@lark-apaas/fullstack-nestjs-core 1.1.56-alpha.2 → 1.1.56-alpha.3

package/dist/index.cjs

@@ -14894,10 +14894,10 @@ var require_object_inspect = __commonJS({
       }
       if (!isDate(obj) && !isRegExp(obj)) {
         var ys = arrObjKeys(obj, inspect);
-        var isPlainObject = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
+        var isPlainObject2 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
         var protoTag = obj instanceof Object ? "" : "null prototype";
-        var stringTag = !isPlainObject && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
-        var constructorTag = isPlainObject || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
+        var stringTag = !isPlainObject2 && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
+        var constructorTag = isPlainObject2 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
         var tag = constructorTag + (stringTag || protoTag ? "[" + $join.call($concat.call([], stringTag || [], protoTag || []), ": ") + "] " : "");
         if (ys.length === 0) {
           return tag + "{}";
@@ -34423,7 +34423,11 @@ __export(index_exports, {
   UserContextMiddleware: () => UserContextMiddleware,
   ViewContextMiddleware: () => ViewContextMiddleware,
   configureApp: () => configureApp,
-  createLegacyPathRedirectMiddleware: () => createLegacyPathRedirectMiddleware
+  createLegacyPathRedirectMiddleware: () => createLegacyPathRedirectMiddleware,
+  safeEscape: () => safeEscape,
+  safeEscapeDeep: () => safeEscapeDeep,
+  safeStringParse: () => safeStringParse,
+  safeStringify: () => safeStringify
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -34436,7 +34440,6 @@ var import_nestjs_observable = require("@lark-apaas/nestjs-observable");
 var import_axios2 = require("@nestjs/axios");
 var import_nestjs_logger2 = require("@lark-apaas/nestjs-logger");
 var import_nestjs_datapaas = require("@lark-apaas/nestjs-datapaas");
-var import_nestjs = require("@lark-apaas/cache-service/nestjs");
 var import_nestjs_authnpaas = require("@lark-apaas/nestjs-authnpaas");
 var import_nestjs_http_forwarder = require("@lark-apaas/nestjs-http-forwarder");
 var import_nestjs_trigger = require("@lark-apaas/nestjs-trigger");
@@ -34560,6 +34563,19 @@ var import_common3 = require("@nestjs/common");
 var import_nestjs_common = require("@lark-apaas/nestjs-common");
 
 // src/utils/safe-stringify.ts
+function safeStringify(obj) {
+  const json2 = JSON.stringify(obj);
+  return safeEscape(json2);
+}
+__name(safeStringify, "safeStringify");
+function safeStringParse(str, defaultValue = null) {
+  try {
+    return JSON.parse(str);
+  } catch (e) {
+    return defaultValue;
+  }
+}
+__name(safeStringParse, "safeStringParse");
 function safeEscape(s) {
   return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
     switch (c.charCodeAt(0)) {
@@ -34601,6 +34617,40 @@ function safeEscape(s) {
   });
 }
 __name(safeEscape, "safeEscape");
+function safeEscapeDeep(value) {
+  return safeEscapeDeepInner(value, /* @__PURE__ */ new WeakSet());
+}
+__name(safeEscapeDeep, "safeEscapeDeep");
+var plainProtos = /* @__PURE__ */ new Set([
+  Object.prototype,
+  null
+]);
+function isPlainObject(v) {
+  if (v === null || typeof v !== "object") return false;
+  return plainProtos.has(Object.getPrototypeOf(v));
+}
+__name(isPlainObject, "isPlainObject");
+function safeEscapeDeepInner(value, seen) {
+  if (typeof value === "string") {
+    return safeEscape(value);
+  }
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    return value.map((v) => safeEscapeDeepInner(v, seen));
+  }
+  if (isPlainObject(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    const out = {};
+    for (const k of Object.keys(value)) {
+      out[k] = safeEscapeDeepInner(value[k], seen);
+    }
+    return out;
+  }
+  return value;
+}
+__name(safeEscapeDeepInner, "safeEscapeDeepInner");
 
