@dwp/govuk-casa 8.16.2 → 8.16.4

package/src/lib/nunjucks-filters.js

@@ -1,6 +1,6 @@
-import merge from 'deepmerge';
-import { DateTime } from 'luxon';
-import nunjucks from 'nunjucks';
+import merge from "deepmerge";
+import { DateTime } from "luxon";
+import nunjucks from "nunjucks";
 
 const { all: deepmergeAll } = merge;
 
@@ -9,54 +9,66 @@ const { all: deepmergeAll } = merge;
 // ref: https://www.npmjs.com/package/deepmerge
 
 const combineMerge = (target, source, options) => {
-  const destination = target.slice()
+  const destination = target.slice();
 
   source.forEach((item, index) => {
     // ESLint disabled as `index` is only an integer
     /* eslint-disable security/detect-object-injection */
-    if (typeof destination[index] === 'undefined') {
-      destination[index] = options.cloneUnlessOtherwiseSpecified(item, options)
+    if (typeof destination[index] === "undefined") {
+      destination[index] = options.cloneUnlessOtherwiseSpecified(item, options);
     } else if (options.isMergeableObject(item)) {
-      destination[index] = merge(target[index], item, options)
+      destination[index] = merge(target[index], item, options);
     } else if (target.indexOf(item) === -1) {
-      destination.push(item)
+      destination.push(item);
     }
     /* eslint-enable security/detect-object-injection */
-  })
-  return destination
-}
+  });
+  return destination;
+};
 
 // Allows objects to be deepmerged and retain their type, without becoming [object Object]
 // ref: https://github.com/jonschlinkert/is-plain-object/blob/master/is-plain-object.js
 
+/**
+ * @param {any} o Value to test
+ * @returns {boolean} True if an object
+ */
 function isObject(o) {
-  return Object.prototype.toString.call(o) === '[object Object]';
+  return Object.prototype.toString.call(o) === "[object Object]";
 }
 
+/**
+ * @param {any} o Value to test
+ * @returns {boolean} True if a plain object or array
+ */
 function isPlainObjectOrArray(o) {
   if (Array.isArray(o)) {
-    return true
+    return true;
   }
   if (isObject(o) === false) {
-    return false
+    return false;
   }
   const ctor = o.constructor;
   if (ctor === undefined) {
-    return true
+    return true;
   }
   const prot = ctor.prototype;
   if (isObject(prot) === false) {
-    return false
+    return false;
   }
   // eslint-disable-next-line no-prototype-builtins
-  return prot.hasOwnProperty('isPrototypeOf');
+  return prot.hasOwnProperty("isPrototypeOf");
 }
 
+/**
+ * @param {...any} objects Objects to merge
+ * @returns {object} Merged object
+ */
 function mergeObjects(...objects) {
-  return deepmergeAll([
-    Object.create(null),
-    ...objects,
-  ], { arrayMerge: combineMerge, isMergeableObject: isPlainObjectOrArray });
+  return deepmergeAll([Object.create(null), ...objects], {
+    arrayMerge: combineMerge,
+    isMergeableObject: isPlainObjectOrArray,
+  });
 }
 /**
  * Determine whether a value exists in a list.
@@ -66,7 +78,7 @@ function mergeObjects(...objects) {
  * @param {any} search Item to search within the `source`
  * @returns {boolean} True if the search item was found
  */
-function includes(source = [], search = '') {
+function includes(source = [], search = "") {
   return source.includes(search);
 }
 
@@ -89,21 +101,23 @@ function includes(source = [], search = '') {
  * @returns {string} Formatted date
  */
 function formatDateObject(date, config = {}) {
-  const { locale = 'en', format = 'd MMMM yyyy' } = config;
+  const { locale = "en", format = "d MMMM yyyy" } = config;
 
   if (
-    Object.prototype.toString.call(date) === '[object Object]'
-    && 'yyyy' in date
-    && 'mm' in date
-    && 'dd' in date
+    Object.prototype.toString.call(date) === "[object Object]" &&
+    "yyyy" in date &&
+    "mm" in date &&
+    "dd" in date
   ) {
     return DateTime.fromObject({
       year: Math.max(0, parseInt(date.yyyy, 10)),
       month: Math.max(0, parseInt(date.mm, 10)),
       day: Math.max(1, parseInt(date.dd, 10)),
-    }).setLocale(locale).toFormat(format);
+    })
+      .setLocale(locale)
+      .toFormat(format);
   }
-  return 'INVALID DATE OBJECT';
+  return "INVALID DATE OBJECT";
 }
 
