@dwp/govuk-casa 8.0.0-beta2 → 8.0.3

package/dist/lib/JourneyContext.js

@@ -26,6 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 var _JourneyContext_data, _JourneyContext_validation, _JourneyContext_nav, _JourneyContext_identity, _JourneyContext_eventListeners, _JourneyContext_eventListenerPreState;
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateObjectKey = void 0;
 /**
  * Represents the state of a user's journey through the Plan. It contains
  * information about:
@@ -39,7 +40,7 @@ const lodash_1 = __importDefault(require("lodash"));
 const ValidationError_js_1 = __importDefault(require("./ValidationError.js"));
 const logger_js_1 = __importDefault(require("./logger.js"));
 const { cloneDeep, isPlainObject, isObject, has, isEqual, } = lodash_1.default; // CommonJS
-const log = (0, logger_js_1.default)('class:journey-context');
+const log = (0, logger_js_1.default)('lib:journey-context');
 /**
  * @typedef {import('./configuration-ingestor').Page} Page
  */
@@ -55,6 +56,14 @@ const log = (0, logger_js_1.default)('class:journey-context');
  * @property {string} [field] Field to watch for changes
  * @property {ContextEventHandler} handler Handler to invoke when change happens
  */
+function validateObjectKey(key = '') {
+    const keyLower = String.prototype.toLowerCase.call(key);
+    if (keyLower === 'prototype' || keyLower === '__proto__' || keyLower === 'constructor') {
+        throw new SyntaxError(`Invalid object key used, ${key}`);
+    }
+    return String(key);
+}
+exports.validateObjectKey = validateObjectKey;
 class JourneyContext {
     /**
      * Constructor.
@@ -144,10 +153,10 @@ class JourneyContext {
      */
     getDataForPage(page) {
         if (typeof page === 'string') {
-            return __classPrivateFieldGet(this, _JourneyContext_data, "f")[page];
+            return __classPrivateFieldGet(this, _JourneyContext_data, "f")[validateObjectKey(page)];
         }
         if (isPlainObject(page)) {
-            return __classPrivateFieldGet(this, _JourneyContext_data, "f")[page.waypoint];
+            return __classPrivateFieldGet(this, _JourneyContext_data, "f")[validateObjectKey(page.waypoint)];
         }
         throw new TypeError(`Page must be a string or Page object. Got ${typeof page}`);
     }
@@ -179,10 +188,10 @@ class JourneyContext {
      */
     setDataForPage(page, webFormData) {
         if (typeof page === 'string') {
-            __classPrivateFieldGet(this, _JourneyContext_data, "f")[page] = webFormData;
+            __classPrivateFieldGet(this, _JourneyContext_data, "f")[validateObjectKey(page)] = webFormData;
         }
         else if (isPlainObject(page)) {
-            __classPrivateFieldGet(this, _JourneyContext_data, "f")[page.waypoint] = webFormData;
+            __classPrivateFieldGet(this, _JourneyContext_data, "f")[validateObjectKey(page.waypoint)] = webFormData;
         }
         else {
             throw new TypeError(`Page must be a string or Page object. Got ${typeof page}`);
@@ -220,7 +229,7 @@ class JourneyContext {
      * @returns {JourneyContext} Chain.
      */
     clearValidationErrorsForPage(pageId) {
-        __classPrivateFieldGet(this, _JourneyContext_validation, "f")[pageId] = null;
+        __classPrivateFieldGet(this, _JourneyContext_validation, "f")[validateObjectKey(pageId)] = null;
         return this;
     }
     /**
@@ -240,7 +249,7 @@ class JourneyContext {
                 throw new SyntaxError('Field errors must be a ValidationError');
             }
         });
-        __classPrivateFieldGet(this, _JourneyContext_validation, "f")[pageId] = errors;
+        __classPrivateFieldGet(this, _JourneyContext_validation, "f")[validateObjectKey(pageId)] = errors;
         return this;
     }
     /**
@@ -251,17 +260,21 @@ class JourneyContext {
      * @returns {ValidationError[]} An array of errors
      */
     getValidationErrorsForPage(pageId) {
-        return __classPrivateFieldGet(this, _JourneyContext_validation, "f")[pageId] || [];
+        var _a;
+        return (_a = __classPrivateFieldGet(this, _JourneyContext_validation, "f")[validateObjectKey(pageId)]) !== null && _a !== void 0 ? _a : [];
     }
     getValidationErrorsForPageByField(pageId) {
         const errors = this.getValidationErrorsForPage(pageId);
         const obj = Object.create(null);
+        // ESLint disabled as `i` is an integer
+        /* eslint-disable security/detect-object-injection */
         for (let i = 0, l = errors.length; i < l; i++) {
