@contrail/cli 3.4.5 → 3.4.6-alpha.cffb28e

package/node_modules/@pinojs/redact/test/prototype-pollution.test.js

@@ -0,0 +1,223 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+/* eslint-disable no-proto */
+
+test('prototype pollution: __proto__ path should not pollute Object prototype', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property if it exists as a regular property
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: constructor.prototype path should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    constructor: {
+      prototype: { isAdmin: true }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['constructor.prototype.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the constructor.prototype property if it exists as a regular property
+  assert.strictEqual(result.constructor.prototype.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: nested __proto__ should not pollute', () => {
+  const obj = {
+    user: {
+      settings: {
+        __proto__: { isAdmin: true }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['user.settings.__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the nested __proto__ property
+  assert.strictEqual(result.user.settings.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: bracket notation __proto__ should not pollute', () => {
+  const obj = {
+    user: { name: 'john' },
+    __proto__: { isAdmin: true }
+  }
+
+  const redact = slowRedact({
+    paths: ['["__proto__"]["isAdmin"]'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact the __proto__ property when accessed via bracket notation
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: wildcard with __proto__ should not pollute', () => {
+  const obj = {
+    users: {
+      __proto__: { isAdmin: true },
+      user1: { name: 'john' },
+      user2: { name: 'jane' }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['users.*'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should redact only own properties
+  assert.strictEqual(result.users.user1, '[REDACTED]')
+  assert.strictEqual(result.users.user2, '[REDACTED]')
+
+  // __proto__ should only be redacted if it's an own property, not inherited
+  if (Object.prototype.hasOwnProperty.call(obj.users, '__proto__')) {
+    assert.strictEqual(result.users.__proto__, '[REDACTED]')
+  }
+})
+
+test('prototype pollution: malicious JSON payload should not pollute', () => {
+  // Simulate a malicious payload that might come from JSON.parse
+  const maliciousObj = JSON.parse('{"user": {"name": "john"}, "__proto__": {"isAdmin": true}}')
+
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(maliciousObj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // The malicious payload should have been redacted
+  assert.strictEqual(result.__proto__.isAdmin, '[REDACTED]')
+})
+
+test('prototype pollution: verify prototype chain is preserved', () => {
+  function CustomClass () {
+    this.data = 'test'
+  }
+  CustomClass.prototype.method = function () { return 'original' }
+
+  const obj = new CustomClass()
+
+  const redact = slowRedact({
+    paths: ['data'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should redact the data property
+  assert.strictEqual(result.data, '[REDACTED]')
+
+  // Should preserve the original prototype chain
+  assert.strictEqual(result.method(), 'original')
+  assert.strictEqual(Object.getPrototypeOf(result), CustomClass.prototype)
+})
+
+test('prototype pollution: setValue should not create prototype pollution', () => {
+  const obj = { user: { name: 'john' } }
+
+  // Try to pollute via non-existent path that could create __proto__
+  const redact = slowRedact({
+    paths: ['__proto__.isAdmin'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+
+  // Should not create the path if it doesn't exist
+  // The __proto__ property may exist due to Object.create, but should not contain our redacted value
+  if (result.__proto__) {
+    assert.strictEqual(result.__proto__.isAdmin, undefined)
+  }
+})
+
+test('prototype pollution: deep nested prototype properties should not pollute', () => {
+  const obj = {
+    level1: {
+      level2: {
+        level3: {
+          __proto__: { isAdmin: true },
+          constructor: {
+            prototype: { isEvil: true }
+          }
+        }
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: [
+      'level1.level2.level3.__proto__.isAdmin',
+      'level1.level2.level3.constructor.prototype.isEvil'
+    ],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should not pollute Object.prototype
+  assert.strictEqual(Object.prototype.isAdmin, undefined)
+  assert.strictEqual(Object.prototype.isEvil, undefined)
+  assert.strictEqual({}.isAdmin, undefined)
+  assert.strictEqual({}.isEvil, undefined)
+
+  // Should redact the deep nested properties
+  assert.strictEqual(result.level1.level2.level3.__proto__.isAdmin, '[REDACTED]')
+  assert.strictEqual(result.level1.level2.level3.constructor.prototype.isEvil, '[REDACTED]')
+})

