shakapacker 8.0.2 → 9.2.0

data/package/utils/typeGuards.ts

@@ -0,0 +1,342 @@
+import { Config, DevServerConfig, YamlConfig } from "../types"
+import { isPathTraversalSafe, validatePort } from "./pathValidation"
+
+// Cache for validated configs with TTL
+interface CacheEntry {
+  result: boolean
+  timestamp: number
+  configHash?: string
+}
+
+let validatedConfigs = new WeakMap<object, CacheEntry>()
+
+// Cache computed values to avoid repeated checks
+let cachedIsWatchMode: boolean | null = null
+let cachedCacheTTL: number | null = null
+
+/**
+ * Detect if running in watch mode (cached)
+ */
+function isWatchMode(): boolean {
+  if (cachedIsWatchMode === null) {
+    cachedIsWatchMode = process.argv.includes('--watch') || process.env.WEBPACK_WATCH === 'true'
+  }
+  return cachedIsWatchMode
+}
+
+/**
+ * Get cache TTL based on environment (cached)
+ */
+function getCacheTTL(): number {
+  if (cachedCacheTTL === null) {
+    if (process.env.SHAKAPACKER_CACHE_TTL) {
+      cachedCacheTTL = parseInt(process.env.SHAKAPACKER_CACHE_TTL, 10)
+    } else if (process.env.NODE_ENV === 'production' && !isWatchMode()) {
+      cachedCacheTTL = Infinity
+    } else if (isWatchMode()) {
+      cachedCacheTTL = 5000  // 5 seconds in watch mode
+    } else {
+      cachedCacheTTL = 60000 // 1 minute in dev
+    }
+  }
+  return cachedCacheTTL
+}
+
+// Only validate in development or when explicitly enabled
+function shouldValidate(): boolean {
+  return process.env.NODE_ENV !== 'production' || process.env.SHAKAPACKER_STRICT_VALIDATION === 'true'
+}
+
+// Debug logging for cache operations
+const debugCache = process.env.SHAKAPACKER_DEBUG_CACHE === 'true'
+
+/**
+ * Clear the validation cache
+ * Useful for testing or when config files change
+ */
+export function clearValidationCache(): void {
+  // Reassign to a new WeakMap to clear all entries
+  validatedConfigs = new WeakMap<object, CacheEntry>()
+  if (debugCache) {
+    console.log('[SHAKAPACKER DEBUG] Validation cache cleared')
+  }
+}
+
+/**
+ * Type guard to validate Config object at runtime
+ * In production, caches results for performance unless SHAKAPACKER_STRICT_VALIDATION is set
+ *
+ * IMPORTANT: Path traversal security checks ALWAYS run regardless of environment or validation mode.
+ * This ensures application security is never compromised for performance.
+ */
+export function isValidConfig(obj: unknown): obj is Config {
+  if (typeof obj !== 'object' || obj === null) {
+    return false
+  }
+
+  // Check cache with TTL
+  const cached = validatedConfigs.get(obj as object)
+  if (cached && (Date.now() - cached.timestamp) < getCacheTTL()) {
+    if (debugCache) {
+      console.log(`[SHAKAPACKER DEBUG] Config validation cache hit (result: ${cached.result})`)
+    }
+    return cached.result
+  }
+
+  const config = obj as Record<string, unknown>
+
+  // Check required string fields
+  const requiredStringFields = [
+    'source_path',
+    'source_entry_path',
+    'public_root_path',
+    'public_output_path',
+    'cache_path',
+    'javascript_transpiler'
+  ]
+
+  for (const field of requiredStringFields) {
+    if (typeof config[field] !== 'string') {
+      // Cache negative result
+      validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+      return false
+    }
+    // SECURITY: Path traversal validation ALWAYS runs (not subject to shouldValidate)
+    // This ensures paths are safe regardless of environment or validation mode
+    if (field.includes('path') && !isPathTraversalSafe(config[field] as string)) {
+      console.warn(`[SHAKAPACKER SECURITY] Invalid path in ${field}: ${config[field]}`)
+      validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+      return false
+    }
+  }
+  
+  // Check required boolean fields
+  const requiredBooleanFields = [
+    'nested_entries',
+    'css_extract_ignore_order_warnings',
+    'webpack_compile_output',
+    'shakapacker_precompile',
+    'cache_manifest',
+    'ensure_consistent_versioning',
+    'useContentHash',
+    'compile'
+  ]
+  
+  for (const field of requiredBooleanFields) {
+    if (typeof config[field] !== 'boolean') {
+      // Cache negative result
+      validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+      return false
+    }
+  }
+  
+  // Check arrays
+  if (!Array.isArray(config.additional_paths)) {
+    // Cache negative result
+    validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+    return false
+  }
+
+  // SECURITY: Path traversal validation for additional_paths ALWAYS runs (not subject to shouldValidate)
+  // This critical security check ensures user-provided paths cannot escape the project directory
+  for (const additionalPath of config.additional_paths as string[]) {
+    if (!isPathTraversalSafe(additionalPath)) {
+      console.warn(`[SHAKAPACKER SECURITY] Invalid additional_path: ${additionalPath}`)
+      validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+      return false
+    }
+  }
+
+  // In production, skip deep validation of optional fields unless explicitly enabled
+  // Security checks above still run regardless of this flag
+  if (!shouldValidate()) {
+    // Cache positive result - basic structure and security validated