             if (!obj[errors[i].field]) {
                 obj[errors[i].field] = [];
             }
             obj[errors[i].field].push(errors[i]);
         }
+        /* eslint-enable security/detect-object-injection */
         return obj;
     }
     /**
@@ -273,7 +286,7 @@ class JourneyContext {
      */
     hasValidationErrorsForPage(pageId) {
         var _a, _b;
-        return ((_b = (_a = __classPrivateFieldGet(this, _JourneyContext_validation, "f")) === null || _a === void 0 ? void 0 : _a[pageId]) === null || _b === void 0 ? void 0 : _b.length) > 0;
+        return ((_b = (_a = __classPrivateFieldGet(this, _JourneyContext_validation, "f")) === null || _a === void 0 ? void 0 : _a[validateObjectKey(pageId)]) === null || _b === void 0 ? void 0 : _b.length) > 0;
     }
     /**
      * Set language of the context.
@@ -292,7 +305,7 @@ class JourneyContext {
      * @returns {boolean} True if the page is valid.
      */
     isPageValid(pageId) {
-        return __classPrivateFieldGet(this, _JourneyContext_validation, "f")[pageId] === null;
+        return __classPrivateFieldGet(this, _JourneyContext_validation, "f")[validateObjectKey(pageId)] === null;
     }
     /**
      * Remove information about these waypoints.
@@ -303,10 +316,13 @@ class JourneyContext {
         const newData = Object.create(null);
         const newValidation = Object.create(null);
         const toKeep = Object.keys(this.data).filter((w) => !waypoints.includes(w));
+        // ESLint disabled as `i` is an integer
+        /* eslint-disable security/detect-object-injection */
         for (let i = 0, l = toKeep.length; i < l; i++) {
             newData[toKeep[i]] = __classPrivateFieldGet(this, _JourneyContext_data, "f")[toKeep[i]];
             newValidation[toKeep[i]] = __classPrivateFieldGet(this, _JourneyContext_validation, "f")[toKeep[i]];
         }
+        /* eslint-enable security/detect-object-injection */
         __classPrivateFieldSet(this, _JourneyContext_data, Object.assign({}, newData), "f");
         __classPrivateFieldSet(this, _JourneyContext_validation, Object.assign({}, newValidation), "f");
     }
@@ -319,6 +335,8 @@ class JourneyContext {
      */
     invalidate(waypoints = []) {
         for (let i = 0, l = waypoints.length; i < l; i++) {
+            // ESLint disabled as `i` is an integer
+            /* eslint-disable-next-line security/detect-object-injection */
             this.removeValidationStateForPage(waypoints[i]);
         }
     }
@@ -346,6 +364,10 @@ class JourneyContext {
         }
         const previousContext = JourneyContext.fromObject(__classPrivateFieldGet(this, _JourneyContext_eventListenerPreState, "f"));
         const listeners = __classPrivateFieldGet(this, _JourneyContext_eventListeners, "f").filter((l) => l.event === event);
+        // ESLint disabled as `listeners[i]` uses an integer key, and the other keys
+        // are derived from the list of `listeners`, which are not manipulated at
+        // runtime (only set by dev in code).
+        /* eslint-disable security/detect-object-injection */
         for (let i = 0, l = listeners.length; i < l; i++) {
             const { waypoint, field, handler } = listeners[i];
             let logMessage;
@@ -367,6 +389,7 @@ class JourneyContext {
                 handler({ journeyContext: this, previousContext });
             }
         }
+        /* eslint-enable security/detect-object-injection */
         return this;
     }
     /* ----------------------------------------------- session context handling */
@@ -440,6 +463,8 @@ class JourneyContext {
      */
     static getContextById(session, id) {
         if (has(session === null || session === void 0 ? void 0 : session.journeyContextList, id)) {
+            // ESLint disabled as `id` has been verified as an "own" property
+            /* eslint-disable-next-line security/detect-object-injection */
             return JourneyContext.fromObject(session.journeyContextList[id]);
         }
         return undefined;
@@ -533,7 +558,8 @@ class JourneyContext {
     }
     static removeContextById(session, id) {
         if (session && has(session.journeyContextList, id)) {
-            /* eslint-disable-next-line no-param-reassign */
+            // ESLint disabled as `id` has been verified as an "own" property
+            /* eslint-disable-next-line security/detect-object-injection, no-param-reassign */
             delete session.journeyContextList[id];
         }
     }

