@ezs/basics 1.22.7 → 1.23.1

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.23.1](https://github.com/Inist-CNRS/ezs/compare/@ezs/basics@1.23.0...@ezs/basics@1.23.1) (2023-01-28)
+
+
+### Bug Fixes
+
+* 🐛 improve security in file access ([6942a8e](https://github.com/Inist-CNRS/ezs/commit/6942a8e039a05d820d8643fa0908287a0a6aefda))
+* 🐛 objstandarize lost boolean values ([dca4714](https://github.com/Inist-CNRS/ezs/commit/dca4714c984214f422f9ed8951575de66af0f0ce))
+
+
+### Reverts
+
+* Revert "chore: 🤖 use lerna exec instead bootstrap" ([56375ee](https://github.com/Inist-CNRS/ezs/commit/56375ee2bd7e9f69f61da3993ab569ca1c16c547))
+
+
+
+
+
+# [1.23.0](https://github.com/Inist-CNRS/ezs/compare/@ezs/basics@1.22.7...@ezs/basics@1.23.0) (2023-01-20)
+
+
+### Features
+
+* 🎸 add new parameter to FILESave ([8fae7b8](https://github.com/Inist-CNRS/ezs/commit/8fae7b8009824d8e73c98e8277e15ffacd87d572))
+
+
+
+
+
 ## [1.22.7](https://github.com/Inist-CNRS/ezs/compare/@ezs/basics@1.22.6...@ezs/basics@1.22.7) (2023-01-13)
 
 

package/README.md

@@ -262,6 +262,8 @@ Output:
 
 -   `location` **[String](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String)** Directory location (optional, default `TMPDIR`)
 -   `identifier` **[String](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String)?** File name
+-   `content` **[String](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String)?** Content to save instead of using input object
+-   `jsonl` **[Boolean](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Boolean)** Save as json line (optional, default `false`)
 -   `compress` **[Boolean](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Boolean)** Enable gzip compression (optional, default `false`)
 
 Returns **[Object](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object)** 

package/lib/file-load.js

@@ -13,6 +13,10 @@ var _path = require("path");
 
 var _os = require("os");
 
+var _higherPath = _interopRequireDefault(require("higher-path"));
+
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+
 /**
  * Take `Object` containing filename et throw content by chunk
  *
@@ -52,18 +56,19 @@ async function FILELoad(data, feed) {
     return;
   }
 
-  const cwd = process.cwd();
-  const tpd = (0, _os.tmpdir)();
   const compress = this.getParam('compress', false);
-  const locations = this.ezs.getPath().concat(cwd, tpd, this.getParam('location'));
-  const file = locations.filter(Boolean).map(dir => (0, _path.resolve)(dir, String(data).trim())).filter(fil => (0, _fs.existsSync)(fil)).shift();
+  const location = (0, _path.normalize)(this.getParam('location', '/'));
+  const locations = [(0, _higherPath.default)((0, _os.tmpdir)(), location), (0, _higherPath.default)(process.cwd(), location)];
+  const filename = locations.filter(Boolean).map(dir => (0, _path.resolve)(dir, String(data).trim())).filter(fil => (0, _fs.existsSync)(fil)).shift();
 
-  if (!file) {
-    feed.end();
+  if (!filename) {
+    feed.stop(new Error('File location check failed.'));
     return;
   }
 
-  const stream = compress ? (0, _fs.createReadStream)(file).pipe((0, _zlib.createGunzip)()) : (0, _fs.createReadStream)(file);
+  (0, _fs.accessSync)((0, _path.dirname)(filename), _fs.constants.R_OK | _fs.constants.W_OK);
+  (0, _fs.accessSync)(filename, _fs.constants.R_OK | _fs.constants.W_OK);
+  const stream = compress ? (0, _fs.createReadStream)(filename).pipe((0, _zlib.createGunzip)()) : (0, _fs.createReadStream)(filename);
   await feed.flow(stream);
   return;
 }

package/lib/file-save.js

@@ -23,6 +23,9 @@ var _debug = _interopRequireDefault(require("debug"));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
+const eol = '\n';
+
+const toJSONL = line => JSON.stringify(line).concat(eol);
 /**
  * Take data, convert it to buffer and append it to file
  *
@@ -55,21 +58,31 @@ function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { de
  * @name FILESave
  * @param {String} [location=TMPDIR] Directory location
  * @param {String} [identifier] File name
+ * @param {String} [content] Content to save instead of using input object
+ * @param {Boolean} [jsonl=false] Save as json line
  * @param {Boolean} [compress=false] Enable gzip compression
  * @returns {Object}
  */
-function FILESave(data, feed) {
-  const buf = Buffer.from(String(data));
 
+
+function FILESave(data, feed) {
   if (this.isFirst()) {
     const identifier = String(this.getParam('identifier'));
-    const location = this.getParam('location', (0, _os.tmpdir)());
+
+    const location = _path.default.normalize(this.getParam('location', (0, _os.tmpdir)()));
+
     const compress = this.getParam('compress', false);
 
+    if (location.indexOf((0, _os.tmpdir)()) !== 0 && location.indexOf(process.cwd()) !== 0) {
+      feed.stop(new Error('File location check failed.'));
+      return;
+    }
+
     if (!_pathExists.default.sync(location)) {
       _makeDir.default.sync(location);
     }
 
+    (0, _fs.accessSync)(location, _fs.constants.R_OK | _fs.constants.W_OK);
     const name = compress ? `${identifier}.gz` : identifier;
 
     const filename = _path.default.resolve(location, name);
@@ -102,5 +115,9 @@ function FILESave(data, feed) {
     return this.whenFinish.then(stats => feed.write(stats)).catch(err => feed.stop(err)).finally(() => feed.close());
   }
 
+  const jsonl = Boolean(this.getParam('jsonl', false));
+  const bufContent = this.getParam('content', data);
+  const bufFunc = jsonl ? toJSONL : String;
+  const buf = Buffer.from(bufFunc(bufContent));
   (0, _streamWrite.default)(this.input, buf, () => feed.end());
 }

package/lib/obj-standardize.js

@@ -21,7 +21,7 @@ function normalize(data, feed) {
   const struct = this.getEnv();
   const vv = {};
   struct.forEach(k => {
-    if (!data[k]) {
+    if (data[k] === undefined || data[k] === null) {
       vv[k] = '';
     } else {
       vv[k] = data[k];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ezs/basics",
   "description": "Basics statements for EZS",
-  "version": "1.22.7",
+  "version": "1.23.1",
   "author": "Nicolas Thouvenin <nthouvenin@gmail.com>",
   "bugs": "https://github.com/Inist-CNRS/ezs/issues",
   "dependencies": {
@@ -13,6 +13,7 @@
     "fetch-with-proxy": "3.0.1",
     "flat": "5.0.2",
     "get-stream": "6.0.1",
+    "higher-path": "1.0.0",
     "lodash.escaperegexp": "4.1.2",
     "lodash.get": "4.4.2",
     "lodash.mapkeys": "4.6.0",
@@ -37,7 +38,7 @@
   "directories": {
     "test": "test"
   },
-  "gitHead": "73aeeddfdd1152f879116a7c064ab3028419021c",
+  "gitHead": "c244731593d7181d55b1d0c20373e5a263f18f02",
   "homepage": "https://github.com/Inist-CNRS/ezs/tree/master/packages/basics#readme",
   "keywords": [
     "ezs"