@depup/webpack 5.106.1-depup.0 → 5.109.2-depup.0

package/lib/cache/ResolverCachePlugin.js

@@ -22,6 +22,7 @@ const makeSerializable = require("../util/makeSerializable");
 /** @typedef {import("../serialization/ObjectMiddleware").ObjectSerializerContext} ObjectSerializerContext */
 
 /**
+ * Defines the sync hook type used by this module.
  * @template T
  * @typedef {import("tapable").SyncHook<T>} SyncHook
  */
@@ -30,15 +31,19 @@ const makeSerializable = require("../util/makeSerializable");
 
 class CacheEntry {
 	/**
+	 * Creates an instance of CacheEntry.
 	 * @param {ResolveRequest} result result
 	 * @param {Snapshot} snapshot snapshot
 	 */
 	constructor(result, snapshot) {
+		/** @type {ResolveRequest} */
 		this.result = result;
+		/** @type {Snapshot} */
 		this.snapshot = snapshot;
 	}
 
 	/**
+	 * Serializes this instance into the provided serializer context.
 	 * @param {ObjectSerializerContext} context context
 	 */
 	serialize({ write }) {
@@ -47,6 +52,7 @@ class CacheEntry {
 	}
 
 	/**
+	 * Restores this instance from the provided deserializer context.
 	 * @param {ObjectDeserializerContext} context context
 	 */
 	deserialize({ read }) {
@@ -58,6 +64,7 @@ class CacheEntry {
 makeSerializable(CacheEntry, "webpack/lib/cache/ResolverCachePlugin");
 
 /**
+ * Adds the provided set to the cache entry.
  * @template T
  * @param {Set<T> | LazySet<T>} set set to add items to
  * @param {Set<T> | LazySet<T> | Iterable<T>} otherSet set to add items from
@@ -74,6 +81,7 @@ const addAllToSet = (set, otherSet) => {
 };
 
 /**
+ * Returns stringified version.
  * @template {object} T
  * @param {T} object an object
  * @param {boolean} excludeContext if true, context is not included in string
@@ -98,7 +106,7 @@ const PLUGIN_NAME = "ResolverCachePlugin";
 
 class ResolverCachePlugin {
 	/**
-	 * Apply the plugin
+	 * Applies the plugin by registering its hooks on the compiler.
 	 * @param {Compiler} compiler the compiler instance
 	 * @returns {void}
 	 */
@@ -135,6 +143,7 @@ class ResolverCachePlugin {
 		/** @typedef {ResolveRequest & { _ResolverCachePluginCacheMiss: true }} ResolveRequestWithCacheMiss */
 
 		/**
+		 * Processes the provided item cache.
 		 * @param {ItemCacheFacade} itemCache cache
 		 * @param {Resolver} resolver the resolver
 		 * @param {ResolveContext} resolveContext context for resolving meta info
@@ -175,6 +184,7 @@ class ResolverCachePlugin {
 					(yieldResult).push(obj);
 			}
 			/**
+			 * Processes the provided key.
 			 * @param {"fileDependencies" | "contextDependencies" | "missingDependencies"} key key
 			 */
 			const propagate = (key) => {
@@ -375,6 +385,7 @@ class ResolverCachePlugin {
 										}
 									};
 							/**
+							 * Process cache result.
 							 * @param {(Error | null)=} err error if any
 							 * @param {(CacheEntry | null)=} cacheEntry cache entry
 							 * @returns {void}

package/lib/cache/getLazyHashedEtag.js

@@ -13,17 +13,19 @@ const createHash = require("../util/createHash");
 /** @typedef {import("../util/Hash").HashFunction} HashFunction */
 