package/dist/lib/MutableRouter.js

@@ -48,6 +48,9 @@ class MutableRouter {
             return __classPrivateFieldGet(this, _MutableRouter_router, "f");
         }
         __classPrivateFieldGet(this, _MutableRouter_stack, "f").forEach(({ method, args }) => {
+            // ESLint disabled as `#router` is dev-controlled, and `seal()` is only
+            // run at boot-time before any user interaction
+            /* eslint-disable-next-line security/detect-object-injection */
             __classPrivateFieldGet(this, _MutableRouter_router, "f")[method].call(__classPrivateFieldGet(this, _MutableRouter_router, "f"), ...args);
         });
         __classPrivateFieldSet(this, _MutableRouter_sealed, true, "f");
@@ -115,7 +118,6 @@ class MutableRouter {
         __classPrivateFieldGet(this, _MutableRouter_instances, "m", _MutableRouter_prepend).call(this, 'use', path, ...callbacks);
     }
     /* -------------------------------------------------------------- replacers */
-    // TODO: How do we handle multiple routes on the same path?
     /**
      * Replace middleware function(s) that were mounted using the `all()` method.
      *

package/dist/lib/Plan.js

@@ -18,7 +18,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const graphlib_1 = require("graphlib");
 const JourneyContext_js_1 = __importDefault(require("./JourneyContext.js"));
 const logger_js_1 = __importDefault(require("./logger.js"));
-const log = (0, logger_js_1.default)('class:plan');
+const log = (0, logger_js_1.default)('lib:plan');
 /**
  * Will check if the source waypoint has specifically passed validation, i.e
  * there is a "null" validation entry for the route source.
@@ -58,6 +58,7 @@ function validateRouteName(val) {
     else if (!['next', 'prev'].includes(val)) {
         throw new ReferenceError(`Expected route name to be one of next or prev. Got ${val}`);
     }
+    return val;
 }
 function validateRouteCondition(val) {
     if (!(val instanceof Function)) {
@@ -177,7 +178,7 @@ class Plan {
         return self.dgraph.edges().map((edge) => makeRouteObject(self.dgraph, edge));
     }
     getRouteCondition(src, tgt, name) {
-        return priv.get(this).follows[name][`${src}/${tgt}`];
+        return priv.get(this).follows[validateRouteName(name)][`${src}/${tgt}`];
     }
     /**
      * Return all outward routes (out-edges) from the given waypoint, to the
@@ -205,6 +206,8 @@ class Plan {
     addSequence(...waypoints) {
         // Setup simple double routes (next/prev) between all waypoints in this list
         for (let i = 0, l = waypoints.length - 1; i < l; i += 1) {
+            // ESLint disabled as `i` is an integer
+            /* eslint-disable-next-line security/detect-object-injection */
             this.setRoute(waypoints[i], waypoints[i + 1]);
         }
     }
@@ -309,6 +312,8 @@ class Plan {
         else {
             followFunc = defaultPrevFollow;
         }
+        // ESLint disabled as `name` has been validated further above
+        /* eslint-disable-next-line security/detect-object-injection */
         self.follows[name][`${src}/${tgt}`] = followFunc;
         return this;
     }
@@ -360,9 +365,7 @@ class Plan {
         if (!self.dgraph.hasNode(startWaypoint)) {
             throw new ReferenceError(`Plan does not contain waypoint '${startWaypoint}'`);
         }
-        if (routeName === undefined) {
-            throw new ReferenceError('Route name must be provided');
-        }
+        validateRouteName(routeName);
         const history = new Map();
         const traverse = (startWP) => {
             let target = self.dgraph.outEdges(startWP).filter((e) => {
@@ -371,6 +374,8 @@ class Plan {
                 }
                 const route = makeRouteObject(self.dgraph, e);
                 try {
+                    // ESLint disabled as `routeName` has been validated further above
+                    /* eslint-disable-next-line security/detect-object-injection */
                     return self.follows[routeName][`${e.v}/${e.w}`](route, context);
                 }
                 catch (ex) {
@@ -413,6 +418,8 @@ class Plan {
                     const results = new Array(totalTrav + 1);
                     results[0] = route;
                     for (let i = 0; i < totalTrav; i++) {
+                        // ESLint disabled as `i` is an integer
+                        /* eslint-disable-next-line security/detect-object-injection */
                         results[i + 1] = traversed[i];
                     }
                     return results;

