@joystick.js/node-canary 0.0.0-canary.4 → 0.0.0-canary.40

package/dist/app/accounts/getBrowserSafeUser.js

@@ -1,4 +1,5 @@
 import { isObject } from "../../validation/lib/typeValidators";
+import escapeKeyValuePair from "../../lib/escapeKeyValuePair.js";
 var getBrowserSafeUser_default = (user = null) => {
   if (!user || !isObject(user)) {
     return null;
@@ -16,7 +17,7 @@ var getBrowserSafeUser_default = (user = null) => {
       return fields;
     }
   }, {});
-  return browserSafeUser;
+  return escapeKeyValuePair(browserSafeUser);
 };
 export {
   getBrowserSafeUser_default as default

package/dist/app/getBrowserSafeRequest.js

@@ -1,8 +1,9 @@
 import getBrowserSafeUser from "./accounts/getBrowserSafeUser";
+import escapeKeyValuePair from "../lib/escapeKeyValuePair.js";
 var getBrowserSafeRequest_default = (req = {}) => {
   const browserSafeRequest = {};
-  browserSafeRequest.params = req.params;
-  browserSafeRequest.query = req.query;
+  browserSafeRequest.params = escapeKeyValuePair(req.params);
+  browserSafeRequest.query = escapeKeyValuePair(req.query);
   browserSafeRequest.context = {
     user: getBrowserSafeUser(req.context.user)
   };

package/dist/app/middleware/index.js

@@ -3,6 +3,7 @@ import compression from "compression";
 import cookieParser from "cookie-parser";
 import favicon from "serve-favicon";
 import fs from "fs";
+import { __package } from "../../index.js";
 import insecure from "./insecure.js";
 import requestMethods from "./requestMethods.js";
 import bodyParser from "./bodyParser.js";
@@ -14,7 +15,6 @@ import runUserQuery from "../accounts/runUserQuery.js";
 import replaceBackslashesWithForwardSlashes from "../../lib/replaceBackslashesWithForwardSlashes.js";
 import replaceFileProtocol from "../../lib/replaceFileProtocol.js";
 import getBuildPath from "../../lib/getBuildPath.js";
-import sanitizeQueryParameters from "./sanitizeQueryParameters.js";
 import session from "./session.js";
 import csp from "./csp.js";
 const cwd = replaceFileProtocol(replaceBackslashesWithForwardSlashes(process.cwd()));
@@ -41,7 +41,6 @@ var middleware_default = ({
     }
     next();
   });
-  app.use(sanitizeQueryParameters);
   app.use(requestMethods);
   if (cspConfig) {
     app.use((req, res, next) => csp(req, res, next, cspConfig));
@@ -54,7 +53,7 @@ var middleware_default = ({
   });
   app.use("/_joystick/utils/process.js", (_req, res) => {
     res.set("Content-Type", "text/javascript");
-    const processPolyfill = fs.readFileSync(`${cwd}/node_modules/@joystick.js/node/dist/app/utils/process.js`, "utf-8");
+    const processPolyfill = fs.readFileSync(`${__package}/app/utils/process.js`, "utf-8");
     res.send(processPolyfill.replace("${NODE_ENV}", process.env.NODE_ENV));
   });
   app.use("/_joystick/index.client.js", express.static(`${buildPath}index.client.js`, {
@@ -65,7 +64,7 @@ var middleware_default = ({
   app.use("/_joystick/ui", express.static(`${buildPath}ui`, { eTag: false, maxAge: "0" }));
   app.use("/_joystick/hmr/client.js", (_req, res) => {
     res.set("Content-Type", "text/javascript");
-    const hmrClient = fs.readFileSync(`${cwd}/node_modules/@joystick.js/node/dist/app/middleware/hmr/client.js`, "utf-8");
+    const hmrClient = fs.readFileSync(`${__package}/app/middleware/hmr/client.js`, "utf-8");
     res.send(hmrClient.replace("${process.env.PORT}", parseInt(process.env.PORT, 10) + 1));
   });
   app.use(favicon(faviconPath));

