@backstage/plugin-catalog-backend 3.8.2-next.1 → 3.8.2

package/CHANGELOG.md

@@ -1,24 +1,10 @@
 # @backstage/plugin-catalog-backend
 
-## 3.8.2-next.1
+## 3.8.2
 
 ### Patch Changes
 
-- ee40136: Fixed a missing promise return in a database migration rollback function.
-- b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.
-- Updated dependencies
-  - @backstage/integration@2.1.0-next.0
-
-## 3.8.2-next.0
-
-### Patch Changes
-
-- Updated dependencies
-  - @backstage/backend-plugin-api@1.10.0-next.0
-  - @backstage/plugin-permission-node@0.11.3-next.0
-  - @backstage/backend-openapi-utils@0.7.1-next.0
-  - @backstage/plugin-catalog-node@2.2.4-next.0
-  - @backstage/plugin-events-node@0.4.25-next.0
+- 286bfc1: Improved path validation for catalog entity placeholders.
 
 ## 3.8.1
 

package/dist/processors/PlaceholderProcessor.cjs.js

@@ -1,10 +1,12 @@
 'use strict';
 
+var parseGitUrl = require('git-url-parse');
 var yaml = require('yaml');
 var pluginCatalogNode = require('@backstage/plugin-catalog-node');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
+var parseGitUrl__default = /*#__PURE__*/_interopDefaultCompat(parseGitUrl);
 var yaml__default = /*#__PURE__*/_interopDefaultCompat(yaml);
 
 class PlaceholderProcessor {
@@ -119,6 +121,24 @@ async function readTextLocation(params) {
     );
   }
 }
+function assertSameRepository(resolvedUrl, baseUrl) {
+  let resolved;
+  let base;
+  try {
+    resolved = parseGitUrl__default.default(resolvedUrl);
+    base = parseGitUrl__default.default(baseUrl);
+  } catch {
+    return;
+  }
+  if (!resolved.owner || !resolved.name || !resolved.filepath || !base.owner || !base.name || !base.filepath) {
+    return;
+  }
+  if (resolved.resource !== base.resource || resolved.full_name !== base.full_name) {
+    throw new Error(
+      `Placeholder may only reference files from the same repository as the entity`
+    );
+  }
+}
 function relativeUrl({
   key,
   value,
@@ -131,7 +151,9 @@ function relativeUrl({
     );
   }
   try {
-    return resolveUrl(value, baseUrl);
+    const resolved = resolveUrl(value, baseUrl);
+    assertSameRepository(resolved, baseUrl);
+    return resolved;
   } catch (e) {
     throw new Error(
       `Placeholder $${key} could not form a URL out of ${baseUrl} and ${value}, ${e}`

package/dist/processors/PlaceholderProcessor.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"PlaceholderProcessor.cjs.js","sources":["../../src/processors/PlaceholderProcessor.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Entity } from '@backstage/catalog-model';\nimport { JsonValue } from '@backstage/types';\nimport { ScmIntegrationRegistry } from '@backstage/integration';\nimport yaml from 'yaml';\nimport { LocationSpec } from '@backstage/plugin-catalog-common';\nimport {\n  CatalogProcessor,\n  CatalogProcessorEmit,\n  PlaceholderResolver,\n  PlaceholderResolverParams,\n  processingResult,\n} from '@backstage/plugin-catalog-node';\nimport { UrlReaderService } from '@backstage/backend-plugin-api';\n\n/** @public */\nexport type PlaceholderProcessorOptions = {\n  resolvers: Record<string, PlaceholderResolver>;\n  reader: UrlReaderService;\n  integrations: ScmIntegrationRegistry;\n};\n\n/**\n * Traverses raw entity JSON looking for occurrences of $-prefixed placeholders\n * that it then fills in with actual data.\n * @public\n */\nexport class PlaceholderProcessor implements CatalogProcessor {\n  private readonly options: PlaceholderProcessorOptions;\n\n  constructor(options: PlaceholderProcessorOptions) {\n    this.options = options;\n  }\n\n  getProcessorName(): string {\n    return 'PlaceholderProcessor';\n  }\n\n  async preProcessEntity(\n    entity: Entity,\n    location: LocationSpec,\n    emit: CatalogProcessorEmit,\n  ): Promise<Entity> {\n    const process = async (data: any): Promise<[any, boolean]> => {\n      if (!data || !