@isrd-isi-edu/ermrestjs 2.1.0 → 2.2.0

package/js/core.js

@@ -22,7 +22,7 @@ import $log from '@isrd-isi-edu/ermrestjs/src/services/logger';
 
 // utils
 import { isObjectAndNotNull, isEmptyArray, isStringAndNotEmpty, isValidColorRGBHex } from '@isrd-isi-edu/ermrestjs/src/utils/type-utils';
-import { fixedEncodeURIComponent, escapeHTML } from '@isrd-isi-edu/ermrestjs/src/utils/value-utils';
+import { fixedEncodeURIComponent, escapeHTML, updateObject } from '@isrd-isi-edu/ermrestjs/src/utils/value-utils';
 import {
   _annotations,
   _commentDisplayModes,
@@ -3238,11 +3238,12 @@ import {
         var defaultAnnotKey = _annotations.COLUMN_DEFAULTS;
         var ancestors = [this.table.schema.catalog, this.table.schema, this.table];
         // frist copy the by_type annots
+        // frist copy the by_type annots
         ancestors.forEach(function (el) {
             if (el.annotations.contains(defaultAnnotKey)) {
                 var tempAnnot = el.annotations.get(defaultAnnotKey).content;
                 if (isObjectAndNotNull(tempAnnot) && isObjectAndNotNull(tempAnnot.by_type) && isObjectAndNotNull(tempAnnot.by_type[jsonColumn.type.typename])) {
-                    Object.assign(annots, tempAnnot.by_type[jsonColumn.type.typename]);
+                    updateObject(annots, tempAnnot.by_type[jsonColumn.type.typename]);
                 }
             }
         });
@@ -3251,7 +3252,7 @@ import {
             if (el.annotations.contains(defaultAnnotKey)) {
                 var tempAnnot = el.annotations.get(defaultAnnotKey).content;
                 if (isObjectAndNotNull(tempAnnot) && isObjectAndNotNull(tempAnnot.by_name) && isObjectAndNotNull(tempAnnot.by_name[jsonColumn.name])) {
-                    Object.assign(annots, tempAnnot.by_name[jsonColumn.name]);
+                    updateObject(annots, tempAnnot.by_name[jsonColumn.name]);
                 }
             }
         });
@@ -3262,14 +3263,14 @@ import {
                 if (el.annotations.contains(defaultAnnotKey)) {
                     var tempAnnot = el.annotations.get(defaultAnnotKey).content;
                     if (isObjectAndNotNull(tempAnnot) && isObjectAndNotNull(tempAnnot.asset) && isObjectAndNotNull(tempAnnot.asset[assetCategory])) {
-                        Object.assign(annots, tempAnnot.asset[assetCategory]);
+                        updateObject(annots, tempAnnot.asset[assetCategory]);
                     }
                 }
             });
         }
 
         // then copy the existing annots on the column
-        Object.assign(annots, jsonColumn.annotations);
+        updateObject(annots, jsonColumn.annotations);
         for (var uri in annots) {
             var jsonAnnotation = annots[uri];
             this.annotations._push(new Annotation("column", uri, jsonAnnotation));

package/js/parser.js

@@ -227,6 +227,7 @@ import HistoryService from '@isrd-isi-edu/ermrestjs/src/services/history';
         this._compactUri = stripTrailingSlash(this._compactUri);
 
         // service
+        // codeql[js/polynomial-redos]: URL input limited by browser length
         parts = uri.match(/(.*)\/catalog\/([^\/]*)\/(entity|attribute|aggregate|attributegroup)\/(.*)/);
         this._service = parts[1];
 
@@ -263,11 +264,13 @@ import HistoryService from '@isrd-isi-edu/ermrestjs/src/services/history';
         // sort and paging
         if (modifiers) {
             if (modifiers.indexOf("@sort(") !== -1) {
+                // codeql[js/polynomial-redos]: URL input limited by browser length
                 this._sort = modifiers.match(/(@sort\([^\)]*\))/)[1];
             }
             // sort must specified to use @before and @after
             if (modifiers.indexOf("@before(") !== -1) {
                 if (this._sort) {
+                    // codeql[js/polynomial-redos]: URL input limited by browser length
                     this._before = modifiers.match(/(@before\([^\)]*\))/)[1];
                 } else {
                     throw new InvalidPageCriteria("Sort modifier is required with paging.", this._path);
@@ -276,6 +279,7 @@ import HistoryService from '@isrd-isi-edu/ermrestjs/src/services/history';
 
             if (modifiers.indexOf("@after(") !== -1) {
                 if (this._sort) {
+                    // codeql[js/polynomial-redos]: URL input limited by browser length
                     this._after = modifiers.match(/(@after\([^\)]*\))/)[1];
                 } else {
                     throw new InvalidPageCriteria("Sort modifier is required with paging.", this._path);
@@ -300,6 +304,7 @@ import HistoryService from '@isrd-isi-edu/ermrestjs/src/services/history';
         }
 