 /**
+ * Represents the lazy hashed etag runtime component.
  * @typedef {object} HashableObject
  * @property {(hash: Hash) => void} updateHash
  */
 
 class LazyHashedEtag {
 	/**
+	 * Creates an instance of LazyHashedEtag.
 	 * @param {HashableObject} obj object with updateHash method
 	 * @param {HashFunction} hashFunction the hash function to use
 	 */
 	constructor(obj, hashFunction = DEFAULTS.HASH_FUNCTION) {
-		/** @type {HashableObject} */
+		/** @type {HashableObject | undefined} */
 		this._obj = obj;
 		/** @type {undefined | string} */
 		this._hash = undefined;
@@ -32,13 +34,21 @@ class LazyHashedEtag {
 	}
 
 	/**
+	 * Returns a string representation.
 	 * @returns {string} hash of object
 	 */
 	toString() {
 		if (this._hash === undefined) {
 			const hash = createHash(this._hashFunction);
-			this._obj.updateHash(hash);
+			/** @type {HashableObject} */
+			(this._obj).updateHash(hash);
 			this._hash = hash.digest("base64");
+			// Drop the captured object once the hash is memoized. The hash is
+			// never reset, so we never need `_obj` again — and many callers
+			// (e.g. `SourceMapDevToolPlugin`, `RealContentHashPlugin`) capture
+			// a heavy `CachedSource` here that would otherwise stay reachable
+			// through this etag for the lifetime of the compilation cache.
+			this._obj = undefined;
 		}
 		return this._hash;
 	}
@@ -53,6 +63,7 @@ const mapStrings = new Map();
 const mapObjects = new WeakMap();
 
 /**
+ * Returns etag.
  * @param {HashableObject} obj object with updateHash method
  * @param {HashFunction=} hashFunction the hash function to use
  * @returns {LazyHashedEtag} etag

package/lib/cache/mergeEtags.js

@@ -9,11 +9,14 @@
 
 class MergedEtag {
 	/**
+	 * Creates an instance of MergedEtag.
 	 * @param {Etag} a first
 	 * @param {Etag} b second
 	 */
 	constructor(a, b) {
+		/** @type {Etag} */
 		this.a = a;
+		/** @type {Etag} */
 		this.b = b;
 	}
 
@@ -28,6 +31,7 @@ const dualObjectMap = new WeakMap();
 const objectStringMap = new WeakMap();
 
 /**
+ * Merges the provided values into a single result.
  * @param {Etag} a first
  * @param {Etag} b second
  * @returns {string | MergedEtag} result

package/lib/cli.js

@@ -7,7 +7,9 @@
 
 const path = require("path");
 const tty = require("tty");
-const webpackSchema = require("../schemas/WebpackOptions.json");
+const webpackSchema =
+	/** @type {EXPECTED_ANY} */
+	(require("../schemas/WebpackOptions.json"));
 
 /** @typedef {import("json-schema").JSONSchema4} JSONSchema4 */
 /** @typedef {import("json-schema").JSONSchema6} JSONSchema6 */
@@ -15,18 +17,20 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {JSONSchema4 | JSONSchema6 | JSONSchema7} JSONSchema */
 /** @typedef {JSONSchema & { absolutePath: boolean, instanceof: string, cli: { helper?: boolean, exclude?: boolean, description?: string, negatedDescription?: string, resetDescription?: string } }} Schema */
 
-// TODO add originPath to PathItem for better errors
 /**
+ * Defines the path item type used by this module.
  * @typedef {object} PathItem
  * @property {Schema} schema the part of the schema
  * @property {string} path the path in the config
+ * @property {string} segment the JSON pointer segment of this schema part (absolute when starting with "#")
  */
 
-/** @typedef {"unknown-argument" | "unexpected-non-array-in-path" | "unexpected-non-object-in-path" | "multiple-values-unexpected" | "invalid-value"} ProblemType */
+/** @typedef {"unknown-argument" | "unexpected-non-array-in-path" | "unexpected-non-object-in-path" | "prototype-pollution-in-path" | "multiple-values-unexpected" | "invalid-value"} ProblemType */
 