package/node_modules/@pinojs/redact/test/selective-clone.test.js

@@ -0,0 +1,115 @@
+const { test } = require('node:test')
+const { strict: assert } = require('node:assert')
+const slowRedact = require('../index.js')
+
+test('selective cloning shares references for non-redacted paths', () => {
+  const sharedObject = { unchanged: 'data' }
+  const obj = {
+    toRedact: 'secret',
+    shared: sharedObject,
+    nested: {
+      toRedact: 'secret2',
+      shared: sharedObject
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['toRedact', 'nested.toRedact'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Redacted values should be different
+  assert.strictEqual(result.toRedact, '[REDACTED]')
+  assert.strictEqual(result.nested.toRedact, '[REDACTED]')
+
+  // Non-redacted references should be shared (same object reference)
+  assert.strictEqual(result.shared, obj.shared)
+  assert.strictEqual(result.nested.shared, obj.nested.shared)
+
+  // The shared object should be the exact same reference
+  assert.strictEqual(result.shared, sharedObject)
+  assert.strictEqual(result.nested.shared, sharedObject)
+})
+
+test('selective cloning works with arrays', () => {
+  const sharedItem = { unchanged: 'data' }
+  const obj = {
+    items: [
+      { secret: 'hidden1', shared: sharedItem },
+      { secret: 'hidden2', shared: sharedItem },
+      sharedItem
+    ]
+  }
+
+  const redact = slowRedact({
+    paths: ['items.*.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Secrets should be redacted
+  assert.strictEqual(result.items[0].secret, '[REDACTED]')
+  assert.strictEqual(result.items[1].secret, '[REDACTED]')
+
+  // Shared references should be preserved where possible
+  // Note: array items with secrets will be cloned, but their shared properties should still reference the original
+  assert.strictEqual(result.items[0].shared, sharedItem)
+  assert.strictEqual(result.items[1].shared, sharedItem)
+
+  // The third item gets cloned due to wildcard, but should have the same content
+  assert.deepStrictEqual(result.items[2], sharedItem)
+  // Note: Due to wildcard '*', all array items are cloned, even if they don't need redaction
+  // This is still a significant optimization for object properties that aren't in wildcard paths
+})
+
+test('selective cloning with no paths returns original object', () => {
+  const obj = { data: 'unchanged' }
+  const redact = slowRedact({
+    paths: [],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Should return the exact same object reference
+  assert.strictEqual(result, obj)
+})
+
+test('selective cloning performance - large objects with minimal redaction', () => {
+  // Create a large object with mostly shared data
+  const sharedData = { large: 'data'.repeat(1000) }
+  const obj = {
+    secret: 'hidden',
+    shared1: sharedData,
+    shared2: sharedData,
+    nested: {
+      secret: 'hidden2',
+      shared3: sharedData,
+      deep: {
+        shared4: sharedData,
+        moreShared: sharedData
+      }
+    }
+  }
+
+  const redact = slowRedact({
+    paths: ['secret', 'nested.secret'],
+    serialize: false
+  })
+
+  const result = redact(obj)
+
+  // Verify redaction worked
+  assert.strictEqual(result.secret, '[REDACTED]')
+  assert.strictEqual(result.nested.secret, '[REDACTED]')
+
+  // Verify shared references are preserved
+  assert.strictEqual(result.shared1, sharedData)
+  assert.strictEqual(result.shared2, sharedData)
+  assert.strictEqual(result.nested.shared3, sharedData)
+  assert.strictEqual(result.nested.deep.shared4, sharedData)
+  assert.strictEqual(result.nested.deep.moreShared, sharedData)
+})

