@nest-vue/vue-security-patched 2.7.16-patch.2

package/packages/compiler-sfc/src/stylePreprocessors.ts

@@ -0,0 +1,135 @@
+import merge from 'merge-source-map'
+import { RawSourceMap } from 'source-map'
+import { isFunction } from 'shared/util'
+
+export type StylePreprocessor = (
+  source: string,
+  map: RawSourceMap | undefined,
+  options: {
+    [key: string]: any
+    additionalData?: string | ((source: string, filename: string) => string)
+    filename: string
+  }
+) => StylePreprocessorResults
+
+export interface StylePreprocessorResults {
+  code: string
+  map?: object
+  errors: Error[]
+  dependencies: string[]
+}
+
+// .scss/.sass processor
+const scss: StylePreprocessor = (source, map, options) => {
+  const nodeSass = require('sass')
+  const finalOptions = {
+    ...options,
+    data: getSource(source, options.filename, options.additionalData),
+    file: options.filename,
+    outFile: options.filename,
+    sourceMap: !!map
+  }
+
+  try {
+    const result = nodeSass.renderSync(finalOptions)
+    const dependencies = result.stats.includedFiles
+    if (map) {
+      return {
+        code: result.css.toString(),
+        map: merge(map, JSON.parse(result.map.toString())),
+        errors: [],
+        dependencies
+      }
+    }
+
+    return { code: result.css.toString(), errors: [], dependencies }
+  } catch (e: any) {
+    return { code: '', errors: [e], dependencies: [] }
+  }
+}
+
+const sass: StylePreprocessor = (source, map, options) =>
+  scss(source, map, {
+    ...options,
+    indentedSyntax: true
+  })
+
+// .less
+const less: StylePreprocessor = (source, map, options) => {
+  const nodeLess = require('less')
+
+  let result: any
+  let error: Error | null = null
+  nodeLess.render(
+    getSource(source, options.filename, options.additionalData),
+    { ...options, syncImport: true },
+    (err: Error | null, output: any) => {
+      error = err
+      result = output
+    }
+  )
+
+  if (error) return { code: '', errors: [error], dependencies: [] }
+  const dependencies = result.imports
+  if (map) {
+    return {
+      code: result.css.toString(),
+      map: merge(map, result.map),
+      errors: [],
+      dependencies: dependencies
+    }
+  }
+
+  return {
+    code: result.css.toString(),
+    errors: [],
+    dependencies: dependencies
+  }
+}
+
+// .styl
+const styl: StylePreprocessor = (source, map, options) => {
+  const nodeStylus = require('stylus')
+  try {
+    const ref = nodeStylus(source)
+    Object.keys(options).forEach(key => ref.set(key, options[key]))
+    if (map) ref.set('sourcemap', { inline: false, comment: false })
+
+    const result = ref.render()
+    const dependencies = ref.deps()
+    if (map) {
+      return {
+        code: result,
+        map: merge(map, ref.sourcemap),
+        errors: [],
+        dependencies
+      }
+    }
+
+    return { code: result, errors: [], dependencies }
+  } catch (e: any) {
+    return { code: '', errors: [e], dependencies: [] }
+  }
+}
+
+function getSource(
+  source: string,
+  filename: string,
+  additionalData?: string | ((source: string, filename: string) => string)
+) {
+  if (!additionalData) return source
+  if (isFunction(additionalData)) {
+    return additionalData(source, filename)
+  }
+  return additionalData + source
+}
+
+export type PreprocessLang = 'less' | 'sass' | 'scss' | 'styl' | 'stylus'
+
+export const processors: Record<PreprocessLang, StylePreprocessor> = {
+  less,
+  sass,
+  scss,
+  styl,
+  stylus: styl
+}