package/dist/app/middleware/render.js

@@ -8,6 +8,8 @@ import generateErrorPage from "../../lib/generateErrorPage.js";
 import replaceFileProtocol from "../../lib/replaceFileProtocol.js";
 import replaceBackslashesWithForwardSlashes from "../../lib/replaceBackslashesWithForwardSlashes.js";
 import getBuildPath from "../../lib/getBuildPath.js";
+import escapeHTML from "../../lib/escapeHTML.js";
+import escapeKeyValuePair from "../../lib/escapeKeyValuePair.js";
 const generateHash = (input = "") => {
   return crypto.createHash("sha256").update(input).digest("hex");
 };
@@ -65,10 +67,10 @@ const getCachedHTML = ({ cachePath, cacheFileName, currentDiff }) => {
 const getUrl = (request = {}) => {
   const [path = null] = request.url?.split("?");
   return {
-    params: request.params,
-    query: request.query,
-    route: request.route.path,
-    path
+    params: escapeKeyValuePair(request.params),
+    query: escapeKeyValuePair(request.query),
+    route: escapeHTML(request.route.path),
+    path: escapeHTML(path)
   };
 };
 const getFile = async (buildPath = "") => {

package/dist/app/sanitizeAPIResponse.js

@@ -1,10 +1,5 @@
 import util from "util";
-import { HTML_ENTITY_MAP } from "../lib/constants.js";
-const escapeHTML = (string = "") => {
-  return String(string).replace(/[&<>"'`=\/]/g, function(match) {
-    return HTML_ENTITY_MAP[match];
-  });
-};
+import escapeHTML from "../lib/escapeHTML.js";
 const sanitizeAPIResponse = (data = null) => {
   let sanitizedData = data;
   if (!util.isString(sanitizedData) && !util.isObject(sanitizedData) && !Array.isArray(sanitizedData)) {

package/dist/index.js

@@ -1,5 +1,7 @@
-import sanitizeHTML from "sanitize-html";
 import fs from "fs";
+import { fileURLToPath } from "url";
+import { dirname } from "path";
+import sanitizeHTML from "sanitize-html";
 import _accounts from "./app/accounts";
 import _action from "./action/index.js";
 import _websockets from "./websockets";
@@ -27,16 +29,18 @@ const sanitize = {
     allowedTags: sanitizeHTML.defaults.allowedTags
   }
 };
+const currentFilePath = fileURLToPath(import.meta.url);
+const __package = dirname(currentFilePath);
 const __filename = nodeUrlPolyfills.__filename;
 const __dirname = nodeUrlPolyfills.__dirname;
 const id = generateId;
 const origin = getOrigin();
 const settings = loadSettings();
-console.log("HERE", fs.readFileSync(__dirname("/dist/app/utils/process.js"), "utf-8"));
 global.joystick = {
   id: generateId,
   emitters: {},
   settings,
+  __package,
   __dirname,
   __filename
 };
@@ -58,6 +62,7 @@ var src_default = {
 export {
   __dirname,
   __filename,
+  __package,
   accounts,
   action,
   src_default as default,

package/dist/lib/escapeHTML.js

@@ -0,0 +1,9 @@
+import { HTML_ENTITY_MAP } from "./constants.js";
+var escapeHTML_default = (string = "") => {
+  return String(string).replace(/[&<>"'`=]/g, function(match) {
+    return HTML_ENTITY_MAP[match];
+  });
+};
+export {
+  escapeHTML_default as default
+};

package/dist/lib/escapeKeyValuePair.js

@@ -0,0 +1,13 @@
+import escapeHTML from "./escapeHTML.js";
+var escapeKeyValuePair_default = (target = {}) => {
+  const parameters = Object.entries(target || {});
+  for (let i = 0; i < parameters?.length; i += 1) {
+    const [key, value] = parameters[i];
+    delete target[key];
+    target[escapeHTML(key)] = escapeHTML(value);
+  }
+  return target;
+};
+export {
+  escapeKeyValuePair_default as default
+};