 /** @typedef {string | number | boolean | RegExp} Value */
 
 /**
+ * Defines the problem type used by this module.
  * @typedef {object} Problem
  * @property {ProblemType} type
  * @property {string} path
@@ -37,6 +41,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
  */
 
 /**
+ * Defines the local problem type used by this module.
  * @typedef {object} LocalProblem
  * @property {ProblemType} type
  * @property {string} path
@@ -48,6 +53,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {string | number | boolean | EnumValueObject | EnumValueArray | null} EnumValue */
 
 /**
+ * Defines the argument config type used by this module.
  * @typedef {object} ArgumentConfig
  * @property {string=} description
  * @property {string=} negatedDescription
@@ -60,6 +66,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {"string" | "number" | "boolean"} SimpleType */
 
 /**
+ * Defines the argument type used by this module.
  * @typedef {object} Argument
  * @property {string | undefined} description
  * @property {SimpleType} simpleType
@@ -72,6 +79,7 @@ const webpackSchema = require("../schemas/WebpackOptions.json");
 /** @typedef {Record<string, EXPECTED_ANY>} ObjectConfiguration */
 
 /**
+ * Returns object of arguments.
  * @param {Schema=} schema a json schema to create arguments for (by default webpack schema is used)
  * @returns {Flags} object of arguments
  */
@@ -80,6 +88,7 @@ const getArguments = (schema = webpackSchema) => {
 	const flags = {};
 
 	/**
+	 * Path to argument name.
 	 * @param {string} input input
 	 * @returns {string} result
 	 */
@@ -95,6 +104,7 @@ const getArguments = (schema = webpackSchema) => {
 			.toLowerCase();
 
 	/**
+	 * Returns schema part.
 	 * @param {string} path path
 	 * @returns {Schema} schema part
 	 */
@@ -117,6 +127,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Returns description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} description
 	 */
@@ -131,6 +142,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Gets negated description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} negative description
 	 */
@@ -144,6 +156,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Gets reset description.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {string | undefined} reset description
 	 */
@@ -157,6 +170,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Schema to argument config.
 	 * @param {Schema} schemaPart schema
 	 * @returns {Pick<ArgumentConfig, "type" | "values"> | undefined} partial argument config
 	 */
@@ -167,6 +181,12 @@ const getArguments = (schema = webpackSchema) => {
 				values: schemaPart.enum
 			};
 		}
+		if (schemaPart.const !== undefined) {
+			return {
+				type: "enum",
+				values: [schemaPart.const]
+			};
+		}
 		switch (schemaPart.type) {
 			case "number":
 				return {
@@ -190,6 +210,7 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Adds the provided path to this object.
 	 * @param {PathItem[]} path path in the schema
 	 * @returns {void}
 	 */
@@ -219,6 +240,21 @@ const getArguments = (schema = webpackSchema) => {
 	};
 
 	/**
+	 * Joins the per-item segments into a JSON pointer (built only when needed).
+	 * @param {PathItem[]} path full path in schema (deepest item first)
+	 * @returns {string} JSON pointer to the deepest schema part
+	 */
+	const getOriginPath = (path) => {
+		let origin = "";
+		for (let i = path.length - 1; i >= 0; i--) {
+			const { segment } = path[i];
+			origin = segment[0] === "#" ? segment : origin + segment;
+		}
+		return origin;
+	};
+
+	/**
+	 * Adds the provided path to this object.
 	 * @param {PathItem[]} path full path in schema
 	 * @param {boolean} multiple inside of an array
 	 * @returns {number} number of arguments added
@@ -267,7 +303,11 @@ const getArguments = (schema = webpackSchema) => {
 		) {
 			if (multiple) {
 				throw new Error(
-					`Conflicting schema for ${path[0].path} with ${argConfig.type} type (array type must be before single item type)`
+					`Conflicting schema for ${path[0].path} (${getOriginPath(
+						path
+					)}) with ${
+						argConfig.type
+					} type (array type must be before single item type)`
 				);
 			}
 			return 0;
@@ -278,17 +318,25 @@ const getArguments = (schema = webpackSchema) => {
 		return 1;
 	};
 