(data instanceof Object)) {\n        // Scalars can't have placeholders\n        return [data, false];\n      }\n\n      if (Array.isArray(data)) {\n        // We're an array - process all entries recursively\n        const items = await Promise.all(data.map(item => process(item)));\n        return items.every(([, changed]) => !changed)\n          ? [data, false]\n          : [items.map(([item]) => item), true];\n      }\n\n      const keys = Object.keys(data);\n      if (!keys.some(k => k.startsWith('$'))) {\n        // We're an object but no placeholders at this level - process all\n        // entries recursively\n        const entries = await Promise.all(\n          Object.entries(data).map(([k, v]) =>\n            process(v).then(vp => [k, vp] as const),\n          ),\n        );\n        return entries.every(([, [, changed]]) => !changed)\n          ? [data, false]\n          : [Object.fromEntries(entries.map(([k, [v]]) => [k, v])), true];\n      } else if (keys.length !== 1) {\n        // This was an object that had more than one key, some of which were\n        // dollar prefixed. We only handle the case where there is exactly one\n        // such key; anything else is left alone.\n        return [data, false];\n      }\n\n      const resolverKey = keys[0].substring(1);\n      const resolverValue = data[keys[0]];\n\n      const resolver = this.options.resolvers[resolverKey];\n      if (!resolver) {\n        // If there was no such placeholder resolver, we err on the side of safety\n        // and assume that this is something that's best left alone. For example, if\n        // the input contains JSONSchema, there may be \"$ref\": \"#/definitions/node\"\n        // nodes in the document.\n        return [data, false];\n      }\n\n      const read = async (url: string): Promise<Buffer> => {\n        const response = await this.options.reader.readUrl(url);\n        const buffer = await response.buffer();\n        return buffer;\n      };\n\n      const resolveUrl = (url: string, base: string): string =>\n        this.options.integrations.resolveUrl({\n          url,\n          base,\n        });\n\n      return [\n        await resolver({\n          key: resolverKey,\n          value: resolverValue,\n          baseUrl: location.target,\n          read,\n          resolveUrl,\n          emit,\n        }),\n        true,\n      ];\n    };\n\n    const [result] = await process(entity);\n    return result;\n  }\n}\n\n/*\n * Resolvers\n */\n\nexport async function yamlPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  // YAML merge support enabled by default\n  const enableYamlMerge = false;\n  const parseOptions = { merge: enableYamlMerge };\n\n  let documents: yaml.Document.Parsed[];\n  try {\n    documents = yaml.parseAllDocuments(content, parseOptions).filter(d => d);\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} failed to parse YAML data at ${params.value}, ${e}`,\n    );\n  }\n\n  if (documents.length !== 1) {\n    throw new Error(\n      `Placeholder \\$${params.key} expected to find exactly one document of data at ${params.value}, found ${documents.length}`,\n    );\n  }\n\n  const document = documents[0];\n\n  if (document.errors?.length) {\n    throw new Error(\n      `Placeholder \\$${params.key} found an error in the data at ${params.value}, ${document.errors[0]}`,\n    );\n  }\n\n  return document.toJSON();\n}\n\nexport async function jsonPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  try {\n    return JSON.parse(content);\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} failed to parse JSON