@lwrjs/shared-utils 0.23.19 → 0.23.21

package/build/cjs/identity.cjs

@@ -37,8 +37,10 @@ __export(exports, {
   VERSION_NOT_PROVIDED: () => VERSION_NOT_PROVIDED,
   VERSION_PREFIX: () => VERSION_PREFIX,
   VERSION_SIGIL: () => VERSION_SIGIL,
+  containsPathTraversal: () => containsPathTraversal,
   explodeSpecifier: () => explodeSpecifier,
   explodeSpecifiers: () => explodeSpecifiers,
+  fullyDecodeSpecifier: () => fullyDecodeSpecifier,
   getCacheKeyFromJson: () => import_fast_json_stable_stringify.default,
   getMappingUriPrefix: () => getMappingUriPrefix,
   getModuleUriPrefix: () => getModuleUriPrefix,
@@ -85,7 +87,30 @@ function normalizeVersionFromUri(version) {
 function prettyModuleUriSuffix(specifier) {
   return `${specifier.replace(/[\/\.\?\#]/g, "_")}`;
 }
+var MAX_DECODE_ITERATIONS = 5;
+function fullyDecodeSpecifier(rawSpecifier) {
+  let decoded = rawSpecifier;
+  for (let i = 0; i < MAX_DECODE_ITERATIONS; i++) {
+    let next;
+    try {
+      next = decodeURIComponent(decoded);
+    } catch {
+      return decoded;
+    }
+    if (next === decoded) {
+      return decoded;
+    }
+    decoded = next;
+  }
+  throw new Error(`Specifier "${rawSpecifier}" could not be fully decoded within ${MAX_DECODE_ITERATIONS} passes`);
+}
+function containsPathTraversal(decodedSpecifier) {
+  return decodedSpecifier.split(/[\\/#?]/).some((segment) => segment === "..");
+}
 function explodeSpecifier(rawSpecifier) {
+  if (containsPathTraversal(fullyDecodeSpecifier(rawSpecifier))) {
+    throw new Error(`Invalid module specifier "${rawSpecifier}": path traversal is not allowed`);
+  }
   const decodedSpecifier = decodeURIComponent(rawSpecifier);
   const versionMatch = decodedSpecifier.match(/(.+)\/v\/([a-zA-Z0-9-_.]+)$/);
   const version = versionMatch ? versionMatch[2] : void 0;

package/build/es/identity.d.ts

@@ -35,6 +35,23 @@ export declare function normalizeVersionFromUri(version: string): string;
  * examples/app/scoped/css?scoped=true => examples_app_scoped_css_scoped=true
  */
 export declare function prettyModuleUriSuffix(specifier: string): string;
+/**
+ * Repeatedly percent-decodes a string until it stabilizes (or the iteration bound is hit).
+ * A single decode pass can be defeated by nesting encodings (e.g. '%252e%252e%252f'
+ * decodes once to '%2e%2e%2f', which looks harmless until it's decoded again). Fully
+ * resolving the encoding first means a later traversal check can't be smuggled past.
+ */
+export declare function fullyDecodeSpecifier(rawSpecifier: string): string;
+/**
+ * True if any '/'-, '\'-, '#'-, or '?'-delimited segment of an already-decoded specifier
+ * is exactly '..' (a directory traversal segment). Segment based so legitimate names
+ * containing dots (e.g. 'my.label') are never mistaken for traversal. '#' and '?' are
+ * included because callers (e.g. lwc-module-provider) split the fragment after '#' off
+ * of a specifier and path.join it against a resolved directory - a '..' glued directly
+ * after '#' (e.g. 'c/app#../secret') would otherwise never appear as its own '/'-delimited
+ * segment and slip past this check (W-24189528).
+ */
+export declare function containsPathTraversal(decodedSpecifier: string): boolean;
 /**
  * Create a partial Module Identifier from a specifier
  * The Module Identifier is partial because the specifier may not contain a version

package/build/es/identity.js

@@ -42,7 +42,50 @@ export function prettyModuleUriSuffix(specifier) {
     // eslint-disable-next-line no-useless-escape
     return `${specifier.replace(/[\/\.\?\#]/g, '_')}`;
 }
+const MAX_DECODE_ITERATIONS = 5;
+/**
+ * Repeatedly percent-decodes a string until it stabilizes (or the iteration bound is hit).
+ * A single decode pass can be defeated by nesting encodings (e.g. '%252e%252e%252f'
+ * decodes once to '%2e%2e%2f', which looks harmless until it's decoded again). Fully
+ * resolving the encoding first means a later traversal check can't be smuggled past.
+ */
+export function fullyDecodeSpecifier(rawSpecifier) {
+    let decoded = rawSpecifier;
+    for (let i = 0; i < MAX_DECODE_ITERATIONS; i++) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return decoded; // malformed escape sequence, nothing further to decode
+        }
+        if (next === decoded) {
+            return decoded; // fully stable within budget
+        }
+        decoded = next;
+    }
+    // Every pass up to the budget still changed the string, so the encoding
+    // depth is unknown and possibly unbounded. Fail closed instead of checking
+    // a value that might still have traversal segments hidden behind more
+    // encoding than we were willing to unwrap.
+    throw new Error(`Specifier "${rawSpecifier}" could not be fully decoded within ${MAX_DECODE_ITERATIONS} passes`);
+}
+/**
+ * True if any '/'-, '\'-, '#'-, or '?'-delimited segment of an already-decoded specifier
+ * is exactly '..' (a directory traversal segment). Segment based so legitimate names
+ * containing dots (e.g. 'my.label') are never mistaken for traversal. '#' and '?' are
+ * included because callers (e.g. lwc-module-provider) split the fragment after '#' off
+ * of a specifier and path.join it against a resolved directory - a '..' glued directly
+ * after '#' (e.g. 'c/app#../secret') would otherwise never appear as its own '/'-delimited
+ * segment and slip past this check (W-24189528).
+ */
+export function containsPathTraversal(decodedSpecifier) {
+    return decodedSpecifier.split(/[\\/#?]/).some((segment) => segment === '..');
+}
 export function explodeSpecifier(rawSpecifier) {
+    if (containsPathTraversal(fullyDecodeSpecifier(rawSpecifier))) {
+        throw new Error(`Invalid module specifier "${rawSpecifier}": path traversal is not allowed`);
+    }
     const decodedSpecifier = decodeURIComponent(rawSpecifier);
     // Split up the version and bare specifier
     const versionMatch = decodedSpecifier.match(/(.+)\/v\/([a-zA-Z0-9-_.]+)$/);

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.23.19",
+    "version": "0.23.21",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -37,7 +37,7 @@
         "build/**/*.d.ts"
     ],
     "dependencies": {
-        "@lwrjs/diagnostics": "0.23.19",
+        "@lwrjs/diagnostics": "0.23.21",
         "es-module-lexer": "^1.5.4",
         "fast-json-stable-stringify": "^2.1.0",
         "magic-string": "^0.30.9",
@@ -50,7 +50,7 @@
         "slugify": "^1.4.5"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.23.19",
+        "@lwrjs/types": "0.23.21",
         "@types/mime-types": "2.1.4",
         "@types/path-to-regexp": "^1.7.0",
         "memfs": "^4.13.0"
@@ -58,5 +58,5 @@
     "engines": {
         "node": ">=22.0.0"
     },
-    "gitHead": "cb801a885519bb0446bbe5b7d36021c443f72c5b"
+    "gitHead": "c20f56af604d81026133ef9e9a575275056e7a91"
 }