 /**
@@ -119,32 +133,31 @@ function formatDateObject(date, config = {}) {
  */
 function renderAsAttributes(attrsObject) {
   const attrsList = [];
-  if (typeof attrsObject === 'object') {
+  if (typeof attrsObject === "object") {
     Object.keys(attrsObject).forEach((key) => {
       // ESLint disable as `attrsObject` is dev-controlled, `Object.keys()` has
       // been used (to get "own" properties) and `m` is one of the characters
       // found by the regex.
       /* eslint-disable security/detect-object-injection */
-      const value = String(attrsObject[key]).replace(/[<>"'&]/g, (m) => ({
-        '<': '&lt;',
-        '>': '&gt;',
-        '"': '&quot;',
-        '\'': '&#039;',
-        '&': '&amp;',
-      }[m]));
+      const value = String(attrsObject[key]).replace(
+        /[<>"'&]/g,
+        (m) =>
+          ({
+            "<": "&lt;",
+            ">": "&gt;",
+            '"': "&quot;",
+            "'": "&#039;",
+            "&": "&amp;",
+          })[m],
+      );
       /* eslint-enable security/detect-object-injection */
       attrsList.push(`${key}="${value}"`);
     });
   }
-  return new nunjucks.runtime.SafeString(attrsList.join(' '));
+  return new nunjucks.runtime.SafeString(attrsList.join(" "));
 }
 
 /**
  * @namespace NunjucksFilters
  */
-export {
-  mergeObjects,
-  includes,
-  formatDateObject,
-  renderAsAttributes,
-};
+export { mergeObjects, includes, formatDateObject, renderAsAttributes };

package/src/lib/nunjucks.js

@@ -1,11 +1,14 @@
-import { readFileSync } from 'fs';
-import { resolve } from 'path';
-import { Environment } from 'nunjucks';
-import dirname from './dirname.cjs';
-import CasaTemplateLoader from './CasaTemplateLoader.js';
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import { Environment } from "nunjucks";
+import dirname from "./dirname.cjs";
+import CasaTemplateLoader from "./CasaTemplateLoader.js";
 import {
-  mergeObjects, includes, renderAsAttributes, formatDateObject,
-} from './nunjucks-filters.js';
+  mergeObjects,
+  includes,
+  renderAsAttributes,
+  formatDateObject,
+} from "./nunjucks-filters.js";
 
 /**
  * @typedef {object} NunjucksOptions
@@ -19,9 +22,7 @@ import {
  * @param {NunjucksOptions} options Nunjucks options
  * @returns {Environment} Nunjucks Environment instance
  */
-export default function nunjucksConfig({
-  views = [],
-}) {
+export default function nunjucksConfig({ views = [] }) {
   // Prepare a single Nunjucks environment for all responses to use. Note that
   // we cannot prepare response-specific global functions/filters if we use a
   // single environment, but the performance gains of doing so are significant.
@@ -42,13 +43,16 @@ export default function nunjucksConfig({
 
   // Globals
   // These can't be modified once set. But they can be overridden by res.locals.
-  /* eslint-disable-next-line security/detect-non-literal-fs-filename */
-  env.addGlobal('casaVersion', JSON.parse(readFileSync(resolve(dirname, '../../package.json'))).version);
 