         // pathParts: <joins/facet/cfacet/filter/>
+        // codeql[js/polynomial-redos]: URL input limited by browser length
         var joinRegExp = /(?:left|right|full|^)\((.*)\)=\((.*:.*:.*)\)/,
             facetsRegExp = /\*::facets::(.+)/,
             customFacetsRegExp = /\*::cfacets::(.+)/;
@@ -1770,6 +1775,7 @@ import HistoryService from '@isrd-isi-edu/ermrestjs/src/services/history';
     function _createParsedJoinFromStr (linking, table, schema) {
         var fromSchemaTable = schema ? [schema,table].join(":") : table;
         var fromCols = linking[1].split(",");
+        // codeql[js/polynomial-redos]: URL input limited by browser length
         var toParts = linking[2].match(/([^:]*):([^:]*):([^\)]*)/);
         var toCols = toParts[3].split(",");
         var strReverse = "(" + toParts[3] + ")=(" + fromSchemaTable + ":" + linking[1] + ")";

package/js/utils/helpers.js

@@ -782,14 +782,16 @@ import AuthnService from '@isrd-isi-edu/ermrestjs/src/services/authn';
 
         //get foreignkey data if available
         if (linkedData && typeof linkedData === "object" && table.sourceDefinitions.fkeys.length > 0) {
-            keyValues.$fkeys = {};
+            // use a prototype-less object to avoid prototype pollution via constraint names
+            keyValues.$fkeys = Object.create(null);
             table.sourceDefinitions.fkeys.forEach(function (fk) {
                 var p = _generateRowLinkProperties(fk.key, linkedData[fk.name], context);
                 if (!p) return;
 
                 cons = fk.constraint_names[0];
                 if (!keyValues.$fkeys[cons[0]]) {
-                    keyValues.$fkeys[cons[0]] = {};
+                    // per-schema map should also be prototype-less
+                    keyValues.$fkeys[cons[0]] = Object.create(null);
                 }
 
                 var fkTempVal = {

package/js/utils/pseudocolumn_helpers.js

@@ -19,34 +19,32 @@ import ConfigService from '@isrd-isi-edu/ermrestjs/src/services/config';
 import { createPseudoColumn } from '@isrd-isi-edu/ermrestjs/src/utils/column-utils';
 import { isObjectAndNotNull, isObject, isDefinedAndNotNull, isStringAndNotEmpty } from '@isrd-isi-edu/ermrestjs/src/utils/type-utils';
 import {
-  fixedEncodeURIComponent,
-  hexToBase64,
-  simpleDeepCopy,
-  shallowCopyExtras,
-  urlEncodeBase64,
+    fixedEncodeURIComponent,
+    hexToBase64,
+    simpleDeepCopy,
+    shallowCopyExtras,
+    urlEncodeBase64,
 } from '@isrd-isi-edu/ermrestjs/src/utils/value-utils';
 import {
-  _constraintTypes,
-  _contexts,
-  _ERMrestFeatures,
-  _ERMrestFilterPredicates,
-  _ERMrestLogicalOperators,
-  _facetingErrors,
-  _facetFilterTypes,
-  _facetHeuristicIgnoredTypes,
-  _FacetsLogicalOperators,
-  _facetUnsupportedTypes,
-  _pseudoColAggregateFns,
-  _shorterVersion,
-  _sourceDefinitionAttributes,
-  _sourceProperties,
-  _specialSourceDefinitions,
-  _systemColumnNames,
-  _warningMessages,
+    _constraintTypes,
+    _contexts,
+    _ERMrestFeatures,
+    _ERMrestFilterPredicates,
+    _ERMrestLogicalOperators,
+    _facetingErrors,
+    _facetFilterTypes,
+    _facetHeuristicIgnoredTypes,
+    _FacetsLogicalOperators,
+    _facetUnsupportedTypes, _shorterVersion,
+    _sourceDefinitionAttributes,
+    _sourceProperties,
+    _specialSourceDefinitions,
+    _systemColumnNames,
+    _warningMessages
 } from '@isrd-isi-edu/ermrestjs/src/utils/constants';
 
 // legacy
-import { generateKeyValueFilters, renameKey, _renderTemplate, _isEntryContext, _getFormattedKeyValues } from '@isrd-isi-edu/ermrestjs/js/utils/helpers';
+import { generateKeyValueFilters, renameKey, _renderTemplate, _isEntryContext } from '@isrd-isi-edu/ermrestjs/js/utils/helpers';
 import { Table, Catalog } from '@isrd-isi-edu/ermrestjs/js/core';
 import { parse, _convertSearchTermToFilter } from '@isrd-isi-edu/ermrestjs/js/parser';
 
