@contrast/assess 1.9.0 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/dataflow/propagation/index.js +1 -0
- package/lib/dataflow/propagation/install/path/basename.js +124 -0
- package/lib/dataflow/propagation/install/path/common.js +176 -0
- package/lib/dataflow/propagation/install/path/index.js +32 -0
- package/lib/dataflow/propagation/install/path/join-and-resolve.js +141 -0
- package/lib/dataflow/propagation/install/path/normalize.js +123 -0
- package/lib/dataflow/propagation/install/querystring/parse.js +1 -1
- package/lib/dataflow/propagation/install/string/match.js +2 -2
- package/lib/dataflow/propagation/install/string/replace.js +1 -1
- package/lib/dataflow/propagation/install/string/slice.js +1 -1
- package/lib/dataflow/propagation/install/string/split.js +1 -1
- package/lib/dataflow/propagation/install/string/substring.js +2 -2
- package/lib/dataflow/propagation/install/string/trim.js +1 -1
- package/lib/dataflow/propagation/install/url/index.js +1 -0
- package/lib/dataflow/propagation/install/url/url.js +228 -0
- package/lib/dataflow/sinks/index.js +8 -4
- package/lib/dataflow/sinks/install/eval.js +138 -0
- package/lib/dataflow/sinks/install/express/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/fastify/unvalidated-redirect.js +2 -1
- package/lib/dataflow/sinks/install/fs.js +3 -3
- package/lib/dataflow/sinks/install/function.js +160 -0
- package/lib/dataflow/sinks/install/http/index.js +31 -0
- package/lib/dataflow/sinks/install/http/request.js +152 -0
- package/lib/dataflow/sinks/install/{http.js → http/server-response.js} +2 -2
- package/lib/dataflow/sinks/install/koa/unvalidated-redirect.js +1 -1
- package/lib/dataflow/sinks/install/mongodb.js +4 -23
- package/lib/dataflow/sinks/install/mssql.js +44 -31
- package/lib/dataflow/sinks/install/vm.js +276 -0
- package/lib/dataflow/tag-utils.js +70 -1
- package/package.json +2 -2
|
@@ -44,7 +44,7 @@ function atomicAppend(firstTagRanges, secondTagRanges, offset) {
|
|
|
44
44
|
|
|
45
45
|
function atomicSubset(tags, subsetStart, len) {
|
|
46
46
|
const ret = [];
|
|
47
|
-
const subsetStop = subsetStart + len;
|
|
47
|
+
const subsetStop = subsetStart + len - 1;
|
|
48
48
|
|
|
49
49
|
for (let idx = 0; idx < tags.length - 1; idx += 2) {
|
|
50
50
|
const tagStart = tags[idx];
|
|
@@ -119,6 +119,42 @@ function atomicMerge(firstTagRanges, secondTagRanges) {
|
|
|
119
119
|
return finalMergedRanges;
|
|
120
120
|
}
|
|
121
121
|
|
|
122
|
+
function atomicExclude(tags, exclusionRange) {
|
|
123
|
+
const ret = [];
|
|
124
|
+
const [exclusionStart, exclusionStop] = exclusionRange;
|
|
125
|
+
|
|
126
|
+
for (let idx = 0; idx < tags.length - 1; idx += 2) {
|
|
127
|
+
const tagStart = tags[idx];
|
|
128
|
+
const tagStop = tags[idx + 1];
|
|
129
|
+
|
|
130
|
+
if (tagStop < exclusionStart) {
|
|
131
|
+
ret.push(tagStart, tagStop);
|
|
132
|
+
// exlusion is below - continue to check next range
|
|
133
|
+
continue;
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
if (tagStart > exclusionStop) {
|
|
137
|
+
ret.push(...tags.slice(idx));
|
|
138
|
+
// all other ranges are above exclusion so we can stop
|
|
139
|
+
break;
|
|
140
|
+
}
|
|
141
|
+
|
|
142
|
+
if (exclusionStart <= tagStart && exclusionStop < tagStop) {
|
|
143
|
+
ret.push(exclusionStop + 1, tagStop);
|
|
144
|
+
}
|
|
145
|
+
|
|
146
|
+
if (exclusionStart > tagStart) {
|
|
147
|
+
ret.push(tagStart, exclusionStart - 1);
|
|
148
|
+
|
|
149
|
+
if (exclusionStop < tagStop) {
|
|
150
|
+
ret.push(exclusionStop + 1, tagStop);
|
|
151
|
+
}
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
|
|
155
|
+
return ret;
|
|
156
|
+
}
|
|
157
|
+
|
|
122
158
|
function createAppendTags(firstTags, secondTags, offset) {
|
|
123
159
|
const ret = Object.create(null);
|
|
124
160
|
const firstTagsObject = ensureObject(firstTags);
|
|
@@ -204,10 +240,43 @@ function createMergedTags(firstTags, secondTags) {
|
|
|
204
240
|
return Object.keys(ret).length ? ret : null;
|
|
205
241
|
}
|
|
206
242
|
|
|
243
|
+
function createTagsWithExclusion(tags, exclusionRange) {
|
|
244
|
+
if (!exclusionRange.length) return;
|
|
245
|
+
|
|
246
|
+
const ret = Object.create(null);
|
|
247
|
+
const tagsObject = ensureObject(tags);
|
|
248
|
+
|
|
249
|
+
for (const tagName of Object.keys(tagsObject)) {
|
|
250
|
+
const newTagRanges = atomicExclude(ensureTagsImmutable(tagsObject, tagName), exclusionRange);
|
|
251
|
+
|
|
252
|
+
newTagRanges.length && (ret[tagName] = newTagRanges);
|
|
253
|
+
}
|
|
254
|
+
|
|
255
|
+
return Object.keys(ret).length ? ret : null;
|
|
256
|
+
}
|
|
257
|
+
|
|
258
|
+
function createAdjustedQueryTags(path, tags, value, argString) {
|
|
259
|
+
let idx = -1;
|
|
260
|
+
for (const str of [...path, value]) {
|
|
261
|
+
// This is the case where the argument is an array
|
|
262
|
+
if (str === 0) continue;
|
|
263
|
+
|
|
264
|
+
idx = argString.indexOf(str, idx);
|
|
265
|
+
if (idx == -1) {
|
|
266
|
+
idx = -1;
|
|
267
|
+
break;
|
|
268
|
+
}
|
|
269
|
+
}
|
|
270
|
+
|
|
271
|
+
return idx > 0 ? createAppendTags([], tags, idx) : [...tags];
|
|
272
|
+
}
|
|
273
|
+
|
|
207
274
|
module.exports = {
|
|
208
275
|
createSubsetTags,
|
|
209
276
|
createAppendTags,
|
|
210
277
|
createFullLengthCopyTags,
|
|
211
278
|
createMergedTags,
|
|
279
|
+
createTagsWithExclusion,
|
|
280
|
+
createAdjustedQueryTags,
|
|
212
281
|
createOverlappingTags
|
|
213
282
|
};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@contrast/assess",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.10.0",
|
|
4
4
|
"description": "",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"scripts": {
|
|
@@ -15,7 +15,7 @@
|
|
|
15
15
|
"dependencies": {
|
|
16
16
|
"@contrast/distringuish": "^4.1.0",
|
|
17
17
|
"@contrast/scopes": "1.4.0",
|
|
18
|
-
"@contrast/common": "1.
|
|
18
|
+
"@contrast/common": "1.13.0",
|
|
19
19
|
"parseurl": "^1.3.3"
|
|
20
20
|
}
|
|
21
21
|
}
|