package/dist/lib/ValidationError.js

@@ -114,11 +114,15 @@ class ValidationError {
         // the values that will be readable, and reflect any context that may have
         // been applied
         Object.keys(originals).forEach((o) => {
+            // ESLint disabled as `o` is an "own" property of `originals`, which is
+            // dev-controlled
+            /* eslint-disable security/detect-object-injection */
             Object.defineProperty(this, o, {
                 value: originals[o],
                 enumerable: true,
                 writable: true,
             });
+            /* eslint-enable security/detect-object-injection */
         });
     }
     /**

package/dist/lib/configuration-ingestor.js

@@ -193,10 +193,10 @@ exports.validateViews = validateViews;
  */
 function validateSessionSecret(secret) {
     if (typeof secret === 'undefined') {
-        throw ReferenceError('Session secret is missing (sessions.secret)');
+        throw ReferenceError('Session secret is missing (session.secret)');
     }
     else if (typeof secret !== 'string') {
-        throw new TypeError('Session secret must be a string (sessions.secret)');
+        throw new TypeError('Session secret must be a string (session.secret)');
     }
     return secret;
 }
@@ -211,10 +211,10 @@ exports.validateSessionSecret = validateSessionSecret;
  */
 function validateSessionTtl(ttl) {
     if (typeof ttl === 'undefined') {
-        throw ReferenceError('Session ttl is missing (sessions.ttl)');
+        throw ReferenceError('Session ttl is missing (session.ttl)');
     }
     else if (typeof ttl !== 'number') {
-        throw new TypeError('Session ttl must be an integer (sessions.ttl)');
+        throw new TypeError('Session ttl must be an integer (session.ttl)');
     }
     return ttl;
 }
@@ -229,10 +229,10 @@ exports.validateSessionTtl = validateSessionTtl;
  */
 function validateSessionName(name) {
     if (typeof name === 'undefined') {
-        throw ReferenceError('Session name is missing (sessions.name)');
+        throw ReferenceError('Session name is missing (session.name)');
     }
     else if (typeof name !== 'string') {
-        throw new TypeError('Session name must be a string (sessions.name)');
+        throw new TypeError('Session name must be a string (session.name)');
     }
     return name;
 }
@@ -247,10 +247,10 @@ exports.validateSessionName = validateSessionName;
  */
 function validateSessionSecure(secure) {
     if (typeof secure === 'undefined') {
-        throw ReferenceError('Session secure flag is missing (sessions.secure)');
+        throw ReferenceError('Session secure flag is missing (session.secure)');
     }
     else if (typeof secure !== 'boolean') {
-        throw new TypeError('Session secure flag must be boolean (sessions.secure)');
+        throw new TypeError('Session secure flag must be boolean (session.secure)');
     }
     return secure;
 }
@@ -302,11 +302,11 @@ function validateSessionCookieSameSite(cookieSameSite, defaultFlag) {
         throw new TypeError('validateSessionCookieSameSite() requires an explicit default flag');
     }
     else if (!validValues.includes(defaultFlag)) {
-        throw new TypeError('validateSessionCookieSameSite() default flag must be set to one of true, false, Strict, Lax or None (sessions.cookieSameSite)');
+        throw new TypeError('validateSessionCookieSameSite() default flag must be set to one of true, false, Strict, Lax or None (session.cookieSameSite)');
     }
     const value = cookieSameSite !== undefined ? cookieSameSite : defaultFlag;
     if (!validValues.includes(value)) {
-        throw new TypeError('SameSite flag must be set to one of true, false, Strict, Lax or None (sessions.cookieSameSite)');
+        throw new TypeError('SameSite flag must be set to one of true, false, Strict, Lax or None (session.cookieSameSite)');
     }
     return value;
 }
@@ -435,7 +435,7 @@ function ingest(config = {}) {
         // Public URL from which the app will be served
         mountUrl: validateMountUrl(config.mountUrl),
         // Session
-        sessions: validateSessionObject(config.session, (session) => ({
+        session: validateSessionObject(config.session, (session) => ({
             name: validateSessionName(session.name),
             secret: validateSessionSecret(session.secret),
             secure: validateSessionSecure(session.secure),
@@ -462,29 +462,3 @@ function ingest(config = {}) {
     return parsed;
 }
 exports.default = ingest;
-// module.exports = {
-//   ingest,
-//   validateAllowPageEdit,
-//   validateUseStickyEdit,
-//   validateContentSecurityPolicies,
-//   validateHeadersObject,
-//   validateHeadersDisabled,
-//   validateI18nObject,
-//   validateI18nDirs,
-//   validateI18nLocales,
-//   validateMountController,
-//   validateMountUrl,
-//   validatePhase,
-//   validateServiceName,
-//   validateSessionExpiryController,
-//   validateSessionObject,
-//   validateSessionCookiePath,
-//   validateSessionCookieSameSite,
-//   validateSessionName,
-//   validateSessionSecret,
-//   validateSessionSecure,
-//   validateSessionStore,
-//   validateSessionTtl,
-//   validateViewsObject,
-//   validateViews,
-// };