package/packages/compiler-sfc/src/templateCompilerModules/assetUrl.ts

@@ -0,0 +1,84 @@
+// vue compiler module for transforming `<tag>:<attribute>` to `require`
+
+import { urlToRequire } from './utils'
+import { ASTNode, ASTAttr } from 'types/compiler'
+
+export interface AssetURLOptions {
+  [name: string]: string | string[]
+}
+
+export interface TransformAssetUrlsOptions {
+  /**
+   * If base is provided, instead of transforming relative asset urls into
+   * imports, they will be directly rewritten to absolute urls.
+   */
+  base?: string
+  /**
+   * If true, also processes absolute urls.
+   */
+  includeAbsolute?: boolean
+}
+
+const defaultOptions: AssetURLOptions = {
+  audio: 'src',
+  video: ['src', 'poster'],
+  source: 'src',
+  img: 'src',
+  image: ['xlink:href', 'href'],
+  use: ['xlink:href', 'href']
+}
+
+export default (
+  userOptions?: AssetURLOptions,
+  transformAssetUrlsOption?: TransformAssetUrlsOptions
+) => {
+  const options = userOptions
+    ? Object.assign({}, defaultOptions, userOptions)
+    : defaultOptions
+
+  return {
+    postTransformNode: (node: ASTNode) => {
+      transform(node, options, transformAssetUrlsOption)
+    }
+  }
+}
+
+function transform(
+  node: ASTNode,
+  options: AssetURLOptions,
+  transformAssetUrlsOption?: TransformAssetUrlsOptions
+) {
+  if (node.type !== 1 || !node.attrs) return
+  for (const tag in options) {
+    if (tag === '*' || node.tag === tag) {
+      const attributes = options[tag]
+      if (typeof attributes === 'string') {
+        node.attrs!.some(attr =>
+          rewrite(attr, attributes, transformAssetUrlsOption)
+        )
+      } else if (Array.isArray(attributes)) {
+        attributes.forEach(item =>
+          node.attrs!.some(attr =>
+            rewrite(attr, item, transformAssetUrlsOption)
+          )
+        )
+      }
+    }
+  }
+}
+
+function rewrite(
+  attr: ASTAttr,
+  name: string,
+  transformAssetUrlsOption?: TransformAssetUrlsOptions
+) {
+  if (attr.name === name) {
+    const value = attr.value
+    // only transform static URLs
+    if (value.charAt(0) === '"' && value.charAt(value.length - 1) === '"') {
+      attr.value = urlToRequire(value.slice(1, -1), transformAssetUrlsOption)
+      return true
+    }
+  }
+  return false
+}

package/packages/compiler-sfc/src/templateCompilerModules/srcset.ts

@@ -0,0 +1,76 @@
+// vue compiler module for transforming `img:srcset` to a number of `require`s
+
+import { urlToRequire } from './utils'
+import { TransformAssetUrlsOptions } from './assetUrl'
+import { ASTNode } from 'types/compiler'
+
+interface ImageCandidate {
+  require: string
+  descriptor: string
+}
+
+export default (transformAssetUrlsOptions?: TransformAssetUrlsOptions) => ({
+  postTransformNode: (node: ASTNode) => {
+    transform(node, transformAssetUrlsOptions)
+  }
+})
+
+// http://w3c.github.io/html/semantics-embedded-content.html#ref-for-image-candidate-string-5
+const escapedSpaceCharacters = /( |\\t|\\n|\\f|\\r)+/g
+
+function transform(
+  node: ASTNode,
+  transformAssetUrlsOptions?: TransformAssetUrlsOptions
+) {
+  if (node.type !== 1 || !node.attrs) {
+    return
+  }
+
+  if (node.tag === 'img' || node.tag === 'source') {
+    node.attrs.forEach(attr => {
+      if (attr.name === 'srcset') {
+        // same logic as in transform-require.js
+        const value = attr.value
+        const isStatic =
+          value.charAt(0) === '"' && value.charAt(value.length - 1) === '"'
+        if (!isStatic) {
+          return
+        }
+
+        const imageCandidates: ImageCandidate[] = value
+          .slice(1, -1)
+          .split(',')
+          .map(s => {
+            // The attribute value arrives here with all whitespace, except
+            // normal spaces, represented by escape sequences
+            const [url, descriptor] = s
+              .replace(escapedSpaceCharacters, ' ')
+              .trim()
+              .split(' ', 2)
+            return {
+              require: urlToRequire(url, transformAssetUrlsOptions),
+              descriptor
+            }
+          })
+
+        // "require(url1)"
+        // "require(url1) 1x"
+        // "require(url1), require(url2)"
+        // "require(url1), require(url2) 2x"
+        // "require(url1) 1x, require(url2)"
+        // "require(url1) 1x, require(url2) 2x"
+        const code = imageCandidates
+          .map(
+            ({ require, descriptor }) =>
+              `${require} + "${descriptor ? ' ' + descriptor : ''}, " + `
+          )
+          .join('')
+          .slice(0, -6)
+          .concat('"')
+          .replace(/ \+ ""$/, '')
+
+        attr.value = code
+      }
+    })
+  }
+}

