(),
26+
positionals: z.array(z.string()).optional(),
27+
flags: z.record(z.string(), z.any()).optional(),
28+
showArgs: z.boolean().default(false),
29+
});
30+
31+
const { command, positionals, flags, showArgs } = props.parse(Astro.props);
32+
33+
const definition = getCommand(command);
34+
35+
const { globalFlags } = commands;
36+
37+
let args = [];
38+
39+
if (flags) {
40+
for (const [key, value] of Object.entries(flags)) {
41+
const flagDef = definition.args?.[key];
42+
43+
if (!flagDef) {
44+
throw new Error(
45+
`[WranglerCLI] Received "${key}" for "${command}" but no such arg exists`,
46+
);
47+
}
48+
49+
const type = flagDef.type ?? flagDef.choices;
50+
const valid = validateArg(value, type);
51+
52+
if (!valid) {
53+
throw new Error(
54+
`[WranglerCLI] Expected "${type}" for "${key}" but got "${typeof value}"`,
55+
);
56+
}
57+
58+
args.push(...[`--${key}`, value]);
59+
}
60+
}
61+
62+
if (positionals) {
63+
const positionalsDef = definition.positionalArgs ?? [];
64+
65+
if (positionalsDef.length === 0) {
66+
throw new Error(
67+
`[WranglerCLI] Expected 0 positional arguments for "${command}" but received ${positionals.length}`,
68+
);
69+
}
70+
71+
args.push(...positionals);
72+
}
73+
---
74+
75+
<PackageManagers
76+
pkg="wrangler"
77+
type="exec"
78+
args={`${command} ${args.join(" ")}`}
79+
/>
80+
81+
{
82+
showArgs && definition.args && (
83+
<Details header="Arguments">
84+
<p>
85+
<strong>Command flags</strong>
86+
</p>
87+
<ul>
88+
{Object.entries(definition.args)
89+
.filter(([_, value]) => !value.hidden)
90+
.map(([key, value]) => {
91+
return <WranglerArg key={key} definition={value} />;
92+
})}
93+
</ul>
94+
95+
<p>
96+
<strong>Global flags</strong>
97+
</p>
98+
<ul>
99+
{Object.entries(globalFlags).map(([key, value]) => {
100+
return <WranglerArg key={key} definition={value} />;
101+
})}
102+
</ul>
103+
</Details>
104+
)
105+
}
Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
import { experimental_AstroContainer as AstroContainer } from "astro/container";
2+
import { expect, test, describe } from "vitest";
3+
import WranglerCLI from "./WranglerCLI.astro";
4+
5+
type Options = Parameters<(typeof container)["renderToString"]>[1];
6+
7+
const container = await AstroContainer.create();
8+
9+
const renderWithOptions = (options?: Options) => {
10+
return container.renderToString(WranglerCLI, options);
11+
};
12+
13+
describe("WranglerCLI", () => {
14+
test("succeeds with valid input", async () => {
15+
await expect(
16+
renderWithOptions({
17+
props: {
18+
command: "deploy",
19+
},
20+
}),
21+
).resolves.toContain("pnpm wrangler deploy");
22+
});
23+
24+
test("errors with no props", async () => {
25+
await expect(renderWithOptions()).rejects
26+
.toThrowErrorMatchingInlineSnapshot(`
27+
[ZodError: [
28+
{
29+
"code": "invalid_type",
30+
"expected": "string",
31+
"received": "undefined",
32+
"path": [
33+
"command"
34+
],
35+
"message": "Required"
36+
}
37+
]]
38+
`);
39+
});
40+
41+
test("errors with non-existent command", async () => {
42+
await expect(
43+
renderWithOptions({
44+
props: {
45+
command: "not-a-valid-command",
46+
},
47+
}),
48+
).rejects.toThrowErrorMatchingInlineSnapshot(
49+
`[Error: [wrangler.ts] Command "not-a-valid-command" not found]`,
50+
);
51+
});
52+
53+
test("errors with bad flags for 'deploy'", async () => {
54+
await expect(
55+
renderWithOptions({
56+
props: {
57+
command: "deploy",
58+
flags: {
59+
foo: "bar",
60+
},
61+
},
62+
}),
63+
).rejects.toThrowErrorMatchingInlineSnapshot(
64+
`[Error: [WranglerCLI] Received "foo" for "deploy" but no such arg exists]`,
65+
);
66+
});
67+
68+
test("errors with bad value for 'container-rollout' flag", async () => {
69+
await expect(
70+
renderWithOptions({
71+
props: {
72+
command: "deploy",
73+
flags: {
74+
"containers-rollout": "not-a-valid-option",
75+
},
76+
},
77+
}),
78+
).rejects.toThrowErrorMatchingInlineSnapshot(
79+
`[Error: [WranglerCLI] Expected "immediate,gradual" for "containers-rollout" but got "string"]`,
80+
);
81+
});
82+
});