-  env.addGlobal('mergeObjects', mergeObjects);
-  env.addGlobal('includes', includes);
-  env.addGlobal('formatDateObject', formatDateObject);
-  env.addGlobal('renderAsAttributes', renderAsAttributes);
+  env.addGlobal(
+    "casaVersion",
+    JSON.parse(readFileSync(resolve(dirname, "../../package.json"))).version,
+  );
+
+  env.addGlobal("mergeObjects", mergeObjects);
+  env.addGlobal("includes", includes);
+  env.addGlobal("formatDateObject", formatDateObject);
+  env.addGlobal("renderAsAttributes", renderAsAttributes);
 
   return env;
 }

package/src/lib/utils.js

@@ -12,13 +12,13 @@
  */
 export function isEmpty(val) {
   if (
-    val === null
-    || typeof val === 'undefined'
-    || (typeof val === 'string' && val === '')
+    val === null ||
+    typeof val === "undefined" ||
+    (typeof val === "string" && val === "")
   ) {
     return true;
   }
-  if (Array.isArray(val) || typeof val === 'object') {
+  if (Array.isArray(val) || typeof val === "object") {
     // ESLint disabled as `k` is an "own property" (thanks to `Object.keys()`)
     /* eslint-disable-next-line security/detect-object-injection */
     return Object.keys(val).filter((k) => !isEmpty(val[k])).length === 0;
@@ -34,7 +34,7 @@ export function isEmpty(val) {
  * @returns {boolean} Whether the value is stringable or not
  */
 export function isStringable(value) {
-  return typeof value === 'string' || typeof value === 'number';
+  return typeof value === "string" || typeof value === "number";
 }
 
 /**
@@ -48,9 +48,14 @@ export function isStringable(value) {
  * @returns {Function[]} An array of middleware that should be applied
  */
 export function resolveMiddlewareHooks(hookName, path, hooks = []) {
-  /* eslint-disable-next-line max-len */
-  const pathMatch = (h) => h.path === undefined || (h.path instanceof RegExp && h.path.test(path)) || h.path === path;
-  return hooks.filter((h) => h.hook === hookName).filter(pathMatch).map((h) => h.middleware);
+  const pathMatch = (h) =>
+    h.path === undefined ||
+    (h.path instanceof RegExp && h.path.test(path)) ||
+    h.path === path;
+  return hooks
+    .filter((h) => h.hook === hookName)
+    .filter(pathMatch)
+    .map((h) => h.middleware);
 }
 
 /**
@@ -63,7 +68,10 @@ export function resolveMiddlewareHooks(hookName, path, hooks = []) {
  */
 export function stringifyInput(input, fallback) {
   // Not using param defaults here as the fallback may be explicitly "undefined"
-  const fb = arguments.length === 2 && (isStringable(fallback) || fallback === undefined) ? fallback : '';
+  const fb =
+    arguments.length === 2 && (isStringable(fallback) || fallback === undefined)
+      ? fallback
+      : "";
   return isStringable(input) ? String(input) : fb;
 }
 
@@ -88,32 +96,37 @@ export function coerceInputToInteger(input) {
  */
 export function stripWhitespace(value, options) {
   const opts = {
-    leading: '',
-    trailing: '',
-    nested: ' ',
+    leading: "",
+    trailing: "",
+    nested: " ",
     ...options,
   };
 
-  if (typeof value !== 'string') {
-    throw new TypeError('value must be a string');
+  if (typeof value !== "string") {
+    throw new TypeError("value must be a string");
   }
 
-  if (typeof opts.leading !== 'string') {
-    throw new TypeError('leading must be a string');
+  if (typeof opts.leading !== "string") {
+    throw new TypeError("leading must be a string");
   }
 
-  if (typeof opts.trailing !== 'string') {
-    throw new TypeError('trailing must be a string');
+  if (typeof opts.trailing !== "string") {
+    throw new TypeError("trailing must be a string");
   }
 
-  if (typeof opts.nested !== 'string') {
-    throw new TypeError('nested must be a string');
+  if (typeof opts.nested !== "string") {
+    throw new TypeError("nested must be a string");
   }
 
-  return value
-    .replace(/^\s+/, opts.leading)
-    .replace(/\s+$/, opts.trailing)
-    .replace(/\s+/g, opts.nested);
+  // This approach avoids using `/s+$/` regex, which triggers the
+  // `sonarjs/slow-regex` eslint rule
+  let newValue = value.replace(/^\s+/, opts.leading);
+  if (newValue.match(/\s$/)) {
+    newValue = `${newValue.trimEnd()}${opts.trailing}`;
+  }
+  newValue = newValue.replace(/\s+/g, opts.nested);
+
+  return newValue;
 }
 
