@lwrjs/shared-utils 0.19.8 → 0.19.9

package/build/cjs/env.cjs

@@ -39,7 +39,6 @@ function getFeatureFlags() {
     LEGACY_LOADER: parseBooleanFlag("LEGACY_LOADER"),
     LWR_TRACING: parseTracingFlag(),
     DISABLE_B3_TRACING: parseBooleanFlag("DISABLE_B3_TRACING"),
-    MRT_B3_TRACING: parseBooleanFlag("MRT_B3_TRACING"),
     MAX_VIEW_CACHE_TTL: parseStringFlag("MAX_VIEW_CACHE_TTL"),
     REEVALUATE_MODULES: parseBooleanFlag("REEVALUATE_MODULES"),
     SSR_COMPILER_ENABLED: parseBooleanFlag("SSR_COMPILER_ENABLED"),
@@ -63,14 +62,6 @@ function parseTracingFlag() {
   const tracingValue = process.env.LWR_TRACING?.toLowerCase();
   return tracingValue && tracingValue !== "off" ? process.env.LWR_TRACING : void 0;
 }
-function shouldEnableB3Headers() {
-  const flags = getFeatureFlags();
-  const isMRT = isLambdaEnv() || process.env.MRT_REQUEST_CLASS || process.env.MOBIFY_PROPERTY_ID;
-  if (isMRT) {
-    return flags.MRT_B3_TRACING !== false;
-  }
-  return true;
-}
 function isLambdaEnv() {
   return process.env.AWS_LAMBDA_FUNCTION_NAME !== void 0;
 }
@@ -141,7 +132,7 @@ function getTraceHeaders(runtimeParams, span) {
     headers[TRUE_CLIENT_IP] = runtimeParams.trueClientIP;
   if (runtimeParams.correlationID)
     headers[CORRELATION_ID] = runtimeParams.correlationID;
-  if (shouldEnableB3Headers()) {
+  if (!getFeatureFlags().DISABLE_B3_TRACING) {
     if (span?.traceId) {
       headers[B3_TRACE_ID] = span.traceId;
       headers[B3_SAMPLED] = parseTracingFlag() ? "1" : "0";

package/build/cjs/identity.cjs

@@ -37,8 +37,10 @@ __export(exports, {
   VERSION_NOT_PROVIDED: () => VERSION_NOT_PROVIDED,
   VERSION_PREFIX: () => VERSION_PREFIX,
   VERSION_SIGIL: () => VERSION_SIGIL,
+  containsPathTraversal: () => containsPathTraversal,
   explodeSpecifier: () => explodeSpecifier,
   explodeSpecifiers: () => explodeSpecifiers,
+  fullyDecodeSpecifier: () => fullyDecodeSpecifier,
   getCacheKeyFromJson: () => import_fast_json_stable_stringify.default,
   getMappingUriPrefix: () => getMappingUriPrefix,
   getModuleUriPrefix: () => getModuleUriPrefix,
@@ -85,7 +87,30 @@ function normalizeVersionFromUri(version) {
 function prettyModuleUriSuffix(specifier) {
   return `${specifier.replace(/[\/\.\?\#]/g, "_")}`;
 }
+var MAX_DECODE_ITERATIONS = 5;
+function fullyDecodeSpecifier(rawSpecifier) {
+  let decoded = rawSpecifier;
+  for (let i = 0; i < MAX_DECODE_ITERATIONS; i++) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return decoded;
+    }
+    if (next === decoded) {
+      return decoded;
+    }
+    decoded = next;
+  }
+  throw new Error(`Specifier "${rawSpecifier}" could not be fully decoded within ${MAX_DECODE_ITERATIONS} passes`);
+}
+function containsPathTraversal(decodedSpecifier) {
+  return decodedSpecifier.split(/[\\/#?]/).some((segment) => segment === "..");
+}
 function explodeSpecifier(rawSpecifier) {
+  if (containsPathTraversal(fullyDecodeSpecifier(rawSpecifier))) {
+    throw new Error(`Invalid module specifier "${rawSpecifier}": path traversal is not allowed`);
+  }
   const decodedSpecifier = decodeURIComponent(rawSpecifier);
   const versionMatch = decodedSpecifier.match(/(.+)\/v\/([a-zA-Z0-9-_.]+)$/);
   const version = versionMatch ? versionMatch[2] : void 0;

