@orioro/util 0.11.2 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @orioro/util
 
+## 0.12.0
+
+### Minor Changes
+
+- improved support for url strings and strings with colon
+
 ## 0.11.2
 
 ### Patch Changes

package/dist/index.js

@@ -950,11 +950,26 @@ function maybeReturnPromise(result, parseResult) {
   return isPromise(result) ? result.then(parseResult) : parseResult(result);
 }
 
-function syntheticJson(str) {
+function syntheticJson(str, maxLength) {
+  if (maxLength === void 0) {
+    maxLength = 10000;
+  }
+  // Step 0: Reject overly long input early to prevent
+  // any possible vulnerability with ReDoS
+  if (str.length > maxLength) {
+    throw new Error('Input too large');
+  }
   // Step 1: Replace single quotes with double quotes
   var normalized = str.replace(/'/g, '"');
-  // Step 2: Add quotes around unquoted keys (letters, digits, underscores)
-  normalized = normalized.replace(/([a-zA-Z0-9_]+)\s*:/g, '"$1":');
+  // Step 2: Add quotes around unquoted keys with limited whitespace,
+  // only if followed by
+  // - double-quoted string (")
+  // - positive or negative number (-?\d)
+  // - start of object ({)
+  // - start of array ([)
+  // - null
+  // - true or false
+  normalized = normalized.replace(/([a-zA-Z0-9_]+)\s{0,5}:\s{0,5}(?=("|-?\d|\{|\[|null|true|false))/g, '"$1":');
   // Step 3: Parse as JSON
   try {
     return JSON.parse(normalized);

package/dist/index.mjs

@@ -948,11 +948,26 @@ function maybeReturnPromise(result, parseResult) {
   return isPromise(result) ? result.then(parseResult) : parseResult(result);
 }
 
-function syntheticJson(str) {
+function syntheticJson(str, maxLength) {
+  if (maxLength === void 0) {
+    maxLength = 10000;
+  }
+  // Step 0: Reject overly long input early to prevent
+  // any possible vulnerability with ReDoS
+  if (str.length > maxLength) {
+    throw new Error('Input too large');
+  }
   // Step 1: Replace single quotes with double quotes
   var normalized = str.replace(/'/g, '"');
-  // Step 2: Add quotes around unquoted keys (letters, digits, underscores)
-  normalized = normalized.replace(/([a-zA-Z0-9_]+)\s*:/g, '"$1":');
+  // Step 2: Add quotes around unquoted keys with limited whitespace,
+  // only if followed by
+  // - double-quoted string (")
+  // - positive or negative number (-?\d)
+  // - start of object ({)
+  // - start of array ([)
+  // - null
+  // - true or false
+  normalized = normalized.replace(/([a-zA-Z0-9_]+)\s{0,5}:\s{0,5}(?=("|-?\d|\{|\[|null|true|false))/g, '"$1":');
   // Step 3: Parse as JSON
   try {
     return JSON.parse(normalized);

package/dist/strExpr/syntheticJson.d.ts

@@ -1 +1 @@
-export declare function syntheticJson(str: string): unknown;
+export declare function syntheticJson(str: string, maxLength?: number): unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orioro/util",
-  "version": "0.11.2",
+  "version": "0.12.0",
   "packageManager": "yarn@4.0.2",
   "type": "module",
   "main": "dist/index.mjs",