package/dist/lib/nodeUrlPolyfills.js

@@ -1,16 +1,12 @@
-import { URL } from "url";
+import { fileURLToPath } from "url";
+import { dirname } from "path";
 var nodeUrlPolyfills_default = {
-  __filename: (url = null) => {
-    if (!url) {
-      return "";
-    }
-    return new URL("", url).pathname;
+  __filename: (url = "") => {
+    return fileURLToPath(url);
   },
-  __dirname: (url = null) => {
-    if (!url) {
-      return "";
-    }
-    return new URL(".", url).pathname;
+  __dirname: (url = "") => {
+    const currentFilePath = fileURLToPath(url);
+    return dirname(currentFilePath);
   }
 };
 export {

package/dist/ssr/index.js

@@ -1,4 +1,5 @@
 import fs from "fs";
+import { __package } from "../index.js";
 import get from "../api/get";
 import set from "../api/set";
 import getBrowserSafeRequest from "../app/getBrowserSafeRequest";
@@ -184,7 +185,7 @@ const getBaseCSS = (baseHTMLName = "") => {
   try {
     const customBaseCSSPathForEmail = baseHTMLName ? `${process.cwd()}/email/base_${baseHTMLName}.css` : null;
     const customDefaultBaseCSSPathForEmail = `${process.cwd()}/email/base.css`;
-    const defaultBaseCSSPathForEmail = process.env.NODE_ENV === "test" ? `${process.cwd()}/src/email/templates/base.css` : `${process.cwd()}/node_modules/@joystick.js/node/dist/email/templates/base.css`;
+    const defaultBaseCSSPathForEmail = process.env.NODE_ENV === "test" ? `${process.cwd()}/src/email/templates/base.css` : `${__package}/email/templates/base.css`;
     let baseCSSPathToFetch = defaultBaseCSSPathForEmail;
     if (fs.existsSync(customDefaultBaseCSSPathForEmail)) {
       baseCSSPathToFetch = customDefaultBaseCSSPathForEmail;
@@ -242,7 +243,7 @@ const getBaseHTML = (isEmailRender = false, baseEmailHTMLName = "") => {
     if (isEmailRender) {
       const customBaseHTMLPathForEmail = baseEmailHTMLName ? `${process.cwd()}/email/base_${baseEmailHTMLName}.html` : null;
       const customDefaultBaseHTMLPathForEmail = `${process.cwd()}/email/base.html`;
-      const defaultBaseHTMLPathForEmail = process.env.NODE_ENV === "test" ? `${process.cwd()}/src/email/templates/base.html` : `${process.cwd()}/node_modules/@joystick.js/node/dist/email/templates/base.html`;
+      const defaultBaseHTMLPathForEmail = process.env.NODE_ENV === "test" ? `${process.cwd()}/src/email/templates/base.html` : `${__package}/email/templates/base.html`;
       baseHTMLPathToFetch = defaultBaseHTMLPathForEmail;
       if (fs.existsSync(customDefaultBaseHTMLPathForEmail)) {
         baseHTMLPathToFetch = customDefaultBaseHTMLPathForEmail;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joystick.js/node-canary",
-  "version": "0.0.0-canary.4",
+  "version": "0.0.0-canary.40",
   "type": "module",
   "description": "A Node.js framework for building web apps.",
   "main": "./dist/index.js",

package/dist/app/middleware/sanitizeQueryParameters.js

@@ -1,16 +0,0 @@
-var sanitizeQueryParameters_default = (req, res, next) => {
-  const queryParameters = Object.entries(req?.query);
-  const htmlRegex = new RegExp(/<(?:"[^"]*"['"]*|'[^']*'['"]*|[^'">])+>/g);
-  for (let i = 0; i < queryParameters?.length; i += 1) {
-    const [key, value] = queryParameters[i];
-    const keyHTMLMatches = key?.match(htmlRegex);
-    const valueHTMLMatches = value?.match(htmlRegex);
-    if (keyHTMLMatches?.length > 0 || valueHTMLMatches?.length > 0) {
-      delete req.query[key];
-    }
-  }
-  next();
-};
-export {
-  sanitizeQueryParameters_default as default
-};