shakapacker 9.3.0.beta.7 → 9.3.0

data/package/configExporter/types.ts

@@ -1,3 +1,67 @@
+/**
+ * Environment variable names that can be set by build configurations.
+ * These are the only environment variables that build configs are allowed to set.
+ * This whitelist prevents malicious configs from modifying critical system variables.
+ */
+export const BUILD_ENV_VARS = [
+  "NODE_ENV",
+  "RAILS_ENV",
+  "NODE_OPTIONS",
+  "BABEL_ENV",
+  "WEBPACK_SERVE",
+  "CLIENT_BUNDLE_ONLY",
+  "SERVER_BUNDLE_ONLY"
+] as const
+
+/**
+ * Environment variables that must never be set by build configurations.
+ * Setting these could compromise system security or cause unexpected behavior.
+ */
+export const DANGEROUS_ENV_VARS = [
+  "PATH",
+  "HOME",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES"
+] as const
+
+/**
+ * Type predicate to check if a string is in the BUILD_ENV_VARS whitelist
+ *
+ * Note: The type assertion is necessary because TypeScript's type system cannot
+ * infer that .includes() on a readonly const array will properly narrow the type.
+ * The assertion is safe because we're only widening the type for the includes() check.
+ */
+export function isBuildEnvVar(
+  key: string
+): key is (typeof BUILD_ENV_VARS)[number] {
+  return (BUILD_ENV_VARS as readonly string[]).includes(key)
+}
+
+/**
+ * Type predicate to check if a string is in the DANGEROUS_ENV_VARS blacklist
+ *
+ * Note: The type assertion is necessary because TypeScript's type system cannot
+ * infer that .includes() on a readonly const array will properly narrow the type.
+ * The assertion is safe because we're only widening the type for the includes() check.
+ */
+export function isDangerousEnvVar(
+  key: string
+): key is (typeof DANGEROUS_ENV_VARS)[number] {
+  return (DANGEROUS_ENV_VARS as readonly string[]).includes(key)
+}
+
+/**
+ * Default directory for config exports when using --doctor or file output modes.
+ */
+export const DEFAULT_EXPORT_DIR = "shakapacker-config-exports"
+
+/**
+ * Default config file path for bundler build configurations.
+ */
+export const DEFAULT_CONFIG_FILE = "config/shakapacker-builds.yml"
+
 export interface ExportOptions {
   doctor?: boolean
   saveDir?: string

data/package/configExporter/yamlSerializer.ts

@@ -1,6 +1,6 @@
+import { relative, isAbsolute } from "path"
 import { ConfigMetadata } from "./types"
 import { getDocForKey } from "./configDocs"
-import { relative, isAbsolute } from "path"
 
 /**
  * Serializes webpack/rspack config to YAML format with optional inline documentation.
@@ -8,6 +8,7 @@ import { relative, isAbsolute } from "path"
  */
 export class YamlSerializer {
   private annotate: boolean
+
   private appRoot: string
 
   constructor(options: { annotate: boolean; appRoot: string }) {
@@ -18,11 +19,11 @@ export class YamlSerializer {
   /**
    * Serialize a config object to YAML string with metadata header
    */
-  serialize(config: any, metadata: ConfigMetadata): string {
+  serialize(config: unknown, metadata: ConfigMetadata): string {
     const output: string[] = []
 
     // Add metadata header
-    output.push(this.createHeader(metadata))
+    output.push(YamlSerializer.createHeader(metadata))
     output.push("")
 
     // Serialize the config
@@ -31,9 +32,9 @@ export class YamlSerializer {
     return output.join("\n")
   }
 
-  private createHeader(metadata: ConfigMetadata): string {
+  private static createHeader(metadata: ConfigMetadata): string {
     const lines: string[] = []
-    lines.push("# " + "=".repeat(77))
+    lines.push(`# ${"=".repeat(77)}`)
     lines.push("# Webpack/Rspack Configuration Export")
     lines.push(`# Generated: ${metadata.exportedAt}`)
     lines.push(`# Environment: ${metadata.environment}`)
@@ -42,11 +43,15 @@ export class YamlSerializer {
     if (metadata.configCount > 1) {
       lines.push(`# Total Configs: ${metadata.configCount}`)
     }
-    lines.push("# " + "=".repeat(77))
+    lines.push(`# ${"=".repeat(77)}`)
     return lines.join("\n")
   }
 