src/components/WranglerCommand.astro

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,11 @@
11
---
22
import { z } from "astro:schema";
3-
import { experimental_getWranglerCommands } from "wrangler";
43
import AnchorHeading from "./AnchorHeading.astro";
54
import { PackageManagers } from "starlight-package-managers";
65
import WranglerArg from "./WranglerArg.astro";
76
import Details from "./Details.astro";
87
import { marked } from "marked";
9-
10-
function getCommand(path: string) {
11-
const segments = path.trim().split(/\s+/);
12-
13-
const { registry } = experimental_getWranglerCommands();
14-
15-
let node = registry.subtree;
16-
for (const segment of segments) {
17-
const next = node.get(segment);
18-
19-
if (!next) break;
20-
21-
if (next.subtree.size === 0 && next.definition?.type === "command") {
22-
return next.definition;
23-
}
24-
25-
node = next.subtree;
26-
}
27-
28-
throw new Error(`[WranglerCommand] Command "${path}" not found`);
29-
}
8+
import { commands, getCommand } from "~/util/wrangler";
309
3110
const props = z.object({
3211
command: z.string(),
@@ -44,7 +23,7 @@ if (!definition.args) {
4423
throw new Error(`[WranglerCommand] "${command}" has no arguments`);
4524
}
4625
47-
const { globalFlags } = experimental_getWranglerCommands();
26+
const { globalFlags } = commands;
4827
4928
const positionals = definition.positionalArgs
5029
?.map((p) => `[${p.toUpperCase()}]`)