 /* ------------------------------------------------ validation / sanitisation */
@@ -127,8 +140,12 @@ export function stripWhitespace(value, options) {
  * @throws {Error} if proposed key is an invalid keyword
  */
 export function notProto(key) {
-  if (['__proto__', 'constructor', 'prototype'].includes(String(key).toLowerCase())) {
-    throw new Error('Attempt to use prototype key disallowed');
+  if (
+    ["__proto__", "constructor", "prototype"].includes(
+      String(key).toLowerCase(),
+    )
+  ) {
+    throw new Error("Attempt to use prototype key disallowed");
   }
   return key;
 }
@@ -143,16 +160,18 @@ export function notProto(key) {
  * @throws {SyntaxError}
  */
 export function validateHookName(hookName) {
-  if (typeof hookName !== 'string') {
-    throw new TypeError('Hook name must be a string');
+  if (typeof hookName !== "string") {
+    throw new TypeError("Hook name must be a string");
   }
 
   if (!hookName.length) {
-    throw new SyntaxError('Hook name must not be empty');
+    throw new SyntaxError("Hook name must not be empty");
   }
 
   if (!hookName.match(/^([a-z_]+\.|)[a-z_]+$/i)) {
-    throw new SyntaxError('Hook name must match either <scope>.<hookname> or <hookname> formats');
+    throw new SyntaxError(
+      "Hook name must match either <scope>.<hookname> or <hookname> formats",
+    );
   }
 }
 
@@ -165,8 +184,8 @@ export function validateHookName(hookName) {
  * @throws {TypeError}
  */
 export function validateHookPath(path) {
-  if (typeof path !== 'string' && !(path instanceof RegExp)) {
-    throw new TypeError('Hook path must be a string or RegExp');
+  if (typeof path !== "string" && !(path instanceof RegExp)) {
+    throw new TypeError("Hook path must be a string or RegExp");
   }
 }
 
@@ -180,16 +199,18 @@ export function validateHookPath(path) {
  * @throws {SyntaxError}
  */
 export function validateUrlPath(path) {
-  if (typeof path !== 'string') {
-    throw new TypeError('URL path must be a string');
+  if (typeof path !== "string") {
+    throw new TypeError("URL path must be a string");
   }
 
   if (path.match(/[^/a-z0-9_-]/)) {
-    throw new SyntaxError('URL path must contain only a-z, 0-9, -, _ and / characters');
+    throw new SyntaxError(
+      "URL path must contain only a-z, 0-9, -, _ and / characters",
+    );
   }
 
   if (path.match(/\/{2,}/)) {
-    throw new SyntaxError('URL path must not contain consecutive /');
+    throw new SyntaxError("URL path must not contain consecutive /");
   }
 
   return path;
@@ -205,16 +226,18 @@ export function validateUrlPath(path) {
  * @throws {SyntaxError}
  */
 export function validateView(view) {
-  if (typeof view !== 'string') {
-    throw new TypeError('View must be a string');
+  if (typeof view !== "string") {
+    throw new TypeError("View must be a string");
   }
 
   if (!view.length) {
-    throw new SyntaxError('View must not be empty');
+    throw new SyntaxError("View must not be empty");
   }
 
   if (!view.match(/^[a-z0-9/_-]+\.njk$/i)) {
-    throw new SyntaxError('View must contain only a-z, 0-9, -, _ and / characters, and end in .njk');
+    throw new SyntaxError(
+      "View must contain only a-z, 0-9, -, _ and / characters, and end in .njk",
+    );
   }
 }
 