-  private serializeValue(value: any, indent: number, keyPath: string): string {
+  private serializeValue(
+    value: unknown,
+    indent: number,
+    keyPath: string
+  ): string {
     if (value === null || value === undefined) {
       return "null"
     }
@@ -64,11 +69,28 @@ export class YamlSerializer {
     }
 
     if (typeof value === "function") {
-      return this.serializeFunction(value)
+      return this.serializeFunction(
+        value as (...args: unknown[]) => unknown,
+        indent
+      )
     }
 
     if (value instanceof RegExp) {
-      return this.serializeString(value.toString())
+      // Extract pattern without surrounding slashes: "/pattern/flags" -> "pattern"
+      // Include flags as inline comment when present for semantic clarity
+      const regexStr = value.toString()
+      const lastSlash = regexStr.lastIndexOf("/")
+      const pattern = regexStr.slice(1, lastSlash)
+      const flags = regexStr.slice(lastSlash + 1)
+
+      const serializedPattern = this.serializeString(pattern, indent)
+
+      // Add flags as inline comment if present (e.g., "pattern" # flags: gi)
+      if (flags) {
+        return `${serializedPattern} # flags: ${flags}`
+      }
+
+      return serializedPattern
     }
 
     if (Array.isArray(value)) {
@@ -76,10 +98,20 @@ export class YamlSerializer {
     }
 
     if (typeof value === "object") {
-      return this.serializeObject(value, indent, keyPath)
+      return this.serializeObject(
+        value as Record<string, unknown>,
+        indent,
+        keyPath
+      )
     }
 
-    return String(value)
+    // Handle remaining types explicitly
+    if (typeof value === "symbol") return value.toString()
+    if (typeof value === "bigint") return value.toString()
+
+    // All remaining types are primitives (string, number, boolean, null, undefined)
+    // that String() handles safely - cast to exclude objects since we've already handled them
+    return String(value as string | number | boolean | null | undefined)
   }
 
   private serializeString(str: string, indent: number = 0): string {
@@ -90,15 +122,28 @@ export class YamlSerializer {
     if (cleaned.includes("\n")) {
       const lines = cleaned.split("\n")
       const lineIndent = " ".repeat(indent + 2)
-      return "|\n" + lines.map((line) => lineIndent + line).join("\n")
+      return `|\n${lines.map((line) => lineIndent + line).join("\n")}`
     }
 
-    // Escape strings that need quoting
+    // Escape strings that need quoting in YAML
+    // YAML has many special characters that can cause parsing errors:
+    // : # ' " (basic delimiters)
+    // [ ] { } (flow collections)
+    // * & ! @ ` (special constructs: aliases, anchors, tags)
     if (
       cleaned.includes(":") ||
       cleaned.includes("#") ||
       cleaned.includes("'") ||
       cleaned.includes('"') ||
+      cleaned.includes("[") ||
+      cleaned.includes("]") ||
+      cleaned.includes("{") ||
+      cleaned.includes("}") ||
+      cleaned.includes("*") ||
+      cleaned.includes("&") ||
+      cleaned.includes("!") ||
+      cleaned.includes("@") ||
+      cleaned.includes("`") ||
       cleaned.startsWith(" ") ||
       cleaned.endsWith(" ")
     ) {
@@ -109,7 +154,10 @@ export class YamlSerializer {
     return cleaned
   }
 
-  private serializeFunction(fn: Function): string {
+  private serializeFunction(
+    fn: (...args: unknown[]) => unknown,
+    indent: number = 0
+  ): string {
     // Get function source code
     const source = fn.toString()
 
@@ -122,21 +170,24 @@ export class YamlSerializer {
     const displayLines = truncated ? lines.slice(0, maxLines) : lines
 
