@contrail/flexplm 1.7.3-alpha.b33e995 → 1.7.3

package/lib/interfaces/interfaces.d.ts

@@ -14,7 +14,7 @@ export interface FCConfig {
     urlContext: string;
     vibeEventEndpoint: string;
     csrfEndpoint: string;
-    useDistinctRestEndPointForImages: boolean;
+    useDistinctRestEndPointForImages?: boolean;
     itemPreDevelopmentLifecycleStages: string[];
     identifierAtts?: {
         [key: string]: string[];

package/lib/util/config-defaults.d.ts

@@ -2,6 +2,8 @@ import { FCConfig } from '../interfaces/interfaces';
 export declare class ConfigDefaults {
     static NEED_CONFIG_VALUES: string;
     static STATIC_CONFIG_CACHE: {};
+    static PROTO_KEYS: string[];
+    static stripProtoKeys(obj: any): any;
     static setConfigDefaults(config: any): Promise<FCConfig>;
     static getDefaultConfig(): {
         urlContext: string;

package/lib/util/config-defaults.js

@@ -5,16 +5,29 @@ const sdk_1 = require("@contrail/sdk");
 const util_1 = require("@contrail/util");
 const type_defaults_1 = require("./type-defaults");
 class ConfigDefaults {
+    static stripProtoKeys(obj) {
+        if (obj && typeof obj === 'object' && !(obj instanceof Date)) {
+            for (const key of Object.keys(obj)) {
+                if (ConfigDefaults.PROTO_KEYS.includes(key)) {
+                    delete obj[key];
+                }
+                else {
+                    ConfigDefaults.stripProtoKeys(obj[key]); // recurse into nested payloads
+                }
+            }
+        }
+        return obj;
+    }
     static async setConfigDefaults(config) {
-        //Validate config
+        // Validate config
         if (!config.apiHost || !config.userName || !config.password) {
             throw new Error(ConfigDefaults.NEED_CONFIG_VALUES);
         }
         if (config.complexConfig && typeof config.complexConfig === 'object') {
-            Object.assign(config, config.complexConfig);
+            Object.assign(config, ConfigDefaults.stripProtoKeys(config.complexConfig));
             delete config.complexConfig;
         }
-        //List will be comma separated list in UI, so convert to array
+        // List will be comma separated list in UI, so convert to array
         if (config?.itemPreDevelopmentLifecycleStages && !(config?.itemPreDevelopmentLifecycleStages instanceof Array)) {
             config.itemPreDevelopmentLifecycleStages = config.itemPreDevelopmentLifecycleStages.split(',');
         }
@@ -32,7 +45,7 @@ class ConfigDefaults {
         const pass = outputConfig.password;
         outputConfig.userName = () => uName;
         outputConfig.password = () => pass;
-        //Don't allow overwriting this.
+        // Don't allow overwriting this.
         outputConfig['OOBvibeEventEndpoint'] = '/rfa/vibeiq/vibeEvents';
         type_defaults_1.TypeDefaults.applyConfig(outputConfig);
         console.log('outputConfig: ' + JSON.stringify(outputConfig));
@@ -42,21 +55,21 @@ class ConfigDefaults {
         return {
             urlContext: '/Windchill',
             sendMode: {
-                ASYNC_PUBLISH_SEASON: 'vibeiqfile'
+                ASYNC_PUBLISH_SEASON: 'vibeiqfile',
             },
             itemPreDevelopmentLifecycleStages: ['concept'],
             identifierAtts: {
                 LCSProduct: ['itemNumber'],
                 LCSSeason: ['flexPLMSeasonName'],
-                LCSSKU: ['itemNumber']
+                LCSSKU: ['itemNumber'],
             },
             LCSMaterial: {
-                processAsItem: false
+                processAsItem: false,
             },
             useDistinctRestEndPointForImages: false,
             csrfEndpoint: '/servlet/rest/security/csrf',
             vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
-            payloadDefaultAsArray: true
+            payloadDefaultAsArray: true,
         };
     }
     static async getConfigFile(fileId) {
@@ -101,3 +114,4 @@ class ConfigDefaults {
 exports.ConfigDefaults = ConfigDefaults;
 ConfigDefaults.NEED_CONFIG_VALUES = 'To connect to FlexPLM all these APP values need to be set apiHost, userName, and password';
 ConfigDefaults.STATIC_CONFIG_CACHE = {};
+ConfigDefaults.PROTO_KEYS = ['__proto__', 'constructor', 'prototype'];