package/dist/lib/configure.js

@@ -61,12 +61,11 @@ function configure(config = {}) {
         plugin.configure(config);
     });
     // Extract config
-    // TODO: Validate/sanitise and deep-freeze object
     const { mountUrl = '/', views = [], session = {
         secret: 'secret',
         name: 'casasession',
         secure: false,
-        ttl: 60 * 60,
+        ttl: 3600,
         cookieSameSite: true,
         cookiePath: '/',
         store: undefined,

package/dist/lib/dirname.cjs

@@ -1 +1 @@
-module.exports = __dirname;
+module.exports = __dirname;

package/dist/lib/end-session.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const logger_js_1 = __importDefault(require("./logger.js"));
-const log = (0, logger_js_1.default)('function:end-session');
+const log = (0, logger_js_1.default)('lib:end-session');
 /**
  * A convenience for ending the current session, but retaining some data in it,
  * like the current language. It persists an empty session before regenerating
@@ -21,6 +21,9 @@ function endSession(req, next) {
     const { language } = req.session;
     Object.entries(req.session).forEach(([k]) => {
         if (!['cookie'].includes(k)) {
+            // ESLint disabled as `Object.entries()` returns "own" properties, and
+            // all values are being null'd, so not assigned any user-controlled values
+            /* eslint-disable-next-line security/detect-object-injection */
             req.session[k] = null;
         }
     });

package/dist/lib/field.d.ts

@@ -10,7 +10,7 @@ export class PageField {
      * @throws {Error} When run on a complex field
      */
     getValue(obj?: object): any;
-    putValue(obj: any, value: any): PageField;
+    putValue(obj?: any, value?: undefined): PageField;
     get name(): string;
     get meta(): object;
     /**
@@ -46,7 +46,7 @@ export class PageField {
      * @param {ValidateContext} context Contextual information
      * @returns {ValidationError[]} Errors, or an empty array if all valid
      */
-    runValidators(value: any, context: any): ValidationError[];
+    runValidators(value: any, context?: any): ValidationError[];
     applyProcessors(value: any): any;
     /**
      * Apply all conditions to get the resulting boolean