package/build/es/env.js

@@ -15,10 +15,7 @@ export function getFeatureFlags() {
         // Enable metrics log level 'off', 'default' or 'verbose'
         LWR_TRACING: parseTracingFlag(),
         // Turn off distributed tracing (B3 headers, traceparent meta tag, MRT span exporting)
-        // Legacy flag - kept for backward compatibility but no longer controls B3 headers
         DISABLE_B3_TRACING: parseBooleanFlag('DISABLE_B3_TRACING'),
-        // Control x-b3-* distributed tracing headers specifically for MRT sites
-        MRT_B3_TRACING: parseBooleanFlag('MRT_B3_TRACING'),
         // Max size of ViewDefinition time to live
         MAX_VIEW_CACHE_TTL: parseStringFlag('MAX_VIEW_CACHE_TTL'),
         // Forces SSR to re-evaluate modules for every page render. By default, modules are evaluated only once.
@@ -59,32 +56,13 @@ function parseStringFlag(flag) {
     return value || undefined;
 }
 /**
- * Helper function to parse the LWR_TRACING flag for OpenTelemetry spans/instrumentation.
- * Returns the value if it's not 'off' and is defined, otherwise returns undefined.
- * This controls OpenTelemetry spans, NOT B3 distributed tracing headers.
+ * Helper function to parse the LWR_TRACING flag.
+ * Returns the value if it's not 'off' and is defined, otherwise returns false.
  */
 function parseTracingFlag() {
     const tracingValue = process.env.LWR_TRACING?.toLowerCase();
     return tracingValue && tracingValue !== 'off' ? process.env.LWR_TRACING : undefined;
 }
-/**
- * Helper function to determine if B3 distributed tracing headers should be enabled.
- * Uses MRT_B3_TRACING for MRT sites, always enabled for non-MRT sites.
- * Separates OpenTelemetry spans (LWR_TRACING) from B3 header propagation.
- *
- * @returns true if B3 distributed tracing headers should be set
- */
-function shouldEnableB3Headers() {
-    const flags = getFeatureFlags();
-    // Check if this is an MRT environment
-    const isMRT = isLambdaEnv() || process.env.MRT_REQUEST_CLASS || process.env.MOBIFY_PROPERTY_ID;
-    if (isMRT) {
-        // For MRT sites, use the MRT-specific distributed tracing flag
-        return flags.MRT_B3_TRACING !== false;
-    }
-    // For non-MRT sites, always enable B3 headers
-    return true;
-}
 /**
  * This function is used to determine if the current environment is a lambda.
  *
@@ -191,9 +169,7 @@ export function getTraceHeaders(runtimeParams, span) {
         headers[TRUE_CLIENT_IP] = runtimeParams.trueClientIP;
     if (runtimeParams.correlationID)
         headers[CORRELATION_ID] = runtimeParams.correlationID;
-    // Set B3 distributed tracing headers for request correlation across microservices
-    // These headers are controlled independently from OpenTelemetry spans (LWR_TRACING)
-    if (shouldEnableB3Headers()) {
+    if (!getFeatureFlags().DISABLE_B3_TRACING) {
         if (span?.traceId) {
             headers[B3_TRACE_ID] = span.traceId;
             headers[B3_SAMPLED] = parseTracingFlag() ? '1' : '0';

package/build/es/identity.d.ts

@@ -35,6 +35,23 @@ export declare function normalizeVersionFromUri(version: string): string;
  * examples/app/scoped/css?scoped=true => examples_app_scoped_css_scoped=true
  */
 export declare function prettyModuleUriSuffix(specifier: string): string;
+/**
+ * Repeatedly percent-decodes a string until it stabilizes (or the iteration bound is hit).
+ * A single decode pass can be defeated by nesting encodings (e.g. '%252e%252e%252f'
+ * decodes once to '%2e%2e%2f', which looks harmless until it's decoded again). Fully
+ * resolving the encoding first means a later traversal check can't be smuggled past.
+ */
+export declare function fullyDecodeSpecifier(rawSpecifier: string): string;
+/**
+ * True if any '/'-, '\'-, '#'-, or '?'-delimited segment of an already-decoded specifier
+ * is exactly '..' (a directory traversal segment). Segment based so legitimate names
+ * containing dots (e.g. 'my.label') are never mistaken for traversal. '#' and '?' are
+ * included because callers (e.g. lwc-module-provider) split the fragment after '#' off
+ * of a specifier and path.join it against a resolved directory - a '..' glued directly
+ * after '#' (e.g. 'c/app#../secret') would otherwise never appear as its own '/'-delimited
+ * segment and slip past this check (W-24189528).
+ */
+export declare function containsPathTraversal(decodedSpecifier: string): boolean;
 /**
  * Create a partial Module Identifier from a specifier
  * The Module Identifier is partial because the specifier may not contain a version