src/components/index.ts

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ export { default as TagsUsage } from "./TagsUsage.astro";
5858
export { default as TunnelCalculator } from "./TunnelCalculator.astro";
5959
export { default as Type } from "./Type.astro";
6060
export { default as TypeScriptExample } from "./TypeScriptExample.astro";
61+
export { default as WranglerCLI } from "./WranglerCLI.astro";
6162
export { default as WranglerCommand } from "./WranglerCommand.astro";
6263
export { default as WranglerNamespace } from "./WranglerNamespace.astro";
6364
export { default as WranglerConfig } from "./WranglerConfig.astro";
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: DNS filtering for private network onramps
3+
description: Magic WAN and WARP Connector traffic can now privately route DNS queries to the Gateway resolver without public Internet exposure.
4+
products:
5+
- gateway
6+
- magic-wan
7+
- cloudflare-tunnel
8+
date: "2025-09-11"
9+
---
10+
11+
[Magic WAN](/magic-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](/cloudflare-one/connections/connect-networks/private-net/warp-connector/site-to-internet/#configure-dns-resolver-on-devices) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet.
12+
13+
Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One features, including [Internal DNS](/cloudflare-one/policies/gateway/resolver-policies/#internal-dns) and [hostname-based policies](/cloudflare-one/policies/gateway/egress-policies/#selector-prerequisites).
14+
15+
To configure DNS filtering, change your Magic WAN or WARP Connector DNS settings to use Cloudflare's shared resolver IPs, `172.64.36.1` and `172.64.36.2`. Once you configure DNS resolution and filtering, you can use _Source Internal IP_ as a traffic selector in your [resolver policies](/cloudflare-one/policies/gateway/resolver-policies/) for routing private DNS traffic to your [Internal DNS](/dns/internal-dns/).
16+
Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
title: "WAF Release - 2025-09-15"
3+
description: Cloudflare WAF managed rulesets 2025-09-15 release
4+
date: 2025-09-15
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
**This week's update**
10+
11+
This week’s focus highlights newly disclosed vulnerabilities in DevOps tooling, data visualization platforms, and enterprise CMS solutions. These issues include sensitive information disclosure and remote code execution, putting organizations at risk of credential leakage, unauthorized access, and full system compromise.
12+
13+
**Key Findings**
14+
15+
* Argo CD (CVE-2025-55190): Exposure of sensitive information could allow attackers to access credential data stored in configurations, potentially leading to compromise of Kubernetes workloads and secrets.Next.js (CVE-2025-57822): Improper handling of redirects in custom middleware can lead to server-side request forgery (SSRF) when user-supplied headers are forwarded. Attackers could exploit this to access internal services or cloud metadata endpoints. The issue has been resolved in versions 14.2.32 and 15.4.7. Developers using custom middleware should upgrade and verify proper redirect handling in `next()` calls.
16+
17+
* DataEase (CVE-2025-57773): Insufficient input validation enables JNDI injection and insecure deserialization, resulting in remote code execution (RCE). Successful exploitation grants attackers control over the application server.
18+
19+
* Sitecore (CVE-2025-53694): A sensitive information disclosure flaw allows unauthorized access to confidential information stored in Sitecore deployments, raising the risk of data breaches and privilege escalation.
20+
21+
**Impact**
22+
23+
These vulnerabilities expose organizations to serious risks, including credential theft, unauthorized access, and full system compromise. Argo CD’s flaw may expose Kubernetes secrets, DataEase exploitation could give attackers remote execution capabilities, and Sitecore’s disclosure issue increases the likelihood of sensitive data leakage and business impact.
24+
25+
Administrators are strongly advised to apply vendor patches immediately, rotate exposed credentials, and review access controls to mitigate these risks.
26+
27+
<table style="width: 100%">
28+
<thead>
29+
<tr>
30+
<th>Ruleset</th>
31+
<th>Rule ID</th>
32+
<th>Legacy Rule ID</th>
33+
<th>Description</th>
34+
<th>Previous Action</th>
35+
<th>New Action</th>
36+
<th>Comments</th>
37+
</tr>
38+
</thead>
39+
<tbody>
40+
<tr>
41+
<td>Cloudflare Managed Ruleset</td>
42+
<td>
43+
<RuleID id="199cce9ab21e40bcb535f01b2ee2085f" />
44+
</td>
45+
<td>100646</td>
46+
<td>Argo CD - Information Disclosure - CVE:CVE-2025-55190s</td>
47+
<td>Log</td>
48+
<td>Disabled</td>
49+
<td>This is a New Detection</td>
50+
</tr>
51+
<tr>
52+
<td>Cloudflare Managed Ruleset</td>
53+
<td>
54+
<RuleID id="e513bb21b6a44f9cbfcd2462f5e20788" />
55+
</td>
56+
<td>100874</td>
57+
<td>DataEase - JNDI injection - CVE:CVE-2025-57773</td>
58+
<td>Log</td>
59+
<td>Disabled</td>
60+
<td>This is a New Detection</td>
61+
</tr>
62+
<tr>
63+
<td>Cloudflare Managed Ruleset</td>
64+
<td>
65+
<RuleID id="be097f5a71a04f27aa87b60d005a12fd" />
66+
</td>
67+
<td>100880</td>
68+
<td>Sitecore - Information Disclosure - CVE:CVE-2025-53694</td>
69+
<td>Log</td>
70+
<td>Block</td>
71+
<td>This is a New Detection</td>
72+
</tr>
73+
</tbody>
74+
</table>

0 commit comments

Comments
 (0)