package/lib/util/config-defaults.spec.js

@@ -378,4 +378,18 @@ describe('all tests', () => {
             expect(Object.keys(config).length).toEqual(0);
         });
     });
+    describe('prototype pollution', () => {
+        const config = {
+            apiHost: 'http://test.com',
+            userName: 'vibeiq',
+            password: 'vibeiq'
+        };
+        it('does not allow prototype pollution via complexConfig', async () => {
+            const startConfig = Object.assign({}, config, {
+                complexConfig: JSON.parse('{"__proto__":{"polluted":true}}')
+            });
+            await config_defaults_1.ConfigDefaults.setConfigDefaults(startConfig);
+            expect({}.polluted).toBeUndefined();
+        });
+    });
 });

package/lib/util/data-converter.spec.js

@@ -38,8 +38,7 @@ describe('getFlexPLMValue multi_select', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -97,8 +96,7 @@ describe('getEnumerationValue', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -155,8 +153,7 @@ describe('getEnumerationValue multi_select', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -216,8 +213,7 @@ describe('getPersistableChanges', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -302,8 +298,7 @@ describe('getObjectReferenceValue cache', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -361,8 +356,7 @@ describe('getObjectReferenceValue bad value', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -468,8 +462,7 @@ describe('setObjectReferenceValue - identity service', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     });
     const refProp = {
         id: 'cJoZQvoj7dkfCBJq',
@@ -927,8 +920,7 @@ describe('getEntityValues', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -969,8 +961,7 @@ describe('setEnumerationKeys', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -1034,8 +1025,7 @@ describe('checkKeysAndValues', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -1112,8 +1102,7 @@ describe('filterOutArchivedAndTrashedEntities', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -1153,8 +1142,7 @@ describe('setUserListValue', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const userListProp1 = {};
     const userEmailMapping = [
@@ -1250,8 +1238,7 @@ describe('getUserListValue', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const userListProp1 = {
         slug: 'userList1'
@@ -1353,8 +1340,7 @@ describe('getFlexPLMValue size_range', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);
@@ -1387,8 +1373,7 @@ describe('getEntityValue size_range', () => {
         urlContext: 'xxx',
         vibeEventEndpoint: '/rfa/vibeiq/vibeEvents',
         csrfEndpoint: '/servlet/rest/security/csrf',
-        itemPreDevelopmentLifecycleStages: ['concept'],
-        useDistinctRestEndPointForImages: false
+        itemPreDevelopmentLifecycleStages: ['concept']
     };
     const mapFileUtil = new transform_data_1.MapFileUtil(new sdk_1.Entities());
     const dc = new data_converter_1.DataConverter(config, mapFileUtil);