data at ${params.value}, ${e}`,\n    );\n  }\n}\n\nexport async function textPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  return content;\n}\n\n/*\n * Helpers\n */\n\nasync function readTextLocation(\n  params: PlaceholderResolverParams,\n): Promise<{ content: string; url: string }> {\n  const newUrl = relativeUrl(params);\n\n  try {\n    const data = await params.read(newUrl);\n    return { content: data.toString('utf-8'), url: newUrl };\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} could not read location ${params.value}, ${e}`,\n    );\n  }\n}\n\nfunction relativeUrl({\n  key,\n  value,\n  baseUrl,\n  resolveUrl,\n}: PlaceholderResolverParams): string {\n  if (typeof value !== 'string') {\n    throw new Error(\n      `Placeholder \\$${key} expected a string value parameter, in the form of an absolute URL or a relative path`,\n    );\n  }\n\n  try {\n    return resolveUrl(value, baseUrl);\n  } catch (e) {\n    // The only remaining case that isn't support is a relative file path that should be\n    // resolved using a relative file location. Accessing local file paths can lead to\n    // path traversal attacks and access to any file on the host system. Implementing this\n    // would require additional security measures.\n    throw new Error(\n      `Placeholder \\$${key} could not form a URL out of ${baseUrl} and ${value}, ${e}`,\n    );\n  }\n}\n"],"names":["processingResult","yaml"],"mappings":";;;;;;;;;AA0CO,MAAM,oBAAA,CAAiD;AAAA,EAC3C,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAsC;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,gBAAA,GAA2B;AACzB,IAAA,OAAO,sBAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAA,CACJ,MAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,KAAuC;AAC5D,MAAA,IAAI,CAAC,IAAA,IAAQ,EAAE,IAAA,YAAgB,MAAA,CAAA,EAAS;AAEtC,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAEvB,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,IAAA,KAAQ,OAAA,CAAQ,IAAI,CAAC,CAAC,CAAA;AAC/D,QAAA,OAAO,KAAA,CAAM,MAAM,CAAC,GAAG,OAAO,CAAA,KAAM,CAAC,OAAO,CAAA,GACxC,CAAC,MAAM,KAAK,CAAA,GACZ,CAAC,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,IAAI,CAAA,KAAM,IAAI,CAAA,EAAG,IAAI,CAAA;AAAA,MACxC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAC7B,MAAA,IAAI,CAAC,KAAK,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG;AAGtC,QAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,GAAA;AAAA,UAC5B,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAA;AAAA,YAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAC7B,OAAA,CAAQ,CAAC,CAAA,CAAE,IAAA,CAAK,CAAA,EAAA,KAAM,CAAC,CAAA,EAAG,EAAE,CAAU;AAAA;AACxC,SACF;AACA,QAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAA,GAC9C,CAAC,MAAM,KAAK,CAAA,GACZ,CAAC,MAAA,CAAO,YAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;AAAA,MAClE,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAI5B,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,CAAC,CAAA,CAAE,UAAU,CAAC,CAAA;AACvC,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAElC,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,WAAW,CAAA;AACnD,MAAA,IAAI,CAAC,QAAA,EAAU;AAKb,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAiC;AACnD,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,QAAQ,GAAG,CAAA;AACtD,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,MAAA,EAAO;AACrC,QAAA,OAAO,MAAA;AAAA,MACT,CAAA;AAEA,MAAA,MAAM,aAAa,CAAC,GAAA,EAAa,SAC/B,IAAA,CAAK,OAAA,CAAQ,aAAa,UAAA,CAAW;AAAA,QACnC,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,MAAM,QAAA,CAAS;AAAA,UACb,GAAA,EAAK,WAAA;AAAA,UACL,KAAA,EAAO,aAAA;AAAA,UACP,SAAS,QAAA,CAAS,MAAA;AAAA,UAClB,IAAA;AAAA,UACA,UAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,CAAC,MAAM,CAAA,GAAI,MAAM,QAAQ,MAAM,CAAA;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAMA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKA,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAGlD,EAAA,MAAM,eAAA,GAAkB,KAAA;AACxB,EAAA,MAAM,YAAA,GAAe,EAAE,KAAA,EAAO,eAAA,EAAgB;AAE9C,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAYC,sBAAK,iBAAA,CAAkB,OAAA,EAAS,YAAY,CAAA,CAAE,MAAA,CAAO,OAAK,CAAC,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,iCAAiC,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,aAAA,EAAiB,OAAO,GAAG,CAAA,kDAAA,EAAqD,OAAO,KAAK,CAAA,QAAA,EAAW,UAAU,MAAM,CAAA;AAAA,KACzH;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,UAAU,CAAC,CAAA;AAE5B,EAAA,IAAI,QAAA,CAAS,QAAQ,MAAA,EAAQ;AAC3B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,aAAA,EAAiB,MAAA,CAAO,GAAG,CAAA,+BAAA,EAAkC,MAAA,CAAO,KAAK,CAAA,EAAA,EAAK,QAAA,CAAS,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,KAClG;AAAA,EACF;AAEA,EAAA,OAAO,SAAS,MAAA,EAAO;AACzB;AAEA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKD,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAElD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,EAC3B,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,iCAAiC,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKA,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAElD,EAAA,OAAO,OAAA;AACT;AAMA,eAAe,iBACb,MAAA,EAC2C;AAC3C,EAAA,MAAM,MAAA,GAAS,YAAY,MAAM,CAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AACrC,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,OAAO,CAAA,EAAG,KAAK,MAAA,EAAO;AAAA,EACxD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,4BAA4B,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAC3E;AAAA,EACF;AACF;AAEA,SAAS,WAAA,CAAY;AAAA,EACnB,GAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsC;AACpC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,GAAG,CAAA,qFAAA;AAAA,KACtB;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,UAAA,CAAW,OAAO,OAAO,CAAA;AAAA,EAClC,SAAS,CAAA,EAAG;AAKV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,GAAG,CAAA,6BAAA,EAAgC,OAAO,CAAA,KAAA,EAAQ,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AACF;;;;;;;"}
+{"version":3,"file":"PlaceholderProcessor.cjs.js","sources":["../../src/processors/PlaceholderProcessor.ts"],"sourcesContent":["/*\n * Copyright 2020 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Entity } from '@backstage/catalog-model';\nimport { JsonValue } from '@backstage/types';\nimport { ScmIntegrationRegistry } from '@backstage/integration';\nimport parseGitUrl from 'git-url-parse';\nimport yaml from 'yaml';\nimport { LocationSpec } from '@backstage/plugin-catalog-common';\nimport {\n  CatalogProcessor,\n  CatalogProcessorEmit,\n  PlaceholderResolver,\n  PlaceholderResolverParams,\n  processingResult,\n} from '@backstage/plugin-catalog-node';\nimport { UrlReaderService } from '@backstage/backend-plugin-api';\n\n/** @public */\nexport type PlaceholderProcessorOptions = {\n  resolvers: Record<string, PlaceholderResolver>;\n  reader: UrlReaderService;\n  integrations: ScmIntegrationRegistry;\n};\n\n/**\n * Traverses raw entity JSON looking for occurrences of $-prefixed placeholders\n * that it then fills in with actual data.\n * @public\n */\nexport class PlaceholderProcessor implements CatalogProcessor {\n  private readonly options: PlaceholderProcessorOptions;\n\n  constructor(options: PlaceholderProcessorOptions) {\n    this.options = options;\n  }\n\n  getProcessorName(): string {\n    return 'PlaceholderProcessor';\n  }\n\n  async preProcessEntity(\n    entity: Entity,\n    location: LocationSpec,\n    emit: CatalogProcessorEmit,\n  ): Promise<Entity> {\n    const process = async (data: any): Promise<[any, boolean]> => {\n      if (!data || !