     // Clean up indentation while preserving structure
-    const minIndent = Math.min(
-      ...displayLines
-        .filter((l) => l.trim().length > 0)
-        .map((l) => l.match(/^\s*/)?.[0].length || 0)
-    )
+    const indentLevels = displayLines
+      .filter((l) => l.trim().length > 0)
+      .map((l) => l.match(/^\s*/)?.[0].length || 0)
+    const minIndent = indentLevels.length > 0 ? Math.min(...indentLevels) : 0
 
     const formatted =
       displayLines.map((line) => line.substring(minIndent)).join("\n") +
       (truncated ? "\n..." : "")
 
-    // Use serializeString to properly handle multiline
-    return this.serializeString(formatted)
+    // Use serializeString to properly handle multiline with correct indentation
+    return this.serializeString(formatted, indent)
   }
 
-  private serializeArray(arr: any[], indent: number, keyPath: string): string {
+  private serializeArray(
+    arr: unknown[],
+    indent: number,
+    keyPath: string
+  ): string {
     if (arr.length === 0) {
       return "[]"
     }
@@ -149,7 +200,7 @@ export class YamlSerializer {
       const itemPath = `${keyPath}[${index}]`
 
       // Check if this is a plugin object and add its name as a comment
-      const pluginName = this.getConstructorName(item)
+      const pluginName = YamlSerializer.getConstructorName(item)
       const isPlugin = pluginName && /(^|\.)plugins\[\d+\]/.test(itemPath)
       const isEmpty =
         typeof item === "object" &&
@@ -180,11 +231,11 @@ export class YamlSerializer {
           .split("\n")
           .filter((line: string) => line.trim().length > 0)
         // Compute minimum leading whitespace to preserve relative indentation
-        const minIndent = Math.min(
-          ...nonEmptyLines.map(
-            (line: string) => line.match(/^\s*/)?.[0].length || 0
-          )
+        const indentLevels = nonEmptyLines.map(
+          (line: string) => line.match(/^\s*/)?.[0].length || 0
         )
+        const minIndent =
+          indentLevels.length > 0 ? Math.min(...indentLevels) : 0
         nonEmptyLines.forEach((line: string) => {
           // Remove only the common indent, preserving relative indentation
           lines.push(contentIndent + line.substring(minIndent))
@@ -196,11 +247,11 @@ export class YamlSerializer {
           .split("\n")
           .filter((line: string) => line.trim().length > 0)
         // Compute minimum leading whitespace to preserve relative indentation
-        const minIndent = Math.min(
-          ...nonEmptyLines.map(
-            (line: string) => line.match(/^\s*/)?.[0].length || 0
-          )
+        const indentLevels = nonEmptyLines.map(
+          (line: string) => line.match(/^\s*/)?.[0].length || 0
         )
+        const minIndent =
+          indentLevels.length > 0 ? Math.min(...indentLevels) : 0
         nonEmptyLines.forEach((line: string) => {
           // Remove only the common indent, preserving relative indentation
           lines.push(contentIndent + line.substring(minIndent))
@@ -211,12 +262,16 @@ export class YamlSerializer {
       }
     })
 
-    return "\n" + lines.join("\n")
+    return `\n${lines.join("\n")}`
   }
 
-  private serializeObject(obj: any, indent: number, keyPath: string): string {
-    const keys = Object.keys(obj)
-    const constructorName = this.getConstructorName(obj)
+  private serializeObject(
+    obj: Record<string, unknown>,
+    indent: number,
+    keyPath: string
+  ): string {
+    const keys = Object.keys(obj).sort()
+    const constructorName = YamlSerializer.getConstructorName(obj)
 
