@forge/api 2.18.6-next.3 → 2.19.0-next.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @forge/api
 
+## 2.19.0-next.4
+
+### Minor Changes
+
+- 347359b: Better protection against path traversal attacks in product requests
+
 ## 2.18.6-next.3
 
 ### Patch Changes

package/out/safeUrl.d.ts

@@ -3,7 +3,7 @@ export type Route = {
 };
 export declare function isRoute(x: unknown): x is Route;
 export declare function routeFromAbsolute(absolutePath: string): Route;
-export declare function route(path: TemplateStringsArray, ...parameters: (string | number | URLSearchParams | Route)[]): Route;
+export declare function route(template: TemplateStringsArray, ...parameters: (string | number | URLSearchParams | Route)[]): Route;
 export declare function requireSafeUrl(url: unknown): Route;
 export declare function assumeTrustedRoute(route: string): Route;
 //# sourceMappingURL=safeUrl.d.ts.map

package/out/safeUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAcF,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,CAE9C;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAG7D;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAqBrH;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CASlD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAEvD"}
+{"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../src/safeUrl.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAcF,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,CAE9C;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,CAG7D;AAkCD,wBAAgB,KAAK,CACnB,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,UAAU,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,eAAe,GAAG,KAAK,CAAC,EAAE,GAC3D,KAAK,CAoBP;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CASlD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAEvD"}

package/out/safeUrl.js

@@ -21,27 +21,46 @@ function routeFromAbsolute(absolutePath) {
     return assumeTrustedRoute(`${absoluteURL.pathname}${absoluteURL.search}`);
 }
 exports.routeFromAbsolute = routeFromAbsolute;
-function route(path, ...parameters) {
-    let fullPath = '';
-    for (let i = 0; i < path.length; i++) {
-        fullPath += path[i];
-        if (i < parameters.length) {
-            const parameter = parameters[i];
-            if (parameter === '..') {
-                throw new Error('Disallowing path traversal attempt');
+const DOUBLE_DOT = ['..', '.%2e', '%2e.', '%2e%2e', '.%2E', '%2E.', '%2E%2e'];
+const ENDS_PATH = ['?', '#'];
+function containsOneOf(needles, haystack) {
+    return needles.some((needle) => haystack.includes(needle));
+}
+function escapeParameter(parameter, mode) {
+    switch (mode) {
+        case 'path':
+            const parameterString = isRoute(parameter) ? parameter.value : String(parameter);
+            if (containsOneOf(DOUBLE_DOT, parameterString) || containsOneOf(ENDS_PATH, parameterString)) {
+                throw new Error('Disallowing path manipulation attempt');
             }
-            else if (isRoute(parameter)) {
-                fullPath += parameter.value;
+            return parameterString;
+        case 'query':
+            if (isRoute(parameter)) {
+                return encodeURIComponent(parameter.value);
             }
             else if (parameter instanceof URLSearchParams) {
-                fullPath += parameter.toString();
+                return parameter.toString();
             }
             else {
-                fullPath += encodeURIComponent(parameter);
+                return encodeURIComponent(parameter);
             }
+    }
+}
+function route(template, ...parameters) {
+    let mode = 'path';
+    let result = '';
+    for (let i = 0; i < template.length; i++) {
+        const templateFragment = template[i];
+        if (containsOneOf(ENDS_PATH, templateFragment)) {
+            mode = 'query';
+        }
+        result += templateFragment;
+        if (i >= parameters.length) {
+            break;
         }
+        result += escapeParameter(parameters[i], mode);
     }
-    return new ReadonlyRoute(fullPath);
+    return new ReadonlyRoute(result);
 }
 exports.route = route;
 function requireSafeUrl(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/api",
-  "version": "2.18.6-next.3",
+  "version": "2.19.0-next.4",
   "description": "Forge API methods",
   "author": "Atlassian",
   "license": "UNLICENSED",
@@ -12,7 +12,7 @@
     "compile": "tsc -b -v"
   },
   "devDependencies": {
-    "@forge/runtime": "5.0.1-next.4",
+    "@forge/runtime": "5.0.1-next.5",
     "@types/node": "14.18.57",
     "jest-matcher-specific-error": "^1.0.0",
     "nock": "^10.0.6"