-	// TODO support `not` and `if/then/else`
-	// TODO support `const`, but we don't use it on our schema
+	// TODO support `not`
 	/**
+	 * Returns added arguments.
 	 * @param {Schema} schemaPart the current schema
-	 * @param {string} schemaPath the current path in the schema
+	 * @param {string} schemaPath the current path in the config
 	 * @param {PathItem[]} path all previous visited schemaParts
 	 * @param {string | null} inArray if inside of an array, the path to the array
+	 * @param {string} segment the JSON pointer segment of the current schema
 	 * @returns {number} added arguments
 	 */
-	const traverse = (schemaPart, schemaPath = "", path = [], inArray = null) => {
+	const traverse = (
+		schemaPart,
+		schemaPath = "",
+		path = [],
+		inArray = null,
+		segment = "#"
+	) => {
 		while (schemaPart.$ref) {
+			segment = schemaPart.$ref;
 			schemaPart = getSchemaPart(schemaPart.$ref);
 		}
 
@@ -303,12 +351,33 @@ const getArguments = (schema = webpackSchema) => {
 		if (schemaPart.cli && schemaPart.cli.exclude) return 0;
 
 		/** @type {PathItem[]} */
-		const fullPath = [{ schema: schemaPart, path: schemaPath }, ...path];
+		const fullPath = [
+			{ schema: schemaPart, path: schemaPath, segment },
+			...path
+		];
 
 		let addedArguments = 0;
 
 		addedArguments += addFlag(fullPath, Boolean(inArray));
 
+		// Collect flags from both branches of a conditional schema.
+		const conditional = /** @type {JSONSchema7} */ (schemaPart);
+		if (conditional.if) {
+			for (const key of /** @type {const} */ (["if", "then", "else"])) {
+				const subSchema = conditional[key];
+				if (subSchema && typeof subSchema === "object") {
+					addedArguments += traverse(
+						/** @type {Schema} */
+						(subSchema),
+						schemaPath,
+						fullPath,
+						inArray,
+						`/${key}`
+					);
+				}
+			}
+		}
+
 		if (schemaPart.type === "object") {
 			if (schemaPart.properties) {
 				for (const property of Object.keys(schemaPart.properties)) {
@@ -317,7 +386,8 @@ const getArguments = (schema = webpackSchema) => {
 						(schemaPart.properties[property]),
 						schemaPath ? `${schemaPath}.${property}` : property,
 						fullPath,
-						inArray
+						inArray,
+						`/properties/${property}`
 					);
 				}
 			}
@@ -337,7 +407,8 @@ const getArguments = (schema = webpackSchema) => {
 						(item),
 						`${schemaPath}.${i}`,
 						fullPath,
-						schemaPath
+						schemaPath,
+						`/items/${i}`
 					);
 				}
 
@@ -349,7 +420,8 @@ const getArguments = (schema = webpackSchema) => {
 				(schemaPart.items),
 				`${schemaPath}[]`,
 				fullPath,
-				schemaPath
+				schemaPath,
+				"/items"
 			);
 
 			if (addedArguments > 0) {
@@ -360,10 +432,16 @@ const getArguments = (schema = webpackSchema) => {
 			return addedArguments;
 		}
 
-		const maybeOf = schemaPart.oneOf || schemaPart.anyOf || schemaPart.allOf;
+		const ofKey = schemaPart.oneOf
+			? "oneOf"
+			: schemaPart.anyOf
+				? "anyOf"
+				: schemaPart.allOf
+					? "allOf"
+					: undefined;
 