package/node_modules/@pinojs/redact/tsconfig.json

@@ -0,0 +1,19 @@
+{
+    "compilerOptions": {
+        "module": "commonjs",
+        "lib": [
+            "es6"
+        ],
+        "noImplicitAny": true,
+        "noImplicitThis": true,
+        "strictFunctionTypes": true,
+        "strictNullChecks": true,
+        "types": [],
+        "noEmit": true,
+        "forceConsistentCasingInFileNames": true
+    },
+    "files": [
+        "index.d.ts",
+        "index.test-d.ts"
+    ]
+}

package/node_modules/atomic-sleep/.travis.yml

@@ -0,0 +1,11 @@
+language: node_js
+sudo: false
+node_js:
+  - 6
+  - 8
+  - 10
+  - 11
+  - 12
+  - 13
+script:
+  - npm run ci

package/node_modules/atomic-sleep/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+Copyright (c) 2020 David Mark Clements
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
+OR OTHER DEALINGS IN THE SOFTWARE.
+

package/node_modules/atomic-sleep/index.js

@@ -0,0 +1,38 @@
+'use strict'
+
+/* global SharedArrayBuffer, Atomics */
+
+if (typeof SharedArrayBuffer !== 'undefined' && typeof Atomics !== 'undefined') {
+  const nil = new Int32Array(new SharedArrayBuffer(4))
+
+  function sleep (ms) {
+    // also filters out NaN, non-number types, including empty strings, but allows bigints
+    const valid = ms > 0 && ms < Infinity 
+    if (valid === false) {
+      if (typeof ms !== 'number' && typeof ms !== 'bigint') {
+        throw TypeError('sleep: ms must be a number')
+      }
+      throw RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity')
+    }
+
+    Atomics.wait(nil, 0, 0, Number(ms))
+  }
+  module.exports = sleep
+} else {
+
+  function sleep (ms) {
+    // also filters out NaN, non-number types, including empty strings, but allows bigints
+    const valid = ms > 0 && ms < Infinity 
+    if (valid === false) {
+      if (typeof ms !== 'number' && typeof ms !== 'bigint') {
+        throw TypeError('sleep: ms must be a number')
+      }
+      throw RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity')
+    }
+    const target = Date.now() + Number(ms)
+    while (target > Date.now()){}
+  }
+
+  module.exports = sleep
+
+}

package/node_modules/atomic-sleep/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "atomic-sleep",
+  "version": "1.0.0",
+  "description": "Zero CPU overhead, zero dependency, true event-loop blocking sleep",
+  "main": "index.js",
+  "scripts": {
+    "test": "tap -R classic- -j1 test",
+    "lint": "standard",
+    "ci": "npm run lint && npm test"
+  },
+  "keywords": [
+    "sleep",
+    "pause",
+    "wait",
+    "performance",
+    "atomics"
+  ],
+  "engines": {
+    "node": ">=8.0.0"
+  },
+  "author": "David Mark Clements (@davidmarkclem)",
+  "license": "MIT",
+  "devDependencies": {
+    "standard": "^14.3.1",
+    "tap": "^14.10.6",
+    "tape": "^4.13.2"
+  },
+  "dependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/davidmarkclements/atomic-sleep.git"
+  },
+  "bugs": {
+    "url": "https://github.com/davidmarkclements/atomic-sleep/issues"
+  },
+  "homepage": "https://github.com/davidmarkclements/atomic-sleep#readme"
+}