+    validatedConfigs.set(obj as object, { result: true, timestamp: Date.now() })
+    return true
+  }
+
+  // Deep validation of optional fields (only in development or with SHAKAPACKER_STRICT_VALIDATION=true)
+  if (config.dev_server !== undefined && !isValidDevServerConfig(config.dev_server)) {
+    // Cache negative result
+    validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+    return false
+  }
+
+  if (config.integrity !== undefined) {
+    const integrity = config.integrity as Record<string, unknown>
+    if (typeof integrity.enabled !== 'boolean' ||
+        typeof integrity.cross_origin !== 'string') {
+      // Cache negative result
+      validatedConfigs.set(obj as object, { result: false, timestamp: Date.now() })
+      return false
+    }
+  }
+  
+  // Cache positive result
+  validatedConfigs.set(obj as object, { result: true, timestamp: Date.now() })
+  
+  return true
+}
+
+/**
+ * Type guard to validate DevServerConfig object at runtime
+ * In production, performs minimal validation for performance
+ */
+export function isValidDevServerConfig(obj: unknown): obj is DevServerConfig {
+  if (typeof obj !== 'object' || obj === null) {
+    return false
+  }
+  
+  // In production, skip deep validation unless explicitly enabled
+  if (!shouldValidate()) {
+    return true
+  }
+  
+  const config = obj as Record<string, unknown>
+  
+  // All fields are optional, just check types if present
+  if (config.hmr !== undefined && 
+      typeof config.hmr !== 'boolean' && 
+      config.hmr !== 'only') {
+    return false
+  }
+  
+  if (config.port !== undefined && !validatePort(config.port)) {
+    return false
+  }
+  
+  return true
+}
+
+/**
+ * Type guard to validate Rspack plugin instance
+ * Checks if an object looks like a valid Rspack plugin
+ */
+export function isValidRspackPlugin(obj: unknown): boolean {
+  if (typeof obj !== 'object' || obj === null) {
+    return false
+  }
+
+  const plugin = obj as Record<string, unknown>
+
+  // Check for common plugin patterns
+  // Most rspack plugins should have an apply method
+  if (typeof plugin.apply === 'function') {
+    return true
+  }
+
+  // Check for constructor name pattern (e.g., HtmlRspackPlugin)
+  const constructorName = plugin.constructor?.name || ''
+  if (constructorName.includes('Plugin') || constructorName.includes('Rspack')) {
+    return true
+  }
+
+  // Check for common plugin properties
+  if ('name' in plugin && typeof plugin.name === 'string') {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Type guard to validate array of Rspack plugins
+ * Ensures all items in the array are valid plugin instances
+ */
+export function isValidRspackPluginArray(arr: unknown): boolean {
+  if (!Array.isArray(arr)) {
+    return false
+  }
+
+  return arr.every(item => isValidRspackPlugin(item))
+}
+
+/**
+ * Type guard to validate YamlConfig structure
+ * In production, performs minimal validation for performance
+ */
+export function isValidYamlConfig(obj: unknown): obj is YamlConfig {
+  if (typeof obj !== 'object' || obj === null) {
+    return false
+  }
+  
+  // In production, skip deep validation unless explicitly enabled
+  if (!shouldValidate()) {
+    return true
+  }
+  
+  const config = obj as Record<string, unknown>
+  
+  // Each key should map to an object
+  for (const env of Object.keys(config)) {
+    if (typeof config[env] !== 'object' || config[env] === null) {
+      return false
+    }
+  }
+  
+  return true
+}
+
+/**
+ * Validates partial config used for merging
+ * Ensures that if fields are present, they have the correct types
+ * In production, performs minimal validation for performance
+ */
+export function isPartialConfig(obj: unknown): obj is Partial<Config> {
+  if (typeof obj !== 'object' || obj === null) {
+    return false
+  }
+  
+  // In production, skip deep validation unless explicitly enabled
+  if (!shouldValidate()) {
+    return true
+  }
+  
+  const config = obj as Record<string, unknown>
+  
+  // Check string fields if present
+  const stringFields = [
+    'source_path', 'source_entry_path', 'public_root_path',
+    'public_output_path', 'cache_path', 'javascript_transpiler'
+  ]
+  
+  for (const field of stringFields) {
+    if (field in config && typeof config[field] !== 'string') {
+      return false
+    }
+  }
+  
+  // Check boolean fields if present
+  const booleanFields = [
+    'nested_entries', 'css_extract_ignore_order_warnings',
+    'webpack_compile_output', 'shakapacker_precompile',
+    'cache_manifest', 'ensure_consistent_versioning'
+  ]
+  
+  for (const field of booleanFields) {
+    if (field in config && typeof config[field] !== 'boolean') {
+      return false
+    }
+  }
+  
+  // Check arrays if present
+  if ('additional_paths' in config && !Array.isArray(config.additional_paths)) {
+    return false
+  }
+  
+  return true
+}
+
+/**
+ * Creates a validation error with helpful context
+ */
+export function createConfigValidationError(
+  configPath: string,
+  environment: string,
+  details?: string
+): Error {
+  const message = `Invalid configuration in ${configPath} for environment '${environment}'`
+  return new Error(details ? `${message}: ${details}` : message)
+}
+
+