     // For empty objects, show constructor name if available
     if (keys.length === 0) {
@@ -248,6 +303,12 @@ export class YamlSerializer {
         for (const line of value.split("\n")) {
           lines.push(`${valueIndent}${line}`)
         }
+      } else if (value instanceof RegExp || typeof value === "function") {
+        // Handle RegExp and functions explicitly before the generic object check
+        // to prevent them from being treated as empty objects (RegExp/functions
+        // have no enumerable keys but should serialize as their string representation)
+        const serialized = this.serializeValue(value, indent + 2, fullKeyPath)
+        lines.push(`${keyIndent}${key}: ${serialized}`)
       } else if (
         typeof value === "object" &&
         value !== null &&
@@ -258,7 +319,7 @@ export class YamlSerializer {
         } else {
           lines.push(`${keyIndent}${key}:`)
           const nestedLines = this.serializeObject(
-            value,
+            value as Record<string, unknown>,
             indent + 2,
             fullKeyPath
           )
@@ -282,7 +343,6 @@ export class YamlSerializer {
   }
 
   private makePathRelative(str: string): string {
-    if (typeof str !== "string") return str
     if (!isAbsolute(str)) return str
 
     // Convert absolute paths to relative paths using path.relative
@@ -297,20 +357,35 @@ export class YamlSerializer {
       return str
     }
 
-    return "./" + rel
+    return `./${rel}`
   }
 
   /**
    * Extracts the constructor name from an object
-   * Returns null for plain objects (Object constructor)
+   * Returns null for plain objects (Object constructor) or objects without prototypes
    */
-  private getConstructorName(obj: any): string | null {
+  private static getConstructorName(obj: unknown): string | null {
     if (!obj || typeof obj !== "object") return null
     if (Array.isArray(obj)) return null
 
-    const constructorName = obj.constructor?.name
-    if (!constructorName || constructorName === "Object") return null
+    // Use Object.getPrototypeOf for safer access to constructor
+    // This handles Object.create(null) and unusual prototypes correctly
+    try {
+      const proto = Object.getPrototypeOf(obj) as {
+        constructor?: { name?: string }
+      } | null
+      if (!proto || proto === Object.prototype) return null
 
-    return constructorName
+      const { constructor } = proto
+      if (!constructor || typeof constructor !== "function") return null
+
+      const constructorName = constructor.name
+      if (!constructorName || constructorName === "Object") return null
+
+      return constructorName
+    } catch {
+      // Handle frozen objects or other edge cases
+      return null
+    }
   }
 }

data/package/dev_server.ts

@@ -1,7 +1,8 @@
 // These are the raw shakapacker dev server config settings from the YML file with ENV overrides applied.
+import { DevServerConfig } from "./types"
+
 const { isBoolean } = require("./utils/helpers")
 const config = require("./config")
-import { DevServerConfig } from "./types"
 
 const envFetch = (key: string): string | boolean | undefined => {
   const value = process.env[key]

data/package/env.ts

@@ -1,5 +1,6 @@
 import { load } from "js-yaml"
 import { readFileSync } from "fs"
+
 const defaultConfigPath = require("./utils/defaultConfigPath")
 const configPath = require("./utils/configPath")
 const { isFileNotFoundError } = require("./utils/errorHelpers")
@@ -76,7 +77,6 @@ const validatedRailsEnv =
   initialRailsEnv && initialRailsEnv.match(regex) ? initialRailsEnv : DEFAULT
 
 if (initialRailsEnv && validatedRailsEnv !== initialRailsEnv) {
-  /* eslint no-console:0 */
   console.warn(
     `[SHAKAPACKER WARNING] Environment '${initialRailsEnv}' not found in the configuration.\n` +
       `Using '${DEFAULT}' configuration as a fallback.`

data/package/environments/base.ts

@@ -1,12 +1,12 @@
 /* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
+import { Dirent } from "fs"
+import type { Configuration, Entry } from "webpack"
+
 const { basename, dirname, join, relative, resolve } = require("path")
 const { existsSync, readdirSync } = require("fs")
-import { Dirent } from "fs"
 const extname = require("path-complete-extname")
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
-import type { Configuration, Entry } from "webpack"
 const config = require("../config")
 const { isProduction } = require("../env")
 
