@contrail/flexplm 1.7.2 → 1.7.3-alpha.2a853f5

package/lib/interfaces/interfaces.d.ts

@@ -14,6 +14,7 @@ export interface FCConfig {
     urlContext: string;
     vibeEventEndpoint: string;
     csrfEndpoint: string;
+    useDistinctRestEndPointForImages?: boolean;
     itemPreDevelopmentLifecycleStages: string[];
     identifierAtts?: {
         [key: string]: string[];

package/lib/util/config-defaults.d.ts

@@ -2,6 +2,8 @@ import { FCConfig } from '../interfaces/interfaces';
 export declare class ConfigDefaults {
     static NEED_CONFIG_VALUES: string;
     static STATIC_CONFIG_CACHE: {};
+    static PROTO_KEYS: string[];
+    static stripProtoKeys(obj: any): any;
     static setConfigDefaults(config: any): Promise<FCConfig>;
     static getDefaultConfig(): {
         urlContext: string;
@@ -17,6 +19,7 @@ export declare class ConfigDefaults {
         LCSMaterial: {
             processAsItem: boolean;
         };
+        useDistinctRestEndPointForImages: boolean;
         csrfEndpoint: string;
         vibeEventEndpoint: string;
         payloadDefaultAsArray: boolean;

package/lib/util/config-defaults.js

@@ -5,12 +5,29 @@ const sdk_1 = require("@contrail/sdk");
 const util_1 = require("@contrail/util");
 const type_defaults_1 = require("./type-defaults");
 class ConfigDefaults {
+    static stripProtoKeys(obj) {
+        if (obj && typeof obj === 'object' && !(obj instanceof Date)) {
+            for (const key of Object.keys(obj)) {
+                if (ConfigDefaults.PROTO_KEYS.includes(key)) {
+                    delete obj[key];
+                }
+                else {
+                    ConfigDefaults.stripProtoKeys(obj[key]); // recurse into nested payloads
+                }
+            }
+        }
+        return obj;
+    }
     static async setConfigDefaults(config) {
-        //Validate config
+        // Validate config
         if (!config.apiHost || !config.userName || !config.password) {
             throw new Error(ConfigDefaults.NEED_CONFIG_VALUES);
         }
-        //List will be comma separated list in UI, so convert to array
+        if (config.complexConfig && typeof config.complexConfig === 'object') {
+            Object.assign(config, ConfigDefaults.stripProtoKeys(config.complexConfig));
+            delete config.complexConfig;
+        }
+        // List will be comma separated list in UI, so convert to array
         if (config?.itemPreDevelopmentLifecycleStages && !(config?.itemPreDevelopmentLifecycleStages instanceof Array)) {
             config.itemPreDevelopmentLifecycleStages = config.itemPreDevelopmentLifecycleStages.split(',');
         }
@@ -28,7 +45,7 @@ class ConfigDefaults {
         const pass = outputConfig.password;
         outputConfig.userName = () => uName;
         outputConfig.password = () => pass;
-        //Don't allow overwriting this.
+        // Don't allow overwriting this.
         outputConfig['OOBvibeEventEndpoint'] = '/rfa/vibeiq/vibeEvents';
         type_defaults_1.TypeDefaults.applyConfig(outputConfig);
         console.log('outputConfig: ' + JSON.stringify(outputConfig));
@@ -38,20 +55,21 @@ class ConfigDefaults {
         return {
             urlContext: '/Windchill',
             sendMode: {
-                ASYNC_PUBLISH_SEASON: 'vibeiqfile'
+                ASYNC_PUBLISH_SEASON: 'vibeiqfile',
             },
             itemPreDevelopmentLifecycleStages: ['concept'],
             identifierAtts: {
                 LCSProduct: ['itemNumber'],
                 LCSSeason: ['flexPLMSeasonName'],
-                LCSSKU: ['itemNumber']
+                LCSSKU: ['itemNumber'],
             },
             LCSMaterial: {
-                processAsItem: false
+                processAsItem: false,
             },
+            useDistinctRestEndPointForImages: false,
             csrfEndpoint: '/servlet/rest/security/csrf',
             vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
-            payloadDefaultAsArray: true
+            payloadDefaultAsArray: true,
         };
     }
     static async getConfigFile(fileId) {
@@ -96,3 +114,4 @@ class ConfigDefaults {
 exports.ConfigDefaults = ConfigDefaults;
 ConfigDefaults.NEED_CONFIG_VALUES = 'To connect to FlexPLM all these APP values need to be set apiHost, userName, and password';
 ConfigDefaults.STATIC_CONFIG_CACHE = {};
+ConfigDefaults.PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];

package/lib/util/config-defaults.spec.js

@@ -378,4 +378,18 @@ describe('all tests', () => {
             expect(Object.keys(config).length).toEqual(0);
         });
     });
+    describe('prototype pollution', () => {
+        const config = {
+            apiHost: 'http://test.com',
+            userName: 'vibeiq',
+            password: 'vibeiq'
+        };
+        it('does not allow prototype pollution via complexConfig', async () => {
+            const startConfig = Object.assign({}, config, {
+                complexConfig: JSON.parse('{"__proto__":{"polluted":true}}')
+            });
+            await config_defaults_1.ConfigDefaults.setConfigDefaults(startConfig);
+            expect({}.polluted).toBeUndefined();
+        });
+    });
 });