 // src/middlewares/view-context/middleware.ts
 function _ts_decorate3(decorators, target, key, desc) {
@@ -34668,7 +34718,10 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
       tenantId,
       environment,
       showBadge: appInfo?.show_badge !== false,
-      appPublished: appPublishedData ?? null,
+      // 上游 get_published_v2 返回的整包数据里可能含用户可输入字段（如 app_description），
+      // 用户输入 </script> / 引号 / 换行等会破坏下游 <script> raw 注入的 JSON.stringify 结果，
+      // 深度 escape 所有 string 字段兜底；浏览器 JSON.parse 后仍还原为原字符串，前端无感。
+      appPublished: appPublishedData ? safeEscapeDeep(appPublishedData) : null,
       basename
     };
     res.locals = {
@@ -36403,22 +36456,6 @@ var PlatformModule = class _PlatformModule {
             }, "useFactory")
           })
         ],
-        import_nestjs.NestjsCacheModule.forRootAsync({
-          inject: [
-            import_nestjs_logger2.AppLogger
-          ],
-          useFactory: /* @__PURE__ */ __name((...args) => {
-            const appLogger = args[0];
-            const connectionString = process.env.SUDA_CACHE_URL ?? "";
-            if (!connectionString) {
-              appLogger.warn("SUDA_CACHE_URL is empty, cache-service will be effectively disabled until it is set.", "PlatformModule");
-            }
-            return {
-              connectionString,
-              connectionTokenFilePath: "/var/run/secrets/zti/credential"
-            };
-          }, "useFactory")
-        }),
         import_nestjs_authnpaas.AuthNPaasModule.forRoot(),
         import_nestjs_authzpaas.AuthZPaasModule.forRoot({
           ...options.authz || {}
@@ -36638,6 +36675,10 @@ var import_nestjs_authzpaas2 = require("@lark-apaas/nestjs-authzpaas");
   ViewContextMiddleware,
   configureApp,
   createLegacyPathRedirectMiddleware,
+  safeEscape,
+  safeEscapeDeep,
+  safeStringParse,
+  safeStringify,
   ...require("@lark-apaas/nestjs-authnpaas"),
   ...require("@lark-apaas/nestjs-capability"),
   ...require("@lark-apaas/nestjs-datapaas"),

package/dist/index.d.cts

@@ -411,4 +411,29 @@ declare class PlatformHttpClientService {
     private registerInterceptorsForClient;
 }
 
-export { type ApiNotFoundResponse, CsrfMiddleware, CsrfTokenMiddleware, FileService, HtmlHotUpdateModule, HtmlHotUpdateService, type PlatformHttpClientOptions, PlatformHttpClientService, PlatformModule, type PlatformModuleOptions, StaticModule, UserContextMiddleware, ViewContextMiddleware, configureApp, createLegacyPathRedirectMiddleware };
+/**
+ * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。
+ * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java
+ * 将 json 的敏感字符转换为 unicode, 避免 xss
+ */
+declare function safeStringify(obj: any): string;
+declare function safeStringParse<T>(str: string, defaultValue?: any): T;
+declare function safeEscape(s: string): string;
+/**
+ * 深度递归 safeEscape：仅处理 plain object / array / string，其他类型（number /
+ * boolean / null / undefined / Date / Map / Set / Buffer / class 实例 …）原样返回，
+ * 避免把非 plain 对象打散成 `{}`。命中循环引用时对已访问节点原样返回，不再递归。
+ *
+ * ⚠️ 用途约定：产物是**给 JS 源码字面量语境**用的（例如把整段结果作为
+ * `<script>window.x = ${result}</script>` 直接注入）。转义后的 `<` 是 6 个字面
+ * 字符（含反斜杠），依赖 JS 引擎在 parse 字符串字面量时把它解回 `<`。
+ *
+ * 若下游再对结果做一次 `JSON.stringify`（如 EJS `<%- JSON.stringify(...) %>`），
+ * `\` 会被 JSON 再次转义为 `\\` —— 这仍然能阻止 `</script>` 提前闭合 <script> 块
+ * （核心目标），但**浏览器端 JSON.parse 拿到的字符串会含字面 `<` 序列而非
+ * `<`**。这是 SDK 与下游的既有契约（现存 `safeEscape(appDescription)` 也是同样性质）。
+ * 前端如需还原可自行 `JSON.parse('"' + v + '"')`。
+ */
+declare function safeEscapeDeep<T>(value: T): T;
+
+export { type ApiNotFoundResponse, CsrfMiddleware, CsrfTokenMiddleware, FileService, HtmlHotUpdateModule, HtmlHotUpdateService, type PlatformHttpClientOptions, PlatformHttpClientService, PlatformModule, type PlatformModuleOptions, StaticModule, UserContextMiddleware, ViewContextMiddleware, configureApp, createLegacyPathRedirectMiddleware, safeEscape, safeEscapeDeep, safeStringParse, safeStringify };

package/dist/index.d.ts

@@ -411,4 +411,29 @@ declare class PlatformHttpClientService {
     private registerInterceptorsForClient;
 }
 