@@ -73,7 +73,7 @@ const getEntryObject = (): Entry => {
     const previousPaths = entries[name]
     if (previousPaths) {
       const pathArray = Array.isArray(previousPaths)
-        ? (previousPaths as string[])
+        ? previousPaths
         : [previousPaths as string]
       pathArray.push(assetPath)
       entries[name] = pathArray

data/package/environments/development.ts

@@ -3,12 +3,6 @@
  * @module environments/development
  */
 
-const { merge } = require("webpack-merge")
-const config = require("../config")
-const baseConfig = require("./base")
-const webpackDevServerConfig = require("../webpackDevServerConfig")
-const { runningWebpackDevServer } = require("../env")
-const { moduleExists } = require("../utils/helpers")
 import type {
   WebpackConfigWithDevServer,
   RspackConfigWithDevServer,
@@ -16,6 +10,13 @@ import type {
   ReactRefreshRspackPlugin
 } from "./types"
 
+const { merge } = require("webpack-merge")
+const config = require("../config")
+const baseConfig = require("./base")
+const webpackDevServerConfig = require("../webpackDevServerConfig")
+const { runningWebpackDevServer } = require("../env")
+const { moduleExists } = require("../utils/helpers")
+
 /**
  * Base development configuration shared between webpack and rspack
  */

data/package/environments/production.ts

@@ -6,17 +6,18 @@
 /* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
-const { resolve } = require("path")
-const { merge } = require("webpack-merge")
-const baseConfig = require("./base")
-const { moduleExists } = require("../utils/helpers")
-const config = require("../config")
 import type {
   Configuration as WebpackConfiguration,
   WebpackPluginInstance
 } from "webpack"
 import type { CompressionPluginConstructor } from "./types"
 
+const { resolve } = require("path")
+const { merge } = require("webpack-merge")
+const baseConfig = require("./base")
+const { moduleExists } = require("../utils/helpers")
+const config = require("../config")
+
 const optimizationPath = resolve(
   __dirname,
   "..",
@@ -27,7 +28,6 @@ const { getOptimization } = require(optimizationPath)
 
 let CompressionPlugin: CompressionPluginConstructor | null = null
 if (moduleExists("compression-webpack-plugin")) {
-  // eslint-disable-next-line global-require
   CompressionPlugin = require("compression-webpack-plugin")
 }
 
@@ -73,7 +73,6 @@ const productionConfig: Partial<WebpackConfiguration> = {
 }
 
 if (config.useContentHash === false) {
-  // eslint-disable-next-line no-console
   console.warn(`⚠️ WARNING
 Setting 'useContentHash' to 'false' in the production environment (specified by NODE_ENV environment variable) is not allowed!
 Content hashes get added to the filenames regardless of setting useContentHash in 'shakapacker.yml' to false.

data/package/environments/test.ts

@@ -3,10 +3,11 @@
  * @module environments/test
  */
 
+import type { Configuration as WebpackConfiguration } from "webpack"
+
 const { merge } = require("webpack-merge")
 const config = require("../config")
 const baseConfig = require("./base")
-import type { Configuration as WebpackConfiguration } from "webpack"
 
 interface TestConfig {
   mode: "development" | "production" | "none"

data/package/index.ts

@@ -4,8 +4,7 @@
 import * as webpackMerge from "webpack-merge"
 import { resolve } from "path"
 import { existsSync } from "fs"
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
-import type { Configuration } from "webpack"
+import type { Configuration, RuleSetRule } from "webpack"
 import config from "./config"
 import baseConfig from "./environments/base"
 import devServer from "./dev_server"
@@ -14,8 +13,16 @@ import { moduleExists, canProcess } from "./utils/helpers"
 import inliningCss from "./utils/inliningCss"
 
 const rulesPath = resolve(__dirname, "rules", `${config.assets_bundler}.js`)
-const rules = require(rulesPath)
+/** Array of webpack/rspack loader rules */
+const rules = require(rulesPath) as RuleSetRule[]
 
+/**
+ * Generate webpack configuration with optional custom config.
+ *
+ * @param extraConfig - Optional webpack configuration to merge with base config
+ * @returns Final webpack configuration
+ * @throws {Error} If more than one argument is provided
+ */
 const generateWebpackConfig = (
   extraConfig: Configuration = {},
   ...extraArgs: unknown[]
@@ -41,15 +48,32 @@ const generateWebpackConfig = (
   return webpackMerge.merge({}, environmentConfig, extraConfig)
 }
 
