@onesub/server 0.23.0 → 0.23.1

package/dist/__tests__/logger.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The process-wide logger, and specifically that a caller cannot forge log lines.
+ *
+ * Much of what this server logs is attacker-influenced — `userId` arrives in the
+ * request body, and bundle ids, package names and receipt previews come out of
+ * submitted receipts. A newline in any of those would let a caller end the current
+ * line and write an entry of their own, and these logs are what support and fraud
+ * decisions get read from.
+ */
+export {};
+//# sourceMappingURL=logger.test.d.ts.map

package/dist/__tests__/logger.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/index.cjs

@@ -175,10 +175,20 @@ var current = console;
 function setLogger(logger) {
   if (logger) current = logger;
 }
+function escapeLineBreaks(value) {
+  return value.replace(/[\r\n\u2028\u2029]/g, (ch) => {
+    if (ch === "\n") return "\\n";
+    if (ch === "\r") return "\\r";
+    return `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`;
+  });
+}
+function scrub(args) {
+  return args.map((arg) => typeof arg === "string" ? escapeLineBreaks(arg) : arg);
+}
 var log = {
-  info: (...args) => current.info(...args),
-  warn: (...args) => current.warn(...args),
-  error: (...args) => current.error(...args)
+  info: (...args) => current.info(...scrub(args)),
+  warn: (...args) => current.warn(...scrub(args)),
+  error: (...args) => current.error(...scrub(args))
 };
 
 // src/http.ts