-export { type ApiNotFoundResponse, CsrfMiddleware, CsrfTokenMiddleware, FileService, HtmlHotUpdateModule, HtmlHotUpdateService, type PlatformHttpClientOptions, PlatformHttpClientService, PlatformModule, type PlatformModuleOptions, StaticModule, UserContextMiddleware, ViewContextMiddleware, configureApp, createLegacyPathRedirectMiddleware };
+/**
+ * 安全转义的 Json Stringify，模版渲染的 JSON 对象需要调用 safeStringify，而不是用原生的 JSON.stringify。
+ * 抄 gson 的实现: https://github.com/google/gson/blob/49ddab9eeb6cbac686711deca6001d40e8d8500d/gson/src/main/java/com/google/gson/stream/JsonWriter.java
+ * 将 json 的敏感字符转换为 unicode, 避免 xss
+ */
+declare function safeStringify(obj: any): string;
+declare function safeStringParse<T>(str: string, defaultValue?: any): T;
+declare function safeEscape(s: string): string;
+/**
+ * 深度递归 safeEscape：仅处理 plain object / array / string，其他类型（number /
+ * boolean / null / undefined / Date / Map / Set / Buffer / class 实例 …）原样返回，
+ * 避免把非 plain 对象打散成 `{}`。命中循环引用时对已访问节点原样返回，不再递归。
+ *
+ * ⚠️ 用途约定：产物是**给 JS 源码字面量语境**用的（例如把整段结果作为
+ * `<script>window.x = ${result}</script>` 直接注入）。转义后的 `<` 是 6 个字面
+ * 字符（含反斜杠），依赖 JS 引擎在 parse 字符串字面量时把它解回 `<`。
+ *
+ * 若下游再对结果做一次 `JSON.stringify`（如 EJS `<%- JSON.stringify(...) %>`），
+ * `\` 会被 JSON 再次转义为 `\\` —— 这仍然能阻止 `</script>` 提前闭合 <script> 块
+ * （核心目标），但**浏览器端 JSON.parse 拿到的字符串会含字面 `<` 序列而非
+ * `<`**。这是 SDK 与下游的既有契约（现存 `safeEscape(appDescription)` 也是同样性质）。
+ * 前端如需还原可自行 `JSON.parse('"' + v + '"')`。
+ */
+declare function safeEscapeDeep<T>(value: T): T;
+
+export { type ApiNotFoundResponse, CsrfMiddleware, CsrfTokenMiddleware, FileService, HtmlHotUpdateModule, HtmlHotUpdateService, type PlatformHttpClientOptions, PlatformHttpClientService, PlatformModule, type PlatformModuleOptions, StaticModule, UserContextMiddleware, ViewContextMiddleware, configureApp, createLegacyPathRedirectMiddleware, safeEscape, safeEscapeDeep, safeStringParse, safeStringify };

package/dist/index.js

@@ -14893,10 +14893,10 @@ var require_object_inspect = __commonJS({
       }
       if (!isDate(obj) && !isRegExp(obj)) {
         var ys = arrObjKeys(obj, inspect);
-        var isPlainObject = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
+        var isPlainObject2 = gPO ? gPO(obj) === Object.prototype : obj instanceof Object || obj.constructor === Object;
         var protoTag = obj instanceof Object ? "" : "null prototype";
-        var stringTag = !isPlainObject && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
-        var constructorTag = isPlainObject || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
+        var stringTag = !isPlainObject2 && toStringTag && Object(obj) === obj && toStringTag in obj ? $slice.call(toStr(obj), 8, -1) : protoTag ? "Object" : "";
+        var constructorTag = isPlainObject2 || typeof obj.constructor !== "function" ? "" : obj.constructor.name ? obj.constructor.name + " " : "";
         var tag = constructorTag + (stringTag || protoTag ? "[" + $join.call($concat.call([], stringTag || [], protoTag || []), ": ") + "] " : "");
         if (ys.length === 0) {
           return tag + "{}";
@@ -34409,7 +34409,6 @@ import { NestjsObservableModule as ObservableModule, Observable, ObservableTrace
 import { HttpModule } from "@nestjs/axios";
 import { LoggerModule, AppLogger as AppLogger2, LoggerContextMiddleware } from "@lark-apaas/nestjs-logger";
 import { DataPaasModule, SqlExecutionContextMiddleware } from "@lark-apaas/nestjs-datapaas";
-import { NestjsCacheModule } from "@lark-apaas/cache-service/nestjs";
 import { AuthNPaasModule } from "@lark-apaas/nestjs-authnpaas";
 import { HttpForwarderModule } from "@lark-apaas/nestjs-http-forwarder";
 import { AutomationModule } from "@lark-apaas/nestjs-trigger";
@@ -34533,6 +34532,19 @@ import { Inject, Injectable as Injectable3, Logger } from "@nestjs/common";
 import { PLATFORM_HTTP_CLIENT } from "@lark-apaas/nestjs-common";
 
