@patchstack/connect 0.2.7 → 0.2.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -1
- package/dist/cli.js +297 -34
- package/dist/cli.js.map +1 -1
- package/dist/index.cjs +133 -34
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.cts +6 -0
- package/dist/index.d.ts +6 -0
- package/dist/index.js +126 -27
- package/dist/index.js.map +1 -1
- package/dist/protect/templates/engine.d.ts +57 -0
- package/dist/protect/templates/engine.js +137 -0
- package/dist/protect/templates/guard.ts +100 -0
- package/dist/protect/templates/manifest.d.ts +1 -0
- package/dist/protect/templates/rules.json +22 -0
- package/package.json +4 -3
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
{
|
|
2
|
+
"_comment": "DEMO SCAFFOLD — static stub; the real per-site rules endpoint does not exist in saas yet. CVE-2022-21681 is a real marked advisory affecting <4.0.10 (demo installs 4.0.0). The demo uses an XSS-shaped payload for visual clarity; exact payload<->CVE alignment is pinned with Group 1's corpus.",
|
|
3
|
+
"firewall": [
|
|
4
|
+
{
|
|
5
|
+
"id": "rm-npm-0001",
|
|
6
|
+
"title": "Block stored XSS via vulnerable markdown renderer (marked)",
|
|
7
|
+
"vulnerability_id": "CVE-2022-21681",
|
|
8
|
+
"package_cond": {
|
|
9
|
+
"package": "marked",
|
|
10
|
+
"vulnerable_versions": ["4.0.0"]
|
|
11
|
+
},
|
|
12
|
+
"rule_v2": [
|
|
13
|
+
{
|
|
14
|
+
"parameter": ["insert.title", "body.title", "update.title"],
|
|
15
|
+
"mutations": ["urldecode"],
|
|
16
|
+
"match": { "type": "inline_xss" }
|
|
17
|
+
}
|
|
18
|
+
]
|
|
19
|
+
}
|
|
20
|
+
],
|
|
21
|
+
"whitelists": []
|
|
22
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@patchstack/connect",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.9",
|
|
4
4
|
"description": "Patchstack connector for JavaScript applications. Scans your lockfile and reports installed packages to Patchstack for vulnerability monitoring.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"patchstack",
|
|
@@ -32,12 +32,13 @@
|
|
|
32
32
|
"LICENSE"
|
|
33
33
|
],
|
|
34
34
|
"scripts": {
|
|
35
|
-
"build": "tsup",
|
|
35
|
+
"build": "tsup && node scripts/copy-protect-templates.mjs",
|
|
36
36
|
"dev": "tsup --watch",
|
|
37
37
|
"test": "vitest run",
|
|
38
|
+
"test:manifest": "bun scripts/test-manifest.ts",
|
|
38
39
|
"test:watch": "vitest",
|
|
39
40
|
"typecheck": "tsc --noEmit",
|
|
40
|
-
"prepare": "
|
|
41
|
+
"prepare": "npm run build",
|
|
41
42
|
"prepublishOnly": "npm run typecheck && npm test && npm run build"
|
|
42
43
|
},
|
|
43
44
|
"engines": {
|