package/lib/util/flexplm-connect.spec.js

@@ -24,6 +24,7 @@ const createConfig = (overrides) => ({
     password: () => 'pass',
     itemPreDevelopmentLifecycleStages: [],
     payloadDefaultAsArray: true,
+    useDistinctRestEndPointForImages: false,
     ...overrides,
 });
 describe('FlexPLMConnect.getRequest', () => {

package/lib/util/thumbnail-util.js

@@ -181,15 +181,34 @@ class ThumbnailUtil {
         const fileName = urlParts[urlParts.length - 1] || 'thumbnail';
         const encodedUrl = urlParts.map(part => encodeURIComponent(part)).join('/');
         const flexPLMConnect = new flexplm_connect_1.FlexPLMConnect(this.config);
-        const response = await flexPLMConnect.getRequest({
-            urlPath: encodedUrl,
-            includeUrlContext: false,
-            returnFullResponse: true,
-        });
+        console.debug('the useDistinctRestEndPointForImages is --> ' + this.config.useDistinctRestEndPointForImages);
+        let response;
+        if (this.config.useDistinctRestEndPointForImages) {
+            // Route through the connector endpoint (Basic auth + VIBEIQGROUP enforced there).
+            const imageEndpoint = '/rfa/vibeiq/image';
+            const urlPath = '/servlet/rest' + imageEndpoint + '?path=' + encodeURIComponent(thumbnailUrl);
+            response = await flexPLMConnect.getRequest({
+                urlPath,
+                includeUrlContext: true,
+                returnFullResponse: true,
+            });
+        }
+        else {
+            response = await flexPLMConnect.getRequest({
+                urlPath: encodedUrl,
+                includeUrlContext: false,
+                returnFullResponse: true,
+            });
+        }
         const fileBuffer = await response.arrayBuffer();
         const buffer = Buffer.from(fileBuffer);
         const contentTypeHeader = response.headers.get('content-type');
         const contentType = contentTypeHeader ? contentTypeHeader.split(';')[0] : 'application/octet-stream';
+        // Ensure we actually receive an image content type.
+        if (!contentType.startsWith('image/')) {
+            const message = `Expected image content from FlexPLM but received '${contentType}' for ${thumbnailUrl}`;
+            throw new Error(message);
+        }
         const contentHolderReference = `${entityName}:${entityId}`;
         const content = await new sdk_1.Content().create({
             fileBuffer: buffer,

package/lib/util/thumbnail-util.spec.js

@@ -437,6 +437,41 @@ describe('ThumbnailUtil Tests', () => {
             expect(mockEntitiesDelete).not.toHaveBeenCalled();
         });
     });
+    describe('syncThumbnailToVibeIQ - useDistinctRestEndPointForImages enabled', () => {
+        let tu;
+        const distinctConfig = { useDistinctRestEndPointForImages: true };
+        beforeEach(() => {
+            jest.clearAllMocks();
+            tu = new thumbnail_util_1.ThumbnailUtil(distinctConfig);
+            mockEntitiesGet.mockImplementation((opts) => {
+                if (opts.entityName === 'content-custom-size')
+                    return Promise.resolve([]);
+                return Promise.resolve({});
+            });
+            mockEntitiesUpdate.mockImplementation((opts) => Promise.resolve({ id: opts.id }));
+            mockEntitiesDelete.mockImplementation((opts) => Promise.resolve({ id: opts.id }));
+        });
+        it('routes through the distinct image endpoint with includeUrlContext true', async () => {
+            const mockResponse = {
+                arrayBuffer: jest.fn().mockResolvedValue(new ArrayBuffer(8)),
+                headers: { get: jest.fn().mockReturnValue('image/png') },
+            };
+            mockGetRequest.mockResolvedValue(mockResponse);
+            mockContentCreate.mockResolvedValue({
+                id: 'distinctContent1', contentType: 'image/png', fileName: 'thumb.png',
+                primaryFileUrl: 'https://files/primary.png', largeViewableUrl: null,
+                mediumLargeViewableUrl: null, mediumViewableUrl: null, smallViewableUrl: null, tinyViewableUrl: null,
+            });
+            const thumbnailUrl = '/rest/thumbnail/thumb.png';
+            const event = { data: { [thumbnail_util_1.ThumbnailUtil.NEW_THUMBNAIL_ID]: thumbnailUrl } };
+            await tu.syncThumbnailToVibeIQ({ entityId: 'entity1', event, entityName: 'color' });
+            expect(mockGetRequest).toHaveBeenCalledWith({
+                urlPath: '/servlet/rest/rfa/vibeiq/image?path=' + encodeURIComponent(thumbnailUrl),
+                includeUrlContext: true,
+                returnFullResponse: true,
+            });
+        });
+    });
     describe('ThumbnailUtil - iteratedThumbnailId (THUMBNAIL key)', () => {
         const config = {};
         let tu;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.2",
+  "version": "1.7.3-alpha.2a853f5",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",