package/packages/compiler-sfc/src/templateCompilerModules/utils.ts

@@ -0,0 +1,86 @@
+import { TransformAssetUrlsOptions } from './assetUrl'
+import { UrlWithStringQuery, parse as uriParse } from 'url'
+import path from 'path'
+
+export function urlToRequire(
+  url: string,
+  transformAssetUrlsOption: TransformAssetUrlsOptions = {}
+): string {
+  const returnValue = `"${url}"`
+  // same logic as in transform-require.js
+  const firstChar = url.charAt(0)
+  if (firstChar === '~') {
+    const secondChar = url.charAt(1)
+    url = url.slice(secondChar === '/' ? 2 : 1)
+  }
+
+  if (isExternalUrl(url) || isDataUrl(url) || firstChar === '#') {
+    return returnValue
+  }
+
+  const uriParts = parseUriParts(url)
+  if (transformAssetUrlsOption.base) {
+    // explicit base - directly rewrite the url into absolute url
+    // does not apply to absolute urls or urls that start with `@`
+    // since they are aliases
+    if (firstChar === '.' || firstChar === '~') {
+      // Allow for full hostnames provided in options.base
+      const base = parseUriParts(transformAssetUrlsOption.base)
+      const protocol = base.protocol || ''
+      const host = base.host ? protocol + '//' + base.host : ''
+      const basePath = base.path || '/'
+      // when packaged in the browser, path will be using the posix-
+      // only version provided by rollup-plugin-node-builtins.
+      return `"${host}${(path.posix || path).join(
+        basePath,
+        uriParts.path + (uriParts.hash || '')
+      )}"`
+    }
+  }
+
+  if (
+    transformAssetUrlsOption.includeAbsolute ||
+    firstChar === '.' ||
+    firstChar === '~' ||
+    firstChar === '@'
+  ) {
+    if (!uriParts.hash) {
+      return `require("${url}")`
+    } else {
+      // support uri fragment case by excluding it from
+      // the require and instead appending it as string;
+      // assuming that the path part is sufficient according to
+      // the above caseing(t.i. no protocol-auth-host parts expected)
+      return `require("${uriParts.path}") + "${uriParts.hash}"`
+    }
+  }
+  return returnValue
+}
+
+/**
+ * vuejs/component-compiler-utils#22 Support uri fragment in transformed require
+ * @param urlString an url as a string
+ */
+function parseUriParts(urlString: string): UrlWithStringQuery {
+  // initialize return value
+  const returnValue: UrlWithStringQuery = uriParse('')
+  if (urlString) {
+    // A TypeError is thrown if urlString is not a string
+    // @see https://nodejs.org/api/url.html#url_url_parse_urlstring_parsequerystring_slashesdenotehost
+    if ('string' === typeof urlString) {
+      // check is an uri
+      return uriParse(urlString, false, true) // take apart the uri
+    }
+  }
+  return returnValue
+}
+
+const externalRE = /^(https?:)?\/\//
+function isExternalUrl(url: string): boolean {
+  return externalRE.test(url)
+}
+
+const dataUrlRE = /^\s*data:/i
+function isDataUrl(url: string): boolean {
+  return dataUrlRE.test(url)
+}

package/packages/compiler-sfc/src/types.ts

@@ -0,0 +1,69 @@
+import { CompilerOptions, CompiledResult } from 'types/compiler'
+import { SFCDescriptor } from './parseComponent'
+
+export interface StartOfSourceMap {
+  file?: string
+  sourceRoot?: string
+}
+
+export interface RawSourceMap extends StartOfSourceMap {
+  version: string
+  sources: string[]
+  names: string[]
+  sourcesContent?: string[]
+  mappings: string
+}
+
+export interface TemplateCompiler {
+  parseComponent(source: string, options?: any): SFCDescriptor
+  compile(template: string, options: CompilerOptions): CompiledResult
+  ssrCompile(template: string, options: CompilerOptions): CompiledResult
+}
+
+export const enum BindingTypes {
+  /**
+   * returned from data()
+   */
+  DATA = 'data',
+  /**
+   * declared as a prop
+   */
+  PROPS = 'props',
+  /**
+   * a local alias of a `<script setup>` destructured prop.
+   * the original is stored in __propsAliases of the bindingMetadata object.
+   */
+  PROPS_ALIASED = 'props-aliased',
+  /**
+   * a let binding (may or may not be a ref)
+   */
+  SETUP_LET = 'setup-let',
+  /**
+   * a const binding that can never be a ref.
+   * these bindings don't need `unref()` calls when processed in inlined
+   * template expressions.
+   */
+  SETUP_CONST = 'setup-const',
+  /**
+   * a const binding that does not need `unref()`, but may be mutated.
+   */
+  SETUP_REACTIVE_CONST = 'setup-reactive-const',
+  /**
+   * a const binding that may be a ref.
+   */
+  SETUP_MAYBE_REF = 'setup-maybe-ref',
+  /**
+   * bindings that are guaranteed to be refs
+   */
+  SETUP_REF = 'setup-ref',
+  /**
+   * declared by other options, e.g. computed, inject
+   */
+  OPTIONS = 'options'
+}
+
+export type BindingMetadata = {
+  [key: string]: BindingTypes | undefined
+} & {
+  __isScriptSetup?: boolean
+}

package/packages/compiler-sfc/src/warn.ts

@@ -0,0 +1,16 @@
+const hasWarned: Record<string, boolean> = {}
+
+export function warnOnce(msg: string) {
+  const isNodeProd =
+    typeof process !== 'undefined' && process.env.NODE_ENV === 'production'
+  if (!isNodeProd && !hasWarned[msg]) {
+    hasWarned[msg] = true
+    warn(msg)
+  }
+}
+
+export function warn(msg: string) {
+  console.warn(
+    `\x1b[1m\x1b[33m[@vue/compiler-sfc]\x1b[0m\x1b[33m ${msg}\x1b[0m\n`
+  )
+}