@panomc/client-gen 1.0.0 → 1.1.0-dev.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panomc/client-gen",
-  "version": "1.0.0",
+  "version": "1.1.0-dev.2",
   "description": "Generates a typed JavaScript client from a Pano OpenAPI document and scaffolds headless sites (pano-client).",
   "author": "PanoMC",
   "license": "MIT",

package/src/generate.js

@@ -113,7 +113,7 @@ export function generateClient(input) {
     const t = /** @type {{ response: string, request: string | null }} */ (opTypes.get(op))
     const { type: paramsType, required } = paramsOf(op, t.request, importCtx)
     const lines = ['/**']
-    const doc1 = oneLine(op.summary) || oneLine(op.description) || `${op.method} ${op.path}`
+    const doc1 = oneLine(op.summary) || oneLine(op.description) || oneLine(`${op.method} ${op.path}`)
     lines.push(` * ${doc1}`)
     if (op.summary && op.description && oneLine(op.description) !== oneLine(op.summary)) lines.push(` * ${oneLine(op.description)}`)
     if (op.deprecated) lines.push(' * @deprecated')

package/src/generate.test.js

@@ -103,6 +103,39 @@ describe('generate: input errors', () => {
     expect(gen.files['operations.js']).toContain('deleteOperation:')
     expect(gen.warnings.some((w) => w.includes('unknown schema "Nope"'))).toBe(true)
   })
+
+  test('values from the document cannot close a JSDoc comment and add code', () => {
+    const evil = '*/ globalThis.PWNED=1; /*'
+    const gen = generateClient({
+      openapi: '3.1.0',
+      paths: {
+        [`/x/{id}/${evil}`]: {
+          get: {
+            operationId: 'getX',
+            parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string', enum: [evil] } }],
+            responses: {
+              200: {
+                content: {
+                  'application/json': {
+                    schema: { type: 'object', properties: { [evil]: { const: evil } }, required: [evil] }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    })
+    for (const [name, text] of Object.entries(gen.files)) {
+      if (!name.endsWith('.js')) continue
+      expect(text).not.toContain('*/ globalThis')
+      // every comment line between /** and */ starts with " *"
+      for (const block of text.matchAll(/\/\*\*\n([\s\S]*?)\n\s*\*\//g)) {
+        for (const line of block[1].split('\n')) expect(line.trimStart().startsWith('*')).toBe(true)
+      }
+    }
+    expect(gen.files['operations.js']).toContain("'/x/{id}/*\\/ globalThis.PWNED=1; /*'")
+  })
 })
 
 describe('generate: the output type checks', () => {

package/src/schema.js

@@ -8,9 +8,21 @@ export const isIdent = (s) => IDENT.test(s)
 /** Property key as it appears in an object type literal. @param {string} s */
 export const propKey = (s) => (isIdent(s) ? s : quote(s))
 
-/** @param {string} s */
+/**
+ * A single-quoted JS string literal. It also lands inside JSDoc comments, so a comment terminator is written
+ * as `*\/` (the same string value) and every kind of line break is escaped.
+ * @param {string} s
+ */
 export function quote(s) {
-  return `'${s.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\r?\n/g, '\\n')}'`
+  const body = s
+    .replace(/\\/g, '\\\\')
+    .replace(/'/g, "\\'")
+    .replace(/\r?\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replaceAll(String.fromCharCode(0x2028), '\\u2028')
+    .replaceAll(String.fromCharCode(0x2029), '\\u2029')
+    .replace(/\*\//g, '*\\/')
+  return `'${body}'`
 }
 
 /**