package/dist/lib/field.js

@@ -107,7 +107,7 @@ class PageField {
         }
         throw new Error('Not yet supporting complex field types');
     }
-    putValue(obj = Object.create(null), value) {
+    putValue(obj = Object.create(null), value = undefined) {
         if (!__classPrivateFieldGet(this, _PageField_meta, "f").complex) {
             /* eslint-disable-next-line no-param-reassign */
             obj[__classPrivateFieldGet(this, _PageField_name, "f")] = value;
@@ -174,14 +174,24 @@ class PageField {
      * @param {ValidateContext} context Contextual information
      * @returns {ValidationError[]} Errors, or an empty array if all valid
      */
-    runValidators(value, context) {
+    runValidators(value, context = Object.create(null)) {
+        var _a;
         // Skip validation if the field is empty and optional
         if (__classPrivateFieldGet(this, _PageField_meta, "f").optional && (0, utils_js_1.isEmpty)(value)) {
             return [];
         }
+        // Skip validation if conditions are not met
+        // We duplicate value in context.fieldValue for historical reasons
+        context.fieldValue = (_a = context.fieldValue) !== null && _a !== void 0 ? _a : value;
+        if (!this.testConditions(context)) {
+            return [];
+        }
         let errors = [];
         for (let i = 0, l = __classPrivateFieldGet(this, _PageField_validators, "f").length; i < l; i++) {
+            // ESLint disabled as `i` is an integer
+            /* eslint-disable security/detect-object-injection */
             const fieldErrors = __classPrivateFieldGet(this, _PageField_validators, "f")[i].validate(value, context).map((e) => e.withContext(Object.assign(Object.assign({}, context), { validator: __classPrivateFieldGet(this, _PageField_validators, "f")[i].name })));
+            /* eslint-enable security/detect-object-injection */
             errors = [
                 ...errors,
                 ...(fieldErrors !== null && fieldErrors !== void 0 ? fieldErrors : []),
@@ -199,12 +209,17 @@ class PageField {
         let processedValue = value;
         // Some of the validators may have their own "sanitise()" methods. These
         // should be run before any other processors
+        // ESLint disabled as `i` is an integer
+        /* eslint-disable security/detect-object-injection */
         for (let i = 0, l = __classPrivateFieldGet(this, _PageField_validators, "f").length; i < l; i++) {
             if (isFunction(__classPrivateFieldGet(this, _PageField_validators, "f")[i].sanitise)) {
                 processedValue = __classPrivateFieldGet(this, _PageField_validators, "f")[i].sanitise(processedValue);
             }
         }
+        /* eslint-enable security/detect-object-injection */
         for (let i = 0, l = __classPrivateFieldGet(this, _PageField_processors, "f").length; i < l; i++) {
+            // ESLint disabled as `i` is an integer
+            /* eslint-disable-next-line security/detect-object-injection */
             processedValue = __classPrivateFieldGet(this, _PageField_processors, "f")[i](processedValue);
         }
         return processedValue;
@@ -228,6 +243,8 @@ class PageField {
         };
         let result = true;
         for (let i = 0, l = __classPrivateFieldGet(this, _PageField_conditions, "f").length; i < l; i++) {
+            // ESLint disabled as `i` is an integer
+            /* eslint-disable-next-line security/detect-object-injection */
             result = result && __classPrivateFieldGet(this, _PageField_conditions, "f")[i](context);
         }
         return result;

package/dist/lib/logger.d.ts

@@ -1,4 +1,4 @@
-declare function _default(ns: any): {
+declare function _default(namespace: any): {
     trace: any;
     debug: any;
     info: any;

package/dist/lib/logger.js

@@ -5,8 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const debug_1 = __importDefault(require("debug"));
 const casaDebugger = (0, debug_1.default)('casa');
-exports.default = (ns) => {
-    const logger = casaDebugger.extend(ns);
+exports.default = (namespace) => {
+    const logger = casaDebugger.extend(namespace);
     return {
         trace: logger.extend('trace'),
         debug: logger.extend('debug'),

package/dist/lib/nunjucks-filters.js

@@ -14,6 +14,8 @@ const { all: deepmergeAll } = deepmerge_1.default;
 const combineMerge = (target, source, options) => {
     const destination = target.slice();
     source.forEach((item, index) => {
+        // ESLint disabled as `index` is only an integer
+        /* eslint-disable security/detect-object-injection */
         if (typeof destination[index] === 'undefined') {
             destination[index] = options.cloneUnlessOtherwiseSpecified(item, options);
         }
@@ -23,6 +25,7 @@ const combineMerge = (target, source, options) => {
         else if (target.indexOf(item) === -1) {
             destination.push(item);
         }
+        /* eslint-enable security/detect-object-injection */
     });
     return destination;
 };
@@ -75,6 +78,10 @@ function renderAsAttributes(attrsObject) {
     const attrsList = [];
     if (typeof attrsObject === 'object') {
         Object.keys(attrsObject).forEach((key) => {
+            // ESLint disable as `attrsObject` is dev-controlled, `Object.keys()` has
+            // been used (to get "own" properties) and `m` is one of the characters
+            // found by the regex.
+            /* eslint-disable security/detect-object-injection */
             const value = String(attrsObject[key]).replace(/[<>"'&]/g, (m) => ({
                 '<': '&lt;',
                 '>': '&gt;',
@@ -82,6 +89,7 @@ function renderAsAttributes(attrsObject) {
                 '\'': '&#039;',
                 '&': '&amp;',
             }[m]));
+            /* eslint-enable security/detect-object-injection */
             attrsList.push(`${key}="${value}"`);
         });
     }