data/package/utils/validateDependencies.ts

@@ -0,0 +1,61 @@
+/**
+ * Validates that required dependencies are installed for the selected bundler
+ */
+
+const { moduleExists } = require("./helpers")
+const { error } = require("./debug")
+
+const validateRspackDependencies = (): void => {
+  const requiredDependencies = ["@rspack/core", "rspack-manifest-plugin"]
+
+  const missingDependencies = requiredDependencies.filter(
+    (dep) => !moduleExists(dep)
+  )
+
+  if (missingDependencies.length > 0) {
+    error(
+      `Missing required dependencies for RSpack:\n${missingDependencies
+        .map((dep) => `  - ${dep}`)
+        .join(
+          "\n"
+        )}\n\nPlease install them with:\n  npm install ${missingDependencies.join(
+        " "
+      )}`
+    )
+    throw new Error(
+      `Missing RSpack dependencies: ${missingDependencies.join(", ")}`
+    )
+  }
+}
+
+const validateWebpackDependencies = (): void => {
+  const requiredDependencies = [
+    "webpack",
+    "webpack-cli",
+    "webpack-assets-manifest"
+  ]
+
+  const missingDependencies = requiredDependencies.filter(
+    (dep) => !moduleExists(dep)
+  )
+
+  if (missingDependencies.length > 0) {
+    error(
+      `Missing required dependencies for Webpack:\n${missingDependencies
+        .map((dep) => `  - ${dep}`)
+        .join(
+          "\n"
+        )}\n\nPlease install them with:\n  npm install ${missingDependencies.join(
+        " "
+      )}`
+    )
+    throw new Error(
+      `Missing Webpack dependencies: ${missingDependencies.join(", ")}`
+    )
+  }
+}
+
+export = {
+  validateRspackDependencies,
+  validateWebpackDependencies
+}

data/package/webpack-types.d.ts

@@ -0,0 +1,33 @@
+// @ts-ignore: webpack is an optional peer dependency (using type-only import)
+import type { Configuration, RuleSetRule, RuleSetUseItem } from 'webpack'
+
+export interface ShakapackerWebpackConfig extends Configuration {
+  module?: Configuration['module'] & {
+    rules?: RuleSetRule[]
+  }
+}
+
+export interface ShakapackerRule extends RuleSetRule {
+  test: RegExp
+  use: RuleSetUseItem[]
+}
+
+export interface ShakapackerLoaderOptions {
+  [key: string]: any
+}
+
+export interface ShakapackerLoader {
+  loader: string
+  options?: ShakapackerLoaderOptions
+}
+
+export type LoaderType = string | ShakapackerLoader
+
+export interface LoaderUtils {
+  resolveLoader(name: string): string
+  createRule(test: RegExp, loaders: LoaderType[]): ShakapackerRule
+  getStyleLoader(extract?: boolean): LoaderType
+  getCssLoader(modules?: boolean): LoaderType
+  getPostCssLoader(): LoaderType
+  getSassLoader(): LoaderType
+}