(data instanceof Object)) {\n        // Scalars can't have placeholders\n        return [data, false];\n      }\n\n      if (Array.isArray(data)) {\n        // We're an array - process all entries recursively\n        const items = await Promise.all(data.map(item => process(item)));\n        return items.every(([, changed]) => !changed)\n          ? [data, false]\n          : [items.map(([item]) => item), true];\n      }\n\n      const keys = Object.keys(data);\n      if (!keys.some(k => k.startsWith('$'))) {\n        // We're an object but no placeholders at this level - process all\n        // entries recursively\n        const entries = await Promise.all(\n          Object.entries(data).map(([k, v]) =>\n            process(v).then(vp => [k, vp] as const),\n          ),\n        );\n        return entries.every(([, [, changed]]) => !changed)\n          ? [data, false]\n          : [Object.fromEntries(entries.map(([k, [v]]) => [k, v])), true];\n      } else if (keys.length !== 1) {\n        // This was an object that had more than one key, some of which were\n        // dollar prefixed. We only handle the case where there is exactly one\n        // such key; anything else is left alone.\n        return [data, false];\n      }\n\n      const resolverKey = keys[0].substring(1);\n      const resolverValue = data[keys[0]];\n\n      const resolver = this.options.resolvers[resolverKey];\n      if (!resolver) {\n        // If there was no such placeholder resolver, we err on the side of safety\n        // and assume that this is something that's best left alone. For example, if\n        // the input contains JSONSchema, there may be \"$ref\": \"#/definitions/node\"\n        // nodes in the document.\n        return [data, false];\n      }\n\n      const read = async (url: string): Promise<Buffer> => {\n        const response = await this.options.reader.readUrl(url);\n        const buffer = await response.buffer();\n        return buffer;\n      };\n\n      const resolveUrl = (url: string, base: string): string =>\n        this.options.integrations.resolveUrl({\n          url,\n          base,\n        });\n\n      return [\n        await resolver({\n          key: resolverKey,\n          value: resolverValue,\n          baseUrl: location.target,\n          read,\n          resolveUrl,\n          emit,\n        }),\n        true,\n      ];\n    };\n\n    const [result] = await process(entity);\n    return result;\n  }\n}\n\n/*\n * Resolvers\n */\n\nexport async function yamlPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  // YAML merge support enabled by default\n  const enableYamlMerge = false;\n  const parseOptions = { merge: enableYamlMerge };\n\n  let documents: yaml.Document.Parsed[];\n  try {\n    documents = yaml.parseAllDocuments(content, parseOptions).filter(d => d);\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} failed to parse YAML data at ${params.value}, ${e}`,\n    );\n  }\n\n  if (documents.length !== 1) {\n    throw new Error(\n      `Placeholder \\$${params.key} expected to find exactly one document of data at ${params.value}, found ${documents.length}`,\n    );\n  }\n\n  const document = documents[0];\n\n  if (document.errors?.length) {\n    throw new Error(\n      `Placeholder \\$${params.key} found an error in the data at ${params.value}, ${document.errors[0]}`,\n    );\n  }\n\n  return document.toJSON();\n}\n\nexport async function jsonPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  try {\n    return JSON.parse(content);\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} failed to parse JSON data at ${params.value}, ${e}`,\n    );\n  }\n}\n\nexport async function textPlaceholderResolver(\n  params: PlaceholderResolverParams,\n): Promise<JsonValue> {\n  const { content, url } = await readTextLocation(params);\n\n  