package/lib/util/thumbnail-util.js

@@ -181,7 +181,7 @@ class ThumbnailUtil {
         const fileName = urlParts[urlParts.length - 1] || 'thumbnail';
         const encodedUrl = urlParts.map(part => encodeURIComponent(part)).join('/');
         const flexPLMConnect = new flexplm_connect_1.FlexPLMConnect(this.config);
-        console.log('the useDistinctRestEndPointForImages is --> ' + this.config.useDistinctRestEndPointForImages);
+        console.debug('the useDistinctRestEndPointForImages is --> ' + this.config.useDistinctRestEndPointForImages);
         let response;
         if (this.config.useDistinctRestEndPointForImages) {
             // Route through the connector endpoint (Basic auth + VIBEIQGROUP enforced there).
@@ -200,17 +200,15 @@ class ThumbnailUtil {
                 returnFullResponse: true,
             });
         }
-        // Ensure we actually receive an image content type.
-        const contTypeHeader = response.headers.get('content-type');
-        const contType = contTypeHeader ? contTypeHeader.split(';')[0] : 'application/octet-stream';
-        if (!contType.startsWith('image/')) {
-            const message = `Expected image content from FlexPLM but received '${contType}' for ${thumbnailUrl}`;
-            throw new Error(message);
-        }
         const fileBuffer = await response.arrayBuffer();
         const buffer = Buffer.from(fileBuffer);
         const contentTypeHeader = response.headers.get('content-type');
         const contentType = contentTypeHeader ? contentTypeHeader.split(';')[0] : 'application/octet-stream';
+        // Ensure we actually receive an image content type.
+        if (!contentType.startsWith('image/')) {
+            const message = `Expected image content from FlexPLM but received '${contentType}' for ${thumbnailUrl}`;
+            throw new Error(message);
+        }
         const contentHolderReference = `${entityName}:${entityId}`;
         const content = await new sdk_1.Content().create({
             fileBuffer: buffer,

package/lib/util/thumbnail-util.spec.js

@@ -437,6 +437,41 @@ describe('ThumbnailUtil Tests', () => {
             expect(mockEntitiesDelete).not.toHaveBeenCalled();
         });
     });
+    describe('syncThumbnailToVibeIQ - useDistinctRestEndPointForImages enabled', () => {
+        let tu;
+        const distinctConfig = { useDistinctRestEndPointForImages: true };
+        beforeEach(() => {
+            jest.clearAllMocks();
+            tu = new thumbnail_util_1.ThumbnailUtil(distinctConfig);
+            mockEntitiesGet.mockImplementation((opts) => {
+                if (opts.entityName === 'content-custom-size')
+                    return Promise.resolve([]);
+                return Promise.resolve({});
+            });
+            mockEntitiesUpdate.mockImplementation((opts) => Promise.resolve({ id: opts.id }));
+            mockEntitiesDelete.mockImplementation((opts) => Promise.resolve({ id: opts.id }));
+        });
+        it('routes through the distinct image endpoint with includeUrlContext true', async () => {
+            const mockResponse = {
+                arrayBuffer: jest.fn().mockResolvedValue(new ArrayBuffer(8)),
+                headers: { get: jest.fn().mockReturnValue('image/png') },
+            };
+            mockGetRequest.mockResolvedValue(mockResponse);
+            mockContentCreate.mockResolvedValue({
+                id: 'distinctContent1', contentType: 'image/png', fileName: 'thumb.png',
+                primaryFileUrl: 'https://files/primary.png', largeViewableUrl: null,
+                mediumLargeViewableUrl: null, mediumViewableUrl: null, smallViewableUrl: null, tinyViewableUrl: null,
+            });
+            const thumbnailUrl = '/rest/thumbnail/thumb.png';
+            const event = { data: { [thumbnail_util_1.ThumbnailUtil.NEW_THUMBNAIL_ID]: thumbnailUrl } };
+            await tu.syncThumbnailToVibeIQ({ entityId: 'entity1', event, entityName: 'color' });
+            expect(mockGetRequest).toHaveBeenCalledWith({
+                urlPath: '/servlet/rest/rfa/vibeiq/image?path=' + encodeURIComponent(thumbnailUrl),
+                includeUrlContext: true,
+                returnFullResponse: true,
+            });
+        });
+    });
     describe('ThumbnailUtil - iteratedThumbnailId (THUMBNAIL key)', () => {
         const config = {};
         let tu;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.3-alpha.b33e995",
+  "version": "1.7.3",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",