@@ -228,15 +251,17 @@ export function validateView(view) {
  * @throws {SyntaxError}
  */
 export function validateWaypoint(waypoint) {
-  if (typeof waypoint !== 'string') {
-    throw new TypeError('Waypoint must be a string');
+  if (typeof waypoint !== "string") {
+    throw new TypeError("Waypoint must be a string");
   }
 
   if (!waypoint.length) {
-    throw new SyntaxError('Waypoint must not be empty');
+    throw new SyntaxError("Waypoint must not be empty");
   }
 
   if (waypoint.match(/[^/a-z0-9_-]/)) {
-    throw new SyntaxError('Waypoint must contain only a-z, 0-9, -, _ and / characters');
+    throw new SyntaxError(
+      "Waypoint must contain only a-z, 0-9, -, _ and / characters",
+    );
   }
 }

package/src/lib/validators/dateObject.js

@@ -1,9 +1,8 @@
-/* eslint-disable class-methods-use-this */
-import { DateTime } from 'luxon';
-import lodash from 'lodash';
-import ValidationError from '../ValidationError.js';
-import ValidatorFactory from '../ValidatorFactory.js';
-import { stringifyInput, stripWhitespace } from '../utils.js';
+import { DateTime } from "luxon";
+import lodash from "lodash";
+import ValidationError from "../ValidationError.js";
+import ValidatorFactory from "../ValidatorFactory.js";
+import { stringifyInput, stripWhitespace } from "../utils.js";
 
 const { isPlainObject } = lodash;
 
@@ -43,21 +42,21 @@ const { isPlainObject } = lodash;
  */
 export default class DateObject extends ValidatorFactory {
   /** @property {string} name Validator name ("dateObject") */
-  name = 'dateObject';
+  name = "dateObject";
 
   validate(value, dataContext = {}) {
     const config = {
       errorMsg: {
-        inline: 'validation:rule.dateObject.inline',
-        summary: 'validation:rule.dateObject.summary',
+        inline: "validation:rule.dateObject.inline",
+        summary: "validation:rule.dateObject.summary",
       },
       errorMsgAfterOffset: {
-        inline: 'validation:rule.dateObject.afterOffset.inline',
-        summary: 'validation:rule.dateObject.afterOffset.summary',
+        inline: "validation:rule.dateObject.afterOffset.inline",
+        summary: "validation:rule.dateObject.afterOffset.summary",
       },
       errorMsgBeforeOffset: {
-        inline: 'validation:rule.dateObject.beforeOffset.inline',
-        summary: 'validation:rule.dateObject.beforeOffset.summary',
+        inline: "validation:rule.dateObject.beforeOffset.inline",
+        summary: "validation:rule.dateObject.beforeOffset.summary",
       },
       now: DateTime.local(),
       allowSingleDigitDay: false,
@@ -71,38 +70,44 @@ export default class DateObject extends ValidatorFactory {
     let valid = false;
     let { errorMsg } = config;
     let luxonDate;
-    const NOW = config.now.startOf('day');
+    const NOW = config.now.startOf("day");
 
     // Accepted formats
-    let formats = ['dd-MM-yyyy'];
-    const formatTests = [{
-      flags: [config.allowSingleDigitDay],
-      formats: ['d-MM-yyyy'],
-    }, {
-      flags: [config.allowSingleDigitDay, config.allowSingleDigitMonth],
-      formats: ['d-M-yyyy'],
-    }, {
-      flags: [config.allowSingleDigitDay, config.allowMonthNames],
-      formats: ['d-MMM-yyyy', 'd-MMMM-yyyy'],
-    }, {
-      flags: [config.allowSingleDigitMonth],
-      formats: ['dd-M-yyyy'],
-    }, {
-      flags: [config.allowMonthNames],
-      formats: ['dd-MMM-yyyy', 'dd-MMMM-yyyy'],
-    }];
+    let formats = ["dd-MM-yyyy"];
+    const formatTests = [
+      {
+        flags: [config.allowSingleDigitDay],
+        formats: ["d-MM-yyyy"],
+      },
+      {
+        flags: [config.allowSingleDigitDay, config.allowSingleDigitMonth],
+        formats: ["d-M-yyyy"],
+      },
+      {
+        flags: [config.allowSingleDigitDay, config.allowMonthNames],
+        formats: ["d-MMM-yyyy", "d-MMMM-yyyy"],
+      },
+      {
+        flags: [config.allowSingleDigitMonth],
+        formats: ["dd-M-yyyy"],
+      },
+      {
+        flags: [config.allowMonthNames],
+        formats: ["dd-MMM-yyyy", "dd-MMMM-yyyy"],
+      },
+    ];
     formatTests.forEach((test) => {
       if (test.flags.every((v) => v === true)) {
         formats = [...formats, ...test.formats];
       }
     });
 