+/**
+ * The Shakapacker module exports.
+ * This object is exported via CommonJS `export =`.
+ *
+ * NOTE: This pattern is temporary and will be replaced with named exports
+ * once issue #641 is resolved.
+ */
 export = {
-  config, // shakapacker.yml
+  /** Shakapacker configuration from shakapacker.yml */
+  config,
+  /** Development server configuration */
   devServer,
+  /** Generate webpack configuration with optional custom config */
   generateWebpackConfig,
+  /** Base webpack/rspack configuration */
   baseConfig,
+  /** Environment configuration (railsEnv, nodeEnv, etc.) */
   env,
+  /** Array of webpack/rspack loader rules */
   rules,
+  /** Check if a module exists in node_modules */
   moduleExists,
+  /** Process a file if a specific loader is available */
   canProcess,
+  /** Whether CSS should be inlined (dev server with HMR) */
   inliningCss,
+  /** webpack-merge functions (merge, mergeWithCustomize, mergeWithRules, unique) */
   ...webpackMerge
 }

data/package/loaders.d.ts

@@ -1,8 +1,8 @@
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
+// @ts-expect-error: webpack is an optional peer dependency (using type-only import)
 import type { LoaderDefinitionFunction } from "webpack"
 
 export interface ShakapackerLoaderOptions {
-  [key: string]: any
+  [key: string]: unknown
 }
 
 export interface ShakapackerLoader {

data/package/optimization/webpack.ts

@@ -19,38 +19,36 @@ interface OptimizationConfig {
   minimizer: unknown[]
 }
 
-const getOptimization = (): OptimizationConfig => {
-  return {
-    minimizer: [
-      tryCssMinimizer(),
-      new TerserPlugin({
-        // SHAKAPACKER_PARALLEL env var: number of parallel workers, or true for auto (os.cpus().length - 1)
-        // If not set or invalid, defaults to true (automatic parallelization)
-        parallel: process.env.SHAKAPACKER_PARALLEL
-          ? Number.parseInt(process.env.SHAKAPACKER_PARALLEL, 10) || true
-          : true,
-        terserOptions: {
-          parse: {
-            // Let terser parse ecma 8 code but always output
-            // ES5 compliant code for older browsers
-            ecma: 8
-          },
-          compress: {
-            ecma: 5,
-            warnings: false,
-            comparisons: false
-          },
-          mangle: { safari10: true },
-          output: {
-            ecma: 5,
-            comments: false,
-            ascii_only: true
-          }
+const getOptimization = (): OptimizationConfig => ({
+  minimizer: [
+    tryCssMinimizer(),
+    new TerserPlugin({
+      // SHAKAPACKER_PARALLEL env var: number of parallel workers, or true for auto (os.cpus().length - 1)
+      // If not set or invalid, defaults to true (automatic parallelization)
+      parallel: process.env.SHAKAPACKER_PARALLEL
+        ? Number.parseInt(process.env.SHAKAPACKER_PARALLEL, 10) || true
+        : true,
+      terserOptions: {
+        parse: {
+          // Let terser parse ecma 8 code but always output
+          // ES5 compliant code for older browsers
+          ecma: 8
+        },
+        compress: {
+          ecma: 5,
+          warnings: false,
+          comparisons: false
+        },
+        mangle: { safari10: true },
+        output: {
+          ecma: 5,
+          comments: false,
+          ascii_only: true
         }
-      })
-    ].filter(Boolean)
-  }
-}
+      }
+    })
+  ].filter(Boolean)
+})
 
 export = {
   getOptimization

data/package/rspack/index.ts

@@ -4,10 +4,11 @@
 // Mixed require/import syntax:
 // - Using require() for compiled JS modules that may not have proper ES module exports
 // - Using import for type-only imports and Node.js built-in modules
-const webpackMerge = require("webpack-merge")
 import { resolve } from "path"
 import { existsSync } from "fs"
 import type { RspackConfigWithDevServer } from "../environments/types"
+
+const webpackMerge = require("webpack-merge")
 const config = require("../config")
 const baseConfig = require("../environments/base")
 const devServer = require("../dev_server")