@onesub/server 0.23.0 → 0.23.2

package/dist/__tests__/logger.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The process-wide logger, and specifically that a caller cannot forge log lines.
+ *
+ * Much of what this server logs is attacker-influenced — `userId` arrives in the
+ * request body, and bundle ids, package names and receipt previews come out of
+ * submitted receipts. A newline in any of those would let a caller end the current
+ * line and write an entry of their own, and these logs are what support and fraud
+ * decisions get read from.
+ */
+export {};
+//# sourceMappingURL=logger.test.d.ts.map

package/dist/__tests__/logger.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/logger.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/index.cjs

@@ -175,10 +175,16 @@ var current = console;
 function setLogger(logger) {
   if (logger) current = logger;
 }
+function escapeLineBreaks(value) {
+  return value.replace(/\r/g, "\\r").replace(/\n/g, "\\n").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function scrub(args) {
+  return args.map((arg) => typeof arg === "string" ? escapeLineBreaks(arg) : arg);
+}
 var log = {
-  info: (...args) => current.info(...args),
-  warn: (...args) => current.warn(...args),
-  error: (...args) => current.error(...args)
+  info: (...args) => current.info(...scrub(args)),
+  warn: (...args) => current.warn(...scrub(args)),
+  error: (...args) => current.error(...scrub(args))
 };
 
 // src/http.ts