@@ -931,11 +929,6 @@ import { parse, _convertSearchTermToFilter } from '@isrd-isi-edu/ermrestjs/js/pa
                 throw new Error(_facetingErrors.aggregateFnNowtAllowed);
             }
 
-            // column type array is not supported
-            if (col.type.isArray) {
-                throw new Error(_facetingErrors.arrayColumnTypeNotSupported);
-            }
-
             // check the column type
             if (_facetUnsupportedTypes.indexOf(col.type.name) !== -1) {
                 throw new Error(`Facet of column type '${col.type.name}' is not supported.`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@isrd-isi-edu/ermrestjs",
   "description": "ERMrest client library in JavaScript",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "license": "Apache-2.0",
   "engines": {
     "node": ">= 20.0.0",
@@ -26,7 +26,7 @@
     "lint": "eslint src js --quiet",
     "lint-w-warn": "eslint src js",
     "format": "prettier --write src",
-    "prepare": "husky"
+    "prepare": "node .husky/install.mjs"
   },
   "repository": {
     "type": "git",
@@ -43,10 +43,12 @@
     "library"
   ],
   "dependencies": {
+    "@types/lodash-es": "^4.17.12",
     "@types/markdown-it": "^14.1.2",
     "@types/q": "^1.5.8",
-    "axios": "1.12.2",
+    "axios": "1.13.2",
     "handlebars": "4.7.8",
+    "lodash-es": "^4.17.23",
     "lz-string": "^1.5.0",
     "markdown-it": "12.3.2",
     "moment": "2.29.4",
@@ -54,32 +56,31 @@
     "mustache": "x",
     "q": "1.5.1",
     "spark-md5": "^3.0.0",
-    "terser": "^5.43.1",
-    "typescript": "~5.8.3",
-    "vite": "^6.4.1",
-    "vite-plugin-compression2": "^2.2.1"
+    "terser": "^5.44.1",
+    "typescript": "~5.9.3",
+    "vite": "^7.3.1",
+    "vite-plugin-compression2": "^2.2.1",
+    "vite-plugin-dts": "^4.5.4"
   },
   "devDependencies": {
     "@commitlint/cli": "^20.2.0",
     "@commitlint/config-conventional": "^20.2.0",
-    "@eslint/js": "^9.36.0",
+    "@eslint/js": "^9.39.2",
     "@isrd-isi-edu/ermrest-data-utils": "0.0.5",
     "@semantic-release/git": "^10.0.1",
-    "@types/node": "^24.6.1",
-    "eslint": "^9.36.0",
+    "@types/node": "^25.0.3",
+    "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.4",
-    "file-api": "^0.10.4",
     "globals": "^16.4.0",
     "husky": "^9.1.7",
     "jasmine": "2.5.3",
     "jasmine-expect": "3.7.1",
     "jasmine-spec-reporter": "2.5.0",
     "nock": "13.5.4",
-    "prettier": "^3.6.2",
+    "prettier": "^3.7.4",
     "require-reload": "^0.2.2",
     "rollup-plugin-visualizer": "^6.0.3",
-    "typescript-eslint": "^8.45.0",
-    "vite-plugin-dts": "^4.5.4"
+    "typescript-eslint": "^8.51.0"
   }
 }

package/src/models/errors.ts

@@ -317,15 +317,15 @@ export class UnsupportedFilters extends ERMrestError {
 
 const removePageCondition = (path?: string) => {
   if (path !== undefined) {
-    path = path.replace(/(@before\([^)]*\))/, '');
-    path = path.replace(/(@after\([^)]*\))/, '');
+    path = path.replace(/(@before\([^)@]*\))/, '');
+    path = path.replace(/(@after\([^)@]*\))/, '');
   }
   return path;
 };
 
 const removeSortCondition = (path?: string) => {
   if (path !== undefined) {
-    return path.replace(/(@sort\([^)]*\))/, '');
+    return path.replace(/(@sort\([^)@]*\))/, '');
   }
   return path;
 };

package/src/models/reference-column/facet-column.ts

@@ -350,6 +350,11 @@ export class FacetColumn {
           return onlyChoice ? modes.CHOICE : modes.RANGE;
         }
 
+        // only check_presence can be supported for arrays.
+        if (self._column.type.isArray) {
+          return modes.PRESENCE;
+        }
+
         // use the defined ux_mode
         if (_facetUXModeNames.indexOf(self._facetObject.ux_mode) !== -1) {
           return self._facetObject.ux_mode;
@@ -1196,7 +1201,7 @@ export class FacetColumn {
     verify(Array.isArray(values), 'given argument must be an array');
 
     const filters = this.filters.slice();
-    values.forEach((v: any) => {
+    values.forEach((v) => {
       filters.push(new ChoiceFacetFilter(v, this._column));
     });
 
