@codacy/tools-jackson 0.3.0 → 0.4.0

package/dist/index.js

@@ -128,8 +128,46 @@ var adapter = {
     const enabledPatterns = new Set(codacyConfig.patterns.map((p) => p.patternId));
     const checkParseError = enabledPatterns.has(PATTERN_PARSE_ERROR);
     const checkDuplicateKeys = enabledPatterns.has(PATTERN_DUPLICATE_KEYS);
+    let rootReal;
+    try {
+      rootReal = await import_promises.default.realpath(ctx.repositoryRoot);
+    } catch (err) {
+      errors.push({
+        toolId: TOOL_ID,
+        phase: "toolInvoke",
+        kind: "FileReadError",
+        message: `Cannot resolve repository root: ${err instanceof Error ? err.message : String(err)}`,
+        level: "error"
+      });
+      return buildResult(startedAt, /* @__PURE__ */ new Date(), issues, errors, ctx.targetFiles.length);
+    }
     for (const relPath of ctx.targetFiles) {
       const absPath = import_path.default.resolve(ctx.repositoryRoot, relPath);
+      const relToRoot = import_path.default.relative(ctx.repositoryRoot, absPath);
+      if (relToRoot === ".." || relToRoot.startsWith(`..${import_path.default.sep}`) || import_path.default.isAbsolute(relToRoot)) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "toolInvoke",
+          kind: "FileReadError",
+          message: `Refusing path outside repository root: ${relPath}`,
+          level: "warning",
+          filePath: relPath
+        });
+        continue;
+      }
+      const fileReal = await import_promises.default.realpath(absPath).catch(() => null);
+      const realRelative = fileReal ? import_path.default.relative(rootReal, fileReal) : null;
+      if (realRelative !== null && (realRelative === ".." || realRelative.startsWith(`..${import_path.default.sep}`) || import_path.default.isAbsolute(realRelative))) {
+        errors.push({
+          toolId: TOOL_ID,
+          phase: "toolInvoke",
+          kind: "FileReadError",
+          message: `Refusing path outside repository root: ${relPath}`,
+          level: "warning",
+          filePath: relPath
+        });
+        continue;
+      }
       let content;
       try {
         content = await import_promises.default.readFile(absPath, "utf-8");
@@ -144,14 +182,15 @@ var adapter = {
         });
         continue;
       }
-      let parseFailed = false;
-      if (checkParseError) {
+      const strippedContent = stripJsonComments(content);
+      let syntaxValid = true;
+      if (checkParseError || checkDuplicateKeys) {
         try {
-          JSON.parse(content);
+          JSON.parse(strippedContent);
         } catch (err) {
-          if (err instanceof SyntaxError) {
-            parseFailed = true;
-            const { line, column } = extractPosition(err.message, content);
+          syntaxValid = false;
+          if (checkParseError && err instanceof SyntaxError) {
+            const { line, column } = extractPosition(err.message, strippedContent);
             const lines = content.split("\n");
             const lineContent = lines[line - 1] ?? "";
             issues.push({
@@ -168,8 +207,8 @@ var adapter = {
           }
         }
       }
-      if (checkDuplicateKeys && !parseFailed) {
-        const duplicates = findDuplicateKeys(content);
+      if (checkDuplicateKeys && syntaxValid) {
+        const duplicates = findDuplicateKeys(strippedContent);
         const lines = content.split("\n");
         for (const dup of duplicates) {
           const lineContent = lines[dup.line - 1] ?? "";
@@ -213,6 +252,59 @@ var adapter = {
     };
   }
 };
+function stripJsonComments(source) {
+  const len = source.length;
+  const result = new Array(len);
+  let i = 0;
+  while (i < len) {
+    const ch = source[i];
+    if (ch === '"') {
+      result[i] = ch;
+      i++;
+      while (i < len) {
+        const sc = source[i];
+        result[i] = sc;
+        i++;
+        if (sc === "\\" && i < len) {
+          result[i] = source[i];
+          i++;
+        } else if (sc === '"') {
+          break;
+        }
+      }
+      continue;
+    }
+    if (ch === "/" && i + 1 < len && source[i + 1] === "*") {
+      result[i] = " ";
+      result[i + 1] = " ";
+      i += 2;
+      while (i < len) {
+        if (source[i] === "*" && i + 1 < len && source[i + 1] === "/") {
+          result[i] = " ";
+          result[i + 1] = " ";
+          i += 2;
+          break;
+        }
+        result[i] = source[i] === "\n" ? "\n" : " ";
+        i++;
+      }
+      continue;
+    }
+    if (ch === "/" && i + 1 < len && source[i + 1] === "/") {
+      result[i] = " ";
+      result[i + 1] = " ";
+      i += 2;
+      while (i < len && source[i] !== "\n") {
+        result[i] = " ";
+        i++;
+      }
+      continue;
+    }
+    result[i] = ch;
+    i++;
+  }
+  return result.join("");
+}
 function extractPosition(message, source) {
   const posMatch = message.match(/position (\d+)/);
   if (posMatch) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-jackson",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Jackson Linter adapter — pure TypeScript JSON syntax validator",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.3.0"
+    "@codacy/tooling": "0.4.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",