 // src/utils/safe-stringify.ts
+function safeStringify(obj) {
+  const json2 = JSON.stringify(obj);
+  return safeEscape(json2);
+}
+__name(safeStringify, "safeStringify");
+function safeStringParse(str, defaultValue = null) {
+  try {
+    return JSON.parse(str);
+  } catch (e) {
+    return defaultValue;
+  }
+}
+__name(safeStringParse, "safeStringParse");
 function safeEscape(s) {
   return s.replace(/[<>&='"\n\r\u2028\u2029]/g, function(c) {
     switch (c.charCodeAt(0)) {
@@ -34574,6 +34586,40 @@ function safeEscape(s) {
   });
 }
 __name(safeEscape, "safeEscape");
+function safeEscapeDeep(value) {
+  return safeEscapeDeepInner(value, /* @__PURE__ */ new WeakSet());
+}
+__name(safeEscapeDeep, "safeEscapeDeep");
+var plainProtos = /* @__PURE__ */ new Set([
+  Object.prototype,
+  null
+]);
+function isPlainObject(v) {
+  if (v === null || typeof v !== "object") return false;
+  return plainProtos.has(Object.getPrototypeOf(v));
+}
+__name(isPlainObject, "isPlainObject");
+function safeEscapeDeepInner(value, seen) {
+  if (typeof value === "string") {
+    return safeEscape(value);
+  }
+  if (Array.isArray(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    return value.map((v) => safeEscapeDeepInner(v, seen));
+  }
+  if (isPlainObject(value)) {
+    if (seen.has(value)) return value;
+    seen.add(value);
+    const out = {};
+    for (const k of Object.keys(value)) {
+      out[k] = safeEscapeDeepInner(value[k], seen);
+    }
+    return out;
+  }
+  return value;
+}
+__name(safeEscapeDeepInner, "safeEscapeDeepInner");
 
 // src/middlewares/view-context/middleware.ts
 function _ts_decorate3(decorators, target, key, desc) {
@@ -34641,7 +34687,10 @@ var ViewContextMiddleware = class _ViewContextMiddleware {
       tenantId,
       environment,
       showBadge: appInfo?.show_badge !== false,
-      appPublished: appPublishedData ?? null,
+      // 上游 get_published_v2 返回的整包数据里可能含用户可输入字段（如 app_description），
+      // 用户输入 </script> / 引号 / 换行等会破坏下游 <script> raw 注入的 JSON.stringify 结果，
+      // 深度 escape 所有 string 字段兜底；浏览器 JSON.parse 后仍还原为原字符串，前端无感。
+      appPublished: appPublishedData ? safeEscapeDeep(appPublishedData) : null,
       basename
     };
     res.locals = {
@@ -36376,22 +36425,6 @@ var PlatformModule = class _PlatformModule {
             }, "useFactory")
           })
         ],
-        NestjsCacheModule.forRootAsync({
-          inject: [
-            AppLogger2
-          ],
-          useFactory: /* @__PURE__ */ __name((...args) => {
-            const appLogger = args[0];
-            const connectionString = process.env.SUDA_CACHE_URL ?? "";
-            if (!connectionString) {
-              appLogger.warn("SUDA_CACHE_URL is empty, cache-service will be effectively disabled until it is set.", "PlatformModule");
-            }
-            return {
-              connectionString,
-              connectionTokenFilePath: "/var/run/secrets/zti/credential"
-            };
-          }, "useFactory")
-        }),
         AuthNPaasModule.forRoot(),
         AuthZPaasModule.forRoot({
           ...options.authz || {}
@@ -36609,7 +36642,11 @@ export {
   UserContextMiddleware,
   ViewContextMiddleware,
   configureApp,
-  createLegacyPathRedirectMiddleware
+  createLegacyPathRedirectMiddleware,
+  safeEscape,
+  safeEscapeDeep,
+  safeStringParse,
+  safeStringify
 };
 /*! Bundled license information:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/fullstack-nestjs-core",
-  "version": "1.1.56-alpha.2",
+  "version": "1.1.56-alpha.3",
   "description": "FullStack Nestjs Core",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,11 +39,10 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@lark-apaas/cache-service": "0.1.1-alpha.1",
     "@lark-apaas/file-service": "^0.1.2",
     "@lark-apaas/http-client": "^0.1.7",
-    "@lark-apaas/nestjs-authnpaas": "^1.0.4",
-    "@lark-apaas/nestjs-authzpaas": "^0.1.9",
+    "@lark-apaas/nestjs-authnpaas": "^1.0.5",
+    "@lark-apaas/nestjs-authzpaas": "^0.1.12",
     "@lark-apaas/nestjs-capability": "^0.1.14",
     "@lark-apaas/nestjs-common": "^0.1.9",
     "@lark-apaas/nestjs-datapaas": "^1.0.21",