GitLab

Added DelimitedStringsOption for enabling delimited strings on the CLI

testing: add tests for constructing Options with defaults and parsing those Options using the CLI parsing tools

feat: StringsOption.Parse(string) now returns a slice containing the original string. Added DelimitedStringsOption which allows passing delimited options on the CLI, such as --option=opt1,opt2 when the delimiter is a comma, instead of requiring the longer form --option=op1 --option=opt2

feat: support strings option over HTTP API

* fix: allow requests from electron renderer

The Electron Renderer process runs in an embedded  browser window so
has access to browser-native `fetch`.  If this is used by
`ipfs-http-client` to make requests against the HTTP API, the
`User-Agent` header is set to a value that looks similar to a browser
but no `Origin` or `Referer` headers are sent.

The change here is to relax the user agent check to allow through
requests from clients with `'Electron'` in their user agents.

* refactor: move environment-based command restrictions to be stored with the command itself

Fix build on Plan 9

build(deps): bump github.com/ipfs/go-log from 1.0.3 to 1.0.4

Fix go-ipfs#7242: Remove "HEAD" from Allow methods

(when GET is not allowed).

* Staticcheck fixes

This fixes all staticcheck warnings for this library.

doc: update docs for interface changes

Bumps [github.com/ipfs/go-log](https://github.com/ipfs/go-log) from 1.0.3 to 1.0.4.
- [Release notes](https://github.com/ipfs/go-log/releases)
- [Commits](https://github.com/ipfs/go-log/compare/v1.0.3...v1.0.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Fix: disallow POST without Origin nor Referer from specific user agents

Addresses browsers being able to POST without control due to things like
https://bugzilla.mozilla.org/show_bug.cgi?id=429594

doc: document command fields

change HandledMethods to AllowGet and cleanup method handling

Allowing methods isn't as simple as just allowing/disallowing them because
different methods do different things.

* HEAD: should be allowed everywhere GET is allowed.
* OPTIONS:
  * When a CORS request is made, this will be handled by the CORS library.
  * Otherewise, we need to return the allowed methods.
* POST: always allowed.
* Everything else: always denied.

Changing HandledMethods to a simple AllowGet makes it easier to "do the right
thing".

remove deprecated log.Warning(f)

Part of the work to unblock: https://github.com/ipfs/go-log/pull/65