-		if (maybeOf) {
-			const items = maybeOf;
+		if (ofKey) {
+			const items = /** @type {Schema[]} */ (schemaPart[ofKey]);
 
 			for (let i = 0; i < items.length; i++) {
 				addedArguments += traverse(
@@ -371,7 +449,8 @@ const getArguments = (schema = webpackSchema) => {
 					(items[i]),
 					schemaPath,
 					fullPath,
-					inArray
+					inArray,
+					`/${ofKey}/${i}`
 				);
 			}
 
@@ -433,6 +512,15 @@ const cliAddedItems = new WeakMap();
 /** @typedef {string | number} Property */
 
 /**
+ * Whether a path segment would walk into the prototype chain.
+ * @param {string} name path segment
+ * @returns {boolean} true when the segment is unsafe to write through
+ */
+const isUnsafeKey = (name) =>
+	name === "__proto__" || name === "constructor" || name === "prototype";
+
+/**
+ * Gets object and property.
  * @param {ObjectConfiguration} config configuration
  * @param {string} schemaPath path in the config
  * @param {number | undefined} index index of value when multiple values are provided, otherwise undefined
@@ -447,6 +535,14 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 	for (const part of parts) {
 		const isArray = part.endsWith("[]");
 		const name = isArray ? part.slice(0, -2) : part;
+		if (isUnsafeKey(name)) {
+			return {
+				problem: {
+					type: "prototype-pollution-in-path",
+					path: parts.slice(0, i).join(".")
+				}
+			};
+		}
 		let value = current[name];
 		if (isArray) {
 			if (value === undefined) {
@@ -493,6 +589,14 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 		current = value;
 		i++;
 	}
+	if (isUnsafeKey(property.endsWith("[]") ? property.slice(0, -2) : property)) {
+		return {
+			problem: {
+				type: "prototype-pollution-in-path",
+				path: parts.join(".")
+			}
+		};
+	}
 	const value = current[property];
 	if (property.endsWith("[]")) {
 		const name = property.slice(0, -2);
@@ -533,6 +637,7 @@ const getObjectAndProperty = (config, schemaPath, index = 0) => {
 };
 
 /**
+ * Updates value using the provided config.
  * @param {ObjectConfiguration} config configuration
  * @param {string} schemaPath path in the config
  * @param {ParsedValue} value parsed value
@@ -552,6 +657,7 @@ const setValue = (config, schemaPath, value, index) => {
 };
 
 /**
+ * Process argument config.
  * @param {ArgumentConfig} argConfig processing instructions
  * @param {ObjectConfiguration} config configuration
  * @param {Value} value the value
@@ -579,6 +685,7 @@ const processArgumentConfig = (argConfig, config, value, index) => {
 };
 
 /**
+ * Gets expected value.
  * @param {ArgumentConfig} argConfig processing instructions
  * @returns {string | undefined} expected message
  */
@@ -606,6 +713,7 @@ const getExpectedValue = (argConfig) => {
 const DECIMAL_NUMBER_REGEXP = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:e[+-]?\d+)?$/i;
 
 /**
+ * Parses value for argument config.
  * @param {ArgumentConfig} argConfig processing instructions
  * @param {Value} value the value
  * @returns {ParsedValue | undefined} parsed value
@@ -665,6 +773,7 @@ const parseValueForArgumentConfig = (argConfig, value) => {
 /** @typedef {Record<string, Value[]>} Values */
 
 /**
+ * Processes the provided arg.
  * @param {Flags} args object of arguments
  * @param {ObjectConfiguration} config configuration
  * @param {Values} values object with values
@@ -684,6 +793,7 @@ const processArguments = (args, config, values) => {
 			continue;
 		}
 		/**
+		 * Processes the provided value.
 		 * @param {Value} value value
 		 * @param {number | undefined} i index
 		 */
@@ -718,21 +828,26 @@ const processArguments = (args, config, values) => {
 };
 
 /**
+ * Checks whether this object is color supported.
  * @returns {boolean} true when colors supported, otherwise false
  */
 const isColorSupported = () => {
 	const { env = {}, argv = [], platform = "" } = process;
 