data/package/webpackDevServerConfig.ts

@@ -0,0 +1,117 @@
+import { DevServerConfig } from "./types"
+const snakeToCamelCase = require("./utils/snakeToCamelCase")
+
+const shakapackerDevServerYamlConfig = require("./dev_server") as DevServerConfig
+const { outputPath: contentBase, publicPath } = require("./config") as {
+  outputPath: string
+  publicPath: string
+}
+
+interface WebpackDevServerConfig {
+  devMiddleware?: {
+    publicPath?: string
+  }
+  hot?: boolean | string
+  liveReload?: boolean
+  historyApiFallback?: boolean | {
+    disableDotRule?: boolean
+  }
+  static?: {
+    publicPath?: string
+    [key: string]: unknown
+  }
+  client?: Record<string, unknown>
+  allowedHosts?: "all" | "auto" | string | string[]
+  bonjour?: boolean | Record<string, unknown>
+  compress?: boolean
+  headers?: Record<string, unknown> | (() => Record<string, unknown>)
+  host?: "local-ip" | "local-ipv4" | "local-ipv6" | string
+  http2?: boolean
+  https?: boolean | Record<string, unknown>
+  ipc?: boolean | string
+  magicHtml?: boolean
+  onAfterSetupMiddleware?: (devServer: unknown) => void
+  onBeforeSetupMiddleware?: (devServer: unknown) => void
+  open?: boolean | string | string[] | Record<string, unknown> | Record<string, unknown>[]
+  port?: "auto" | string | number
+  proxy?: unknown
+  server?: string | boolean | Record<string, unknown>
+  setupExitSignals?: boolean
+  setupMiddlewares?: (middlewares: unknown[], devServer: unknown) => unknown[]
+  watchFiles?: string | string[] | unknown
+  webSocketServer?: string | boolean | Record<string, unknown>
+  [key: string]: unknown
+}
+
+const webpackDevServerMappedKeys = new Set([
+  // client, server, liveReload, devMiddleware are handled separately
+  "allowedHosts",
+  "bonjour",
+  "compress",
+  "headers",
+  "historyApiFallback",
+  "host",
+  "hot",
+  "http2",
+  "https",
+  "ipc",
+  "magicHtml",
+  "onAfterSetupMiddleware",
+  "onBeforeSetupMiddleware",
+  "open",
+  "port",
+  "proxy",
+  "server",
+  "setupExitSignals",
+  "setupMiddlewares",
+  "watchFiles",
+  "webSocketServer"
+])
+
+function createDevServerConfig(): WebpackDevServerConfig {
+  const devServerYamlConfig = { ...shakapackerDevServerYamlConfig } as DevServerConfig & Record<string, unknown>
+  const liveReload =
+    devServerYamlConfig.live_reload !== undefined
+      ? devServerYamlConfig.live_reload
+      : !devServerYamlConfig.hmr
+  delete devServerYamlConfig.live_reload
+
+  const config: WebpackDevServerConfig = {
+    devMiddleware: {
+      publicPath
+    },
+    hot: devServerYamlConfig.hmr,
+    liveReload,
+    historyApiFallback: {
+      disableDotRule: true
+    },
+    static: {
+      publicPath: contentBase
+    }
+  }
+  delete devServerYamlConfig.hmr
+
+  if (devServerYamlConfig.static) {
+    config.static = { 
+      ...config.static, 
+      ...(typeof devServerYamlConfig.static === 'object' ? devServerYamlConfig.static as Record<string, unknown> : {})
+    }
+    delete devServerYamlConfig.static
+  }
+
+  if (devServerYamlConfig.client) {
+    config.client = devServerYamlConfig.client
+    delete devServerYamlConfig.client
+  }
+
+  Object.keys(devServerYamlConfig).forEach((yamlKey) => {
+    const camelYamlKey = snakeToCamelCase(yamlKey)
+    if (webpackDevServerMappedKeys.has(camelYamlKey)) {
+      config[camelYamlKey] = devServerYamlConfig[yamlKey]
+    }
+  })
+
+  return config
+}
+
+export = createDevServerConfig