package/node_modules/atomic-sleep/readme.md

@@ -0,0 +1,58 @@
+<h1 align="center">Welcome to atomic-sleep ⏱️</h1>
+<p>
+  <img alt="Version" src="https://img.shields.io/badge/version-1.0.0-blue.svg?cacheSeconds=2592000" />
+  <a href="#" target="_blank">
+    <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
+  </a>
+  <a href="https://twitter.com/davidmarkclem" target="_blank">
+    <img alt="Twitter: davidmarkclem" src="https://img.shields.io/twitter/follow/davidmarkclem.svg?style=social" />
+  </a>
+</p>
+
+> Zero CPU overhead, zero dependency, true event-loop blocking sleep
+
+## Usage
+
+```js
+const sleep = require('atomic-sleep')
+
+console.time('sleep')
+setTimeout(() => { console.timeEnd('sleep') }, 100) 
+sleep(1000)
+```
+
+The `console.time` will report a time of just over 1000ms despite the `setTimeout`
+being 100ms. This is because the event loop is paused for 1000ms and the setTimeout
+fires immediately after the event loop is no longer blocked (as more than 100ms have passed).
+
+## Install
+
+```sh
+npm install
+```
+
+## Run tests
+
+```sh
+npm test
+```
+
+## Support
+
+Node and Browser versions that support both `SharedArrayBuffer` and `Atomics` will have (virtually) zero CPU overhead sleep. 
+
+For Node, Atomic Sleep can provide zero CPU overhead sleep from Node 8 and up.
+
+For browser support see https://caniuse.com/#feat=sharedarraybuffer and https://caniuse.com/#feat=mdn-javascript_builtins_atomics.
+
+
+For older Node versions and olders browsers we fall back to blocking the event loop in a way that will cause a CPU spike. 
+
+
+
+## Author
+
+👤 **David Mark Clements (@davidmarkclem)**
+
+* Twitter: [@davidmarkclem](https://twitter.com/davidmarkclem)
+* Github: [@davidmarkclements](https://github.com/davidmarkclements)

package/node_modules/atomic-sleep/test.js

@@ -0,0 +1,47 @@
+'use strict'
+const test = require('tape')
+const sleep = require('.')
+
+test('blocks event loop for given amount of milliseconds', ({ is, end }) => {
+  const now = Date.now()
+  setTimeout(() => {
+    const delta = Date.now() - now
+    const fuzzyDelta = Math.floor(delta / 10) * 10 // allow up to 10ms of execution lag
+    is(fuzzyDelta, 1000)
+    end()
+  }, 100)
+  sleep(1000)
+})
+
+if (typeof BigInt !== 'undefined') {
+
+  test('allows ms to be supplied as a BigInt number', ({ is, end }) => {
+    const now = Date.now()
+    setTimeout(() => {
+      const delta = Date.now() - now
+      const fuzzyDelta = Math.floor(delta / 10) * 10 // allow up to 10ms of execution lag
+      is(fuzzyDelta, 1000)
+      end()
+    }, 100)
+    sleep(BigInt(1000)) // avoiding n notation as this will error on legacy node/browsers
+  })
+
+}
+
+test('throws range error if ms less than 0', ({ throws, end }) => {
+  throws(() => sleep(-1), RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity'))
+  end()
+})
+
+test('throws range error if ms is Infinity', ({ throws, end }) => {
+  throws(() => sleep(Infinity), RangeError('sleep: ms must be a number that is greater than 0 but less than Infinity'))
+  end()
+})
+
+test('throws range error if ms is not a number or bigint', ({ throws, end }) => {
+  throws(() => sleep('Infinity'), TypeError('sleep: ms must be a number'))
+  throws(() => sleep('foo'), TypeError('sleep: ms must be a number'))
+  throws(() => sleep({a: 1}), TypeError('sleep: ms must be a number'))
+  throws(() => sleep([1,2,3]), TypeError('sleep: ms must be a number'))
+  end()
+})

package/node_modules/on-exit-leak-free/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: '/'
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10
+- package-ecosystem: npm
+  directory: '/'
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10

package/node_modules/on-exit-leak-free/.github/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+on:
+  push:
+    paths-ignore:
+        - 'docs/**'
+        - '*.md'
+  pull_request:
+    paths-ignore:
+        - 'docs/**'
+        - '*.md'
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        node-version: [14, 16, 18, 20]
+        os: [macos-latest, ubuntu-latest, windows-latest]
+        exclude:
+          - node-version: 14
+            os: windows-latest
+
+    steps:
+
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install
+        run: |
+          npm install --ignore-scripts
+
+      - name: Run tests
+        run: |
+          npm run test
+
+  automerge:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v3.9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

package/node_modules/on-exit-leak-free/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Matteo Collina
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.