-	const isDisabled = "NO_COLOR" in env || argv.includes("--no-color");
-	const isForced = "FORCE_COLOR" in env || argv.includes("--color");
+	// Read values instead of using `in`: Deno's and Bun's `process.env` honor
+	// property access but not the `in`/`has` trap, so `"X" in env` is unreliable.
+	const isDisabled = env.NO_COLOR !== undefined || argv.includes("--no-color");
+	const isForced = env.FORCE_COLOR !== undefined || argv.includes("--color");
 	const isWindows = platform === "win32";
 	const isDumbTerminal = env.TERM === "dumb";
 
 	const isCompatibleTerminal = tty.isatty(1) && env.TERM && !isDumbTerminal;
 
 	const isCI =
-		"CI" in env &&
-		("GITHUB_ACTIONS" in env || "GITLAB_CI" in env || "CIRCLECI" in env);
+		env.CI !== undefined &&
+		(env.GITHUB_ACTIONS !== undefined ||
+			env.GITLAB_CI !== undefined ||
+			env.CIRCLECI !== undefined);
 
 	return (
 		!isDisabled &&
@@ -741,6 +856,7 @@ const isColorSupported = () => {
 };
 
 /**
+ * Returns result.
  * @param {number} index index
  * @param {string} string string
  * @param {string} close close
@@ -761,6 +877,7 @@ const replaceClose = (
 ) => head + (next < 0 ? tail : replaceClose(next, tail, close, replace));
 
 /**
+ * Returns result.
  * @param {number} index index to replace
  * @param {string} string string
  * @param {string} open open string
@@ -776,6 +893,7 @@ const clearBleed = (index, string, open, close, replace) =>
 /** @typedef {(value: EXPECTED_ANY) => string} PrintFunction */
 
 /**
+ * Returns function to create color.
  * @param {string} open open string
  * @param {string} close close string
  * @param {string=} replace extra replace
@@ -790,6 +908,7 @@ const filterEmpty =
 			: "";
 
 /**
+ * Returns result.
  * @param {number} open open code
  * @param {number} close close code
  * @param {string=} replace extra replace
@@ -799,15 +918,18 @@ const init = (open, close, replace) =>
 	filterEmpty(`\u001B[${open}m`, `\u001B[${close}m`, replace);
 
 /**
+ * Defines the colors type used by this module.
  * @typedef {{ reset: PrintFunction, bold: PrintFunction, dim: PrintFunction, italic: PrintFunction, underline: PrintFunction, inverse: PrintFunction, hidden: PrintFunction, strikethrough: PrintFunction, black: PrintFunction, red: PrintFunction, green: PrintFunction, yellow: PrintFunction, blue: PrintFunction, magenta: PrintFunction, cyan: PrintFunction, white: PrintFunction, gray: PrintFunction, bgBlack: PrintFunction, bgRed: PrintFunction, bgGreen: PrintFunction, bgYellow: PrintFunction, bgBlue: PrintFunction, bgMagenta: PrintFunction, bgCyan: PrintFunction, bgWhite: PrintFunction, blackBright: PrintFunction, redBright: PrintFunction, greenBright: PrintFunction, yellowBright: PrintFunction, blueBright: PrintFunction, magentaBright: PrintFunction, cyanBright: PrintFunction, whiteBright: PrintFunction, bgBlackBright: PrintFunction, bgRedBright: PrintFunction, bgGreenBright: PrintFunction, bgYellowBright: PrintFunction, bgBlueBright: PrintFunction, bgMagentaBright: PrintFunction, bgCyanBright: PrintFunction, bgWhiteBright: PrintFunction }} Colors
  */
 
 /**
+ * Defines the colors options type used by this module.
  * @typedef {object} ColorsOptions
  * @property {boolean=} useColor force use colors
  */
 
 /**
+ * Creates a colors from the provided colors option.
  * @param {ColorsOptions=} options options
  * @returns {Colors} colors
  */