package/build/es/identity.js

@@ -42,7 +42,50 @@ export function prettyModuleUriSuffix(specifier) {
     // eslint-disable-next-line no-useless-escape
     return `${specifier.replace(/[\/\.\?\#]/g, '_')}`;
 }
+const MAX_DECODE_ITERATIONS = 5;
+/**
+ * Repeatedly percent-decodes a string until it stabilizes (or the iteration bound is hit).
+ * A single decode pass can be defeated by nesting encodings (e.g. '%252e%252e%252f'
+ * decodes once to '%2e%2e%2f', which looks harmless until it's decoded again). Fully
+ * resolving the encoding first means a later traversal check can't be smuggled past.
+ */
+export function fullyDecodeSpecifier(rawSpecifier) {
+    let decoded = rawSpecifier;
+    for (let i = 0; i < MAX_DECODE_ITERATIONS; i++) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return decoded; // malformed escape sequence, nothing further to decode
+        }
+        if (next === decoded) {
+            return decoded; // fully stable within budget
+        }
+        decoded = next;
+    }
+    // Every pass up to the budget still changed the string, so the encoding
+    // depth is unknown and possibly unbounded. Fail closed instead of checking
+    // a value that might still have traversal segments hidden behind more
+    // encoding than we were willing to unwrap.
+    throw new Error(`Specifier "${rawSpecifier}" could not be fully decoded within ${MAX_DECODE_ITERATIONS} passes`);
+}
+/**
+ * True if any '/'-, '\'-, '#'-, or '?'-delimited segment of an already-decoded specifier
+ * is exactly '..' (a directory traversal segment). Segment based so legitimate names
+ * containing dots (e.g. 'my.label') are never mistaken for traversal. '#' and '?' are
+ * included because callers (e.g. lwc-module-provider) split the fragment after '#' off
+ * of a specifier and path.join it against a resolved directory - a '..' glued directly
+ * after '#' (e.g. 'c/app#../secret') would otherwise never appear as its own '/'-delimited
+ * segment and slip past this check (W-24189528).
+ */
+export function containsPathTraversal(decodedSpecifier) {
+    return decodedSpecifier.split(/[\\/#?]/).some((segment) => segment === '..');
+}
 export function explodeSpecifier(rawSpecifier) {
+    if (containsPathTraversal(fullyDecodeSpecifier(rawSpecifier))) {
+        throw new Error(`Invalid module specifier "${rawSpecifier}": path traversal is not allowed`);
+    }
     const decodedSpecifier = decodeURIComponent(rawSpecifier);
     // Split up the version and bare specifier
     const versionMatch = decodedSpecifier.match(/(.+)\/v\/([a-zA-Z0-9-_.]+)$/);

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.19.8",
+    "version": "0.19.9",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -37,7 +37,7 @@
         "build/**/*.d.ts"
     ],
     "dependencies": {
-        "@lwrjs/diagnostics": "0.19.8",
+        "@lwrjs/diagnostics": "0.19.9",
         "es-module-lexer": "^1.5.4",
         "fast-json-stable-stringify": "^2.1.0",
         "magic-string": "^0.30.9",
@@ -50,7 +50,7 @@
         "slugify": "^1.4.5"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.19.8",
+        "@lwrjs/types": "0.19.9",
         "@types/mime-types": "2.1.4",
         "@types/path-to-regexp": "^1.7.0",
         "memfs": "^4.13.0"
@@ -58,5 +58,5 @@
     "engines": {
         "node": ">=20.0.0"
     },
-    "gitHead": "318e3e2bde6d04a218cc11849f791b7de85e6f9e"
+    "gitHead": "721f776d04844cbc99531d449c8200fac74c5fa2"
 }