-    if (typeof value === 'object') {
+    if (typeof value === "object") {
       formats.find((format) => {
         luxonDate = DateTime.fromFormat(
-          [value.dd, value.mm, value.yyyy].join('-'),
+          [value.dd, value.mm, value.yyyy].join("-"),
           format,
-        ).startOf('day');
+        ).startOf("day");
 
         valid = luxonDate.isValid;
 
@@ -113,7 +118,7 @@ export default class DateObject extends ValidatorFactory {
         // Check date is after the specified duration from now.
         // Need to use UTC() otherwise DST shifts can affect the calculated offset
         if (config.afterOffsetFromNow) {
-          const offsetDate = NOW.plus(config.afterOffsetFromNow).startOf('day');
+          const offsetDate = NOW.plus(config.afterOffsetFromNow).startOf("day");
 
           if (luxonDate <= offsetDate) {
             valid = false;
@@ -124,7 +129,9 @@ export default class DateObject extends ValidatorFactory {
         // Check date is before the specified duration from now
         // Need to use UTC() otherwise DST shifts can affect the calculated offset
         if (config.beforeOffsetFromNow) {
-          const offsetDate = NOW.plus(config.beforeOffsetFromNow).startOf('day');
+          const offsetDate = NOW.plus(config.beforeOffsetFromNow).startOf(
+            "day",
+          );
 
           if (luxonDate >= offsetDate) {
             valid = false;
@@ -136,20 +143,20 @@ export default class DateObject extends ValidatorFactory {
       // Check presence of each object component (dd, mm, yyyy) in order to log
       // which specific parts are in error
       errorMsg.focusSuffix = [];
-      if (!Object.prototype.hasOwnProperty.call(value, 'dd') || !value.dd) {
-        errorMsg.focusSuffix.push('[dd]');
+      if (!Object.prototype.hasOwnProperty.call(value, "dd") || !value.dd) {
+        errorMsg.focusSuffix.push("[dd]");
       }
-      if (!Object.prototype.hasOwnProperty.call(value, 'mm') || !value.mm) {
-        errorMsg.focusSuffix.push('[mm]');
+      if (!Object.prototype.hasOwnProperty.call(value, "mm") || !value.mm) {
+        errorMsg.focusSuffix.push("[mm]");
       }
-      if (!Object.prototype.hasOwnProperty.call(value, 'yyyy') || !value.yyyy) {
-        errorMsg.focusSuffix.push('[yyyy]');
+      if (!Object.prototype.hasOwnProperty.call(value, "yyyy") || !value.yyyy) {
+        errorMsg.focusSuffix.push("[yyyy]");
       }
 
       // If the date is invalid, but not specific parts have been highlighted in
       // error, then highlight all inputs, focusing on the [dd] first
       if (!valid && !errorMsg.focusSuffix.length) {
-        errorMsg.focusSuffix = ['[dd]', '[mm]', '[yyyy]'];
+        errorMsg.focusSuffix = ["[dd]", "[mm]", "[yyyy]"];
       }
     }
 
@@ -158,11 +165,13 @@ export default class DateObject extends ValidatorFactory {
 
   sanitise(value) {
     if (value !== undefined) {
-      return isPlainObject(value) ? {
-        dd: stripWhitespace(stringifyInput(value.dd)),
-        mm: stripWhitespace(stringifyInput(value.mm)),
-        yyyy: stripWhitespace(stringifyInput(value.yyyy)),
-      } : Object.create(null);
+      return isPlainObject(value)
+        ? {
+            dd: stripWhitespace(stringifyInput(value.dd)),
+            mm: stripWhitespace(stringifyInput(value.mm)),
+            yyyy: stripWhitespace(stringifyInput(value.yyyy)),
+          }
+        : Object.create(null);
     }
     return undefined;
   }