@@ -1213,7 +1218,7 @@ export class FacetColumn {
     const filters = this.filters.slice().filter((f: FacetFilter | NotNullFacetFilter) => {
       return !(f instanceof ChoiceFacetFilter) && !(f instanceof NotNullFacetFilter);
     });
-    values.forEach((v: any) => {
+    values.forEach((v) => {
       filters.push(new ChoiceFacetFilter(v, this._column));
     });
 
@@ -1342,7 +1347,7 @@ export class FacetColumn {
 
     // create a new FacetColumn so it doesn't reference to the current FacetColum
     // TODO can be refactored
-    const jsonFilters: any[] = [];
+    const jsonFilters = [];
 
     // TODO might be able to imporve this. Instead of recreating the whole json file.
     // gather all the filters from the facetColumns

package/src/services/error.ts

@@ -188,6 +188,7 @@ export default class ErrorService {
       let msgTail;
       const keyValueMap: Record<string, string> = {};
       let duplicateReference = null;
+      // codeql[js/polynomial-redos]: Parsing structured database error messages
       const columnRegExp = /\(([^)]+)\)/,
         valueRegExp = /=\(([^)]+)\)/,
         matches = columnRegExp.exec(generatedErrMessage),

package/src/services/handlebars.ts

@@ -114,11 +114,14 @@ export default class HandlebarsService {
     _addErmrestVarsToTemplate(keyValues, catalog);
 
     // If no conditional handlebars statements of the form {{#if VARNAME}}{{/if}} or {{^if VARNAME}}{{/if}} or {{#unless VARNAME}}{{/unless}} or {{^unless VARNAME}}{{/unless}} not found then do direct null check
+    // codeql[js/polynomial-redos]
     if (!conditionalRegex.exec(template)) {
       // Grab all placeholders ({{PROP_NAME}}) in the template
+      // codeql[js/polynomial-redos]: template is not user input
       const placeholders = template.match(/\{\{([^\{\}\(\)\s]+)\}\}/gi);
 
       // These will match the placeholders that are encapsulated in square brackets {{[string with space]}} or {{{[string with space]}}}
+      // codeql[js/polynomial-redos]: template is not user input
       const specialPlaceholders = template.match(/\{\{((\[[^\{\}]+\])|(\{\[[^\{\}]+\]\}))\}\}/gi);
 
       // If there are any placeholders

package/src/utils/markdown-utils.ts

@@ -121,8 +121,7 @@ function _bindCustomMarkdownTags(md: typeof MarkdownIt) {
             openingLink!.attrs!.forEach(function (attr) {
               switch (attr[0]) {
                 case 'href':
-                  // eslint-disable-next-line no-useless-escape
-                  isYTlink = attr[1].match('^(http(s)?:\/\/)?((w){3}.)?youtu(be|.be)?(\.com)?\/.+') != null;
+                  isYTlink = attr[1].match('^(http(s)?://)?((w){3}.)?youtu(be|.be)?(.com)?/.+') != null;
                   iframeSrc = attr[1];
                   iframeHTML += ' src="' + attr[1] + '"';
                   videoText = 'Note: YouTube video ( ' + attr[1] + ' ) is hidden in print';

package/src/utils/value-utils.ts

@@ -1,3 +1,5 @@
+import { isArray, mergeWith } from 'lodash-es';
+
 import { ENV_IS_NODE } from '@isrd-isi-edu/ermrestjs/src/utils/constants';
 
 /**
@@ -70,7 +72,17 @@ export function stripTrailingSlash(str: string): string {
  * trim the slashes that might exist at the begining or end of the string
  */
 export function trimSlashes(str: string) {
-  return str.replace(/^\/+|\/+$/g, '');
+  let start = 0;
+  let end = str.length - 1;
+
+  while (start <= end && str[start] === '/') {
+    start++;
+  }
+  while (end >= start && str[end] === '/') {
+    end--;
+  }
+
+  return start <= end ? str.slice(start, end + 1) : '';
 }
 
 /**
@@ -125,3 +137,18 @@ export function shallowCopyExtras(copyTo: any, copyFrom: any, enforcedList: stri
 export function simpleDeepCopy(source: object): any {
   return JSON.parse(JSON.stringify(source));
 }
+
+/**
+ * update the target object with the updates provided in the updates object.
+ * NOTE: this will mutate the target object.
+ */
+export function updateObject(target: any, updates: any) {
+  mergeWith(target, updates, (objValue: unknown, srcValue: unknown) => {
+    // by default lodash's mergeWith will concat arrays, we want to replace them instead.
+    if (isArray(objValue)) {
+      return srcValue;
+    }
+  });
+
+  return target;
+}