params.emit(processingResult.refresh(`url:${url}`));\n\n  return content;\n}\n\n/*\n * Helpers\n */\n\nasync function readTextLocation(\n  params: PlaceholderResolverParams,\n): Promise<{ content: string; url: string }> {\n  const newUrl = relativeUrl(params);\n\n  try {\n    const data = await params.read(newUrl);\n    return { content: data.toString('utf-8'), url: newUrl };\n  } catch (e) {\n    throw new Error(\n      `Placeholder \\$${params.key} could not read location ${params.value}, ${e}`,\n    );\n  }\n}\n\nfunction assertSameRepository(resolvedUrl: string, baseUrl: string): void {\n  let resolved;\n  let base;\n  try {\n    resolved = parseGitUrl(resolvedUrl);\n    base = parseGitUrl(baseUrl);\n  } catch {\n    return;\n  }\n\n  if (\n    !resolved.owner ||\n    !resolved.name ||\n    !resolved.filepath ||\n    !base.owner ||\n    !base.name ||\n    !base.filepath\n  ) {\n    return;\n  }\n\n  if (\n    resolved.resource !== base.resource ||\n    resolved.full_name !== base.full_name\n  ) {\n    throw new Error(\n      `Placeholder may only reference files from the same repository as the entity`,\n    );\n  }\n}\n\nfunction relativeUrl({\n  key,\n  value,\n  baseUrl,\n  resolveUrl,\n}: PlaceholderResolverParams): string {\n  if (typeof value !== 'string') {\n    throw new Error(\n      `Placeholder \\$${key} expected a string value parameter, in the form of an absolute URL or a relative path`,\n    );\n  }\n\n  try {\n    const resolved = resolveUrl(value, baseUrl);\n    assertSameRepository(resolved, baseUrl);\n    return resolved;\n  } catch (e) {\n    // The only remaining case that isn't support is a relative file path that should be\n    // resolved using a relative file location. Accessing local file paths can lead to\n    // path traversal attacks and access to any file on the host system. Implementing this\n    // would require additional security measures.\n    throw new Error(\n      `Placeholder \\$${key} could not form a URL out of ${baseUrl} and ${value}, ${e}`,\n    );\n  }\n}\n"],"names":["processingResult","yaml","parseGitUrl"],"mappings":";;;;;;;;;;;AA2CO,MAAM,oBAAA,CAAiD;AAAA,EAC3C,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAsC;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,gBAAA,GAA2B;AACzB,IAAA,OAAO,sBAAA;AAAA,EACT;AAAA,EAEA,MAAM,gBAAA,CACJ,MAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,KAAuC;AAC5D,MAAA,IAAI,CAAC,IAAA,IAAQ,EAAE,IAAA,YAAgB,MAAA,CAAA,EAAS;AAEtC,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AAEvB,QAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA,IAAA,KAAQ,OAAA,CAAQ,IAAI,CAAC,CAAC,CAAA;AAC/D,QAAA,OAAO,KAAA,CAAM,MAAM,CAAC,GAAG,OAAO,CAAA,KAAM,CAAC,OAAO,CAAA,GACxC,CAAC,MAAM,KAAK,CAAA,GACZ,CAAC,KAAA,CAAM,GAAA,CAAI,CAAC,CAAC,IAAI,CAAA,KAAM,IAAI,CAAA,EAAG,IAAI,CAAA;AAAA,MACxC;AAEA,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA;AAC7B,MAAA,IAAI,CAAC,KAAK,IAAA,CAAK,CAAA,CAAA,KAAK,EAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG;AAGtC,QAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,GAAA;AAAA,UAC5B,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAA;AAAA,YAAI,CAAC,CAAC,CAAA,EAAG,CAAC,CAAA,KAC7B,OAAA,CAAQ,CAAC,CAAA,CAAE,IAAA,CAAK,CAAA,EAAA,KAAM,CAAC,CAAA,EAAG,EAAE,CAAU;AAAA;AACxC,SACF;AACA,QAAA,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAA,GAC9C,CAAC,MAAM,KAAK,CAAA,GACZ,CAAC,MAAA,CAAO,YAAY,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA,KAAM,CAAC,CAAA,EAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;AAAA,MAClE,CAAA,MAAA,IAAW,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAI5B,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,MAAM,WAAA,GAAc,IAAA,CAAK,CAAC,CAAA,CAAE,UAAU,CAAC,CAAA;AACvC,MAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,IAAA,CAAK,CAAC,CAAC,CAAA;AAElC,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,WAAW,CAAA;AACnD,MAAA,IAAI,CAAC,QAAA,EAAU;AAKb,QAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAAA,MACrB;AAEA,MAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAiC;AACnD,QAAA,MAAM,WAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,QAAQ,GAAG,CAAA;AACtD,QAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,MAAA,EAAO;AACrC,QAAA,OAAO,MAAA;AAAA,MACT,CAAA;AAEA,MAAA,MAAM,aAAa,CAAC,GAAA,EAAa,SAC/B,IAAA,CAAK,OAAA,CAAQ,aAAa,UAAA,CAAW;AAAA,QACnC,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AAEH,MAAA,OAAO;AAAA,QACL,MAAM,QAAA,CAAS;AAAA,UACb,GAAA,EAAK,WAAA;AAAA,UACL,KAAA,EAAO,aAAA;AAAA,UACP,SAAS,QAAA,CAAS,MAAA;AAAA,UAClB,IAAA;AAAA,UACA,UAAA;AAAA,UACA;AAAA,SACD,CAAA;AAAA,QACD;AAAA,OACF;AAAA,IACF,CAAA;AAEA,IAAA,MAAM,CAAC,MAAM,CAAA,GAAI,MAAM,QAAQ,MAAM,CAAA;AACrC,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAMA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKA,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAGlD,EAAA,MAAM,eAAA,GAAkB,KAAA;AACxB,EAAA,MAAM,YAAA,GAAe,EAAE,KAAA,EAAO,eAAA,EAAgB;AAE9C,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAYC,sBAAK,iBAAA,CAAkB,OAAA,EAAS,YAAY,CAAA,CAAE,MAAA,CAAO,OAAK,CAAC,CAAA;AAAA,EACzE,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,iCAAiC,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,aAAA,EAAiB,OAAO,GAAG,CAAA,kDAAA,EAAqD,OAAO,KAAK,CAAA,QAAA,EAAW,UAAU,MAAM,CAAA;AAAA,KACzH;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,UAAU,CAAC,CAAA;AAE5B,EAAA,IAAI,QAAA,CAAS,QAAQ,MAAA,EAAQ;AAC3B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,aAAA,EAAiB,MAAA,CAAO,GAAG,CAAA,+BAAA,EAAkC,MAAA,CAAO,KAAK,CAAA,EAAA,EAAK,QAAA,CAAS,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,KAClG;AAAA,EACF;AAEA,EAAA,OAAO,SAAS,MAAA,EAAO;AACzB;AAEA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKD,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAElD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,EAC3B,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,iCAAiC,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AACF;AAEA,eAAsB,wBACpB,MAAA,EACoB;AACpB,EAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,MAAM,iBAAiB,MAAM,CAAA;AAEtD,EAAA,MAAA,CAAO,KAAKA,kCAAA,CAAiB,OAAA,CAAQ,CAAA,IAAA,EAAO,GAAG,EAAE,CAAC,CAAA;AAElD,EAAA,OAAO,OAAA;AACT;AAMA,eAAe,iBACb,MAAA,EAC2C;AAC3C,EAAA,MAAM,MAAA,GAAS,YAAY,MAAM,CAAA;AAEjC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AACrC,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,SAAS,OAAO,CAAA,EAAG,KAAK,MAAA,EAAO;AAAA,EACxD,SAAS,CAAA,EAAG;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,MAAA,CAAO,GAAG,4BAA4B,MAAA,CAAO,KAAK,KAAK,CAAC,CAAA;AAAA,KAC3E;AAAA,EACF;AACF;AAEA,SAAS,oBAAA,CAAqB,aAAqB,OAAA,EAAuB;AACxE,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAWE,6BAAY,WAAW,CAAA;AAClC,IAAA,IAAA,GAAOA,6BAAY,OAAO,CAAA;AAAA,EAC5B,CAAA,CAAA,MAAQ;AACN,IAAA;AAAA,EACF;AAEA,EAAA,IACE,CAAC,QAAA,CAAS,KAAA,IACV,CAAC,QAAA,CAAS,QACV,CAAC,QAAA,CAAS,QAAA,IACV,CAAC,KAAK,KAAA,IACN,CAAC,KAAK,IAAA,IACN,CAAC,KAAK,QAAA,EACN;AACA,IAAA;AAAA,EACF;AAEA,EAAA,IACE,SAAS,QAAA,KAAa,IAAA,CAAK,YAC3B,QAAA,CAAS,SAAA,KAAc,KAAK,SAAA,EAC5B;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2EAAA;AAAA,KACF;AAAA,EACF;AACF;AAEA,SAAS,WAAA,CAAY;AAAA,EACnB,GAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,EAAsC;AACpC,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,GAAG,CAAA,qFAAA;AAAA,KACtB;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,EAAO,OAAO,CAAA;AAC1C,IAAA,oBAAA,CAAqB,UAAU,OAAO,CAAA;AACtC,IAAA,OAAO,QAAA;AAAA,EACT,SAAS,CAAA,EAAG;AAKV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,gBAAiB,GAAG,CAAA,6BAAA,EAAgC,OAAO,CAAA,KAAA,EAAQ,KAAK,KAAK,CAAC,CAAA;AAAA,KAChF;AAAA,EACF;AACF;;;;;;;"}