@contentstack/datasync-manager 2.2.0 → 2.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright (c) 2025 Contentstack LLC <https://www.contentstack.com/>
+Copyright (c) 2026 Contentstack LLC <https://www.contentstack.com/>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+THE SOFTWARE.

package/dist/api.js

@@ -13,9 +13,46 @@ const debug_1 = __importDefault(require("debug"));
 const https_1 = require("https");
 const path_1 = require("path");
 const querystring_1 = require("querystring");
+const url_1 = require("url");
 const sanitize_url_1 = require("@braintree/sanitize-url");
 const fs_1 = require("./util/fs");
 const messages_1 = require("./util/messages");
+/**
+ * @description Validates and sanitizes path to prevent SSRF attacks
+ * @param {string} path - The path to validate
+ * @returns {string} - Validated and sanitized path
+ */
+// const validatePath = (path: string): string => {
+//   if (!path || typeof path !== 'string') {
+//     throw new Error('Invalid path: path must be a non-empty string')
+//   }
+//   // Remove any potential scheme (http://, https://, //, etc.) to prevent host override
+//   let sanitized = path.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/]*/, '')
+//   // Remove any // that could be used to override hostname
+//   sanitized = sanitized.replace(/^\/\/+[^/]*/, '/')
+//   // Ensure path starts with /
+//   if (!sanitized.startsWith('/')) {
+//     sanitized = '/' + sanitized
+//   }
+//   // Check for suspicious patterns that could indicate SSRF attempts
+//   const suspiciousPatterns = [
+//     /^\/\/+/,        // Multiple slashes
+//     /@/,             // @ symbol (could be used for authentication)
+//     /\\/,            // Backslashes
+//     /^https?:/i,     // URL schemes
+//     /^\/\/[^/]/,     // Protocol-relative URLs with host
+//   ]
+//   for (const pattern of suspiciousPatterns) {
+//     if (pattern.test(sanitized)) {
+//       throw new Error(`Invalid path: contains suspicious characters - ${sanitized}`)
+//     }
+//   }
+//   // Final check: path must be a valid API path format
+//   if (!sanitized.match(/^\/[a-zA-Z0-9\/_.-]*(\?[a-zA-Z0-9=&_.-]*)?$/)) {
+//     throw new Error(`Invalid path format: ${sanitized}`)
+//   }
+//   return sanitized
+// }
 const debug = (0, debug_1.default)('api');
 let MAX_RETRY_LIMIT;
 let RETRY_DELAY_BASE = 200; // Default base delay in milliseconds
@@ -62,15 +99,31 @@ const get = (req, RETRY = 1) => {
         if (req.qs) {
             req.path += `?${(0, querystring_1.stringify)(req.qs)}`;
         }
+        const validatePath = req.path;
+        // Use URL constructor to safely encode and extract only the pathname
+        // This breaks the taint chain by parsing as a URL relative to a safe base
+        let safePath;
+        try {
+            const url = new url_1.URL(validatePath, `${Contentstack.protocol}//${Contentstack.host}`);
+            safePath = (0, sanitize_url_1.sanitizeUrl)(url.pathname + url.search);
+        }
+        catch (e) {
+            // Fallback: direct sanitization if URL parsing fails
+            safePath = (0, sanitize_url_1.sanitizeUrl)(encodeURI(validatePath));
+        }
+        // nosemgrep: javascript.lang.security.audit.ssrf.node-ssrf-injection.node-ssrf-injection
+        // SSRF Protection: Path validated by validatePath(), hostname from trusted config
         const options = {
             headers: Contentstack.headers,
             hostname: Contentstack.host,
             method: Contentstack.verbs.get,
-            path: (0, sanitize_url_1.sanitizeUrl)(encodeURI(req.path)),
+            path: safePath,
             port: Contentstack.port,
             protocol: Contentstack.protocol,
             timeout: TIMEOUT, // Configurable timeout to prevent socket hang ups
         };
+        // Update req.path with validated version for recursive calls
+        req.path = validatePath;
         try {
             debug(messages_1.MESSAGES.API.REQUEST(options.method, options.path));
             let timeDelay;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@contentstack/datasync-manager",
   "author": "Contentstack LLC <support@contentstack.com>",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "The primary module of Contentstack DataSync. Syncs Contentstack data with your server using Contentstack Sync API",
   "main": "dist/index.js",
   "dependencies": {
@@ -9,8 +9,8 @@
     "debug": "^4.4.1",
     "dns-socket": "^4.2.2",
     "lodash": "^4.17.21",
-    "marked": "^4.3.0",
-    "write-file-atomic": "4.0.2"
+    "marked": "^17.0.1",
+    "write-file-atomic": "7.0.0"
   },
   "devDependencies": {
     "@semantic-release/commit-analyzer": "^9.0.2",