package/dist/lib/utils.js

@@ -46,6 +46,8 @@ function isEmpty(val) {
         return true;
     }
     if (Array.isArray(val) || typeof val === 'object') {
+        // ESLint disabled as `k` is an "own property" (thanks to `Object.keys()`)
+        /* eslint-disable-next-line security/detect-object-injection */
         return Object.keys(val).filter((k) => !isEmpty(val[k])).length === 0;
     }
     return false;

package/dist/lib/validators/inArray.js

@@ -31,7 +31,7 @@ class InArray extends ValidatorFactory_js_1.default {
         if (value !== null && typeof value !== 'undefined') {
             const search = Array.isArray(value) ? value : [value];
             for (let i = 0, l = search.length; i < l; i += 1) {
-                if (source.indexOf(search[i]) > -1) {
+                if (source.indexOf(search[parseInt(i, 10)]) > -1) {
                     valid = true;
                 }
                 else {

package/dist/lib/validators/index.js

@@ -23,25 +23,3 @@ exports.default = {
     strlen: strlen_js_1.default,
     wordCount: wordCount_js_1.default,
 };
-// const dateObject = require('./dateObject.js');
-// const email = require('./email.js');
-// const inArray = require('./inArray.js');
-// const nino = require('./nino.js');
-// const optional = require('./optional.js');
-// const postalAddressObject = require('./postalAddressObject.js');
-// const regex = require('./regex.js');
-// const required = require('./required.js');
-// const strlen = require('./strlen.js');
-// const wordCount = require('./wordCount.js');
-// module.exports = {
-//   dateObject,
-//   email,
-//   inArray,
-//   nino,
-//   optional,
-//   postalAddressObject,
-//   regex,
-//   required,
-//   strlen,
-//   wordCount,
-// };

package/dist/lib/validators/postalAddressObject.js

@@ -66,6 +66,8 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
         const reqF = Object.create(null);
         const reqC = cfg.requiredFields;
         ['address1', 'address2', 'address3', 'address4', 'postcode'].forEach((k) => {
+            // ESLint disabled as `k` is a known value from a constant list
+            /* eslint-disable-next-line security/detect-object-injection */
             reqF[k] = reqC.indexOf(k) > -1;
         });
         let valid = true;
@@ -75,8 +77,7 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
             const reAddrLine1 = /^\d+|[^\s]+[a-z0-9\-,.&#()/\\:;'" ]+$/i;
             // UK Postcode regex taken from the dwp java pc checker
             // https://github.com/dwp/postcode-format-validation
-            const pc = /^(?![QVX])[A-Z]((?![IJZ])[A-Z][0-9](([0-9]?)|([ABEHMNPRVWXY]?))|([0-9]([0-9]?|[ABCDEFGHJKPSTUW]?))) ?[0-9]((?![CIKMOV])[A-Z]){2}$|^(BFPO)[ ]?[0-9]{1,4}$/i;
-            const rePostcode = new RegExp(pc, 'i');
+            const rePostcode = /^(?![QVX])[A-Z]((?![IJZ])[A-Z][0-9](([0-9]?)|([ABEHMNPRVWXY]?))|([0-9]([0-9]?|[ABCDEFGHJKPSTUW]?))) ?[0-9]((?![CIKMOV])[A-Z]){2}$|^(BFPO)[ ]?[0-9]{1,4}$/i;
             // [required, regex, strlenmax, error message]
             const attributes = {
                 address1: [reqF.address1, reAddrLine1, cfg.strlenmax, cfg.errorMsgAddress1],
@@ -85,6 +86,8 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
                 address4: [reqF.address4, reAddr, cfg.strlenmax, cfg.errorMsgAddress4],
                 postcode: [reqF.postcode, rePostcode, null, cfg.errorMsgPostcode],
             };
+            // ESLint disabled as `k` is a known value from the constant list above
+            /* eslint-disable security/detect-object-injection */
             Object.keys(attributes).forEach((k) => {
                 const attr = attributes[k];
                 const hasProperty = Object.prototype.hasOwnProperty.call(value, k);
@@ -100,6 +103,7 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
                     }));
                 }
             });
+            /* eslint-enable security/detect-object-injection */
         }
         else {
             valid = false;

package/dist/middleware/body-parser.d.ts

@@ -1 +1,2 @@
+export function verifyBody(req: any, res: any, buf: any, encoding: any): void;
 export default function bodyParserMiddleware(): import("connect").NextHandleFunction[];