@rapidrest/core 1.3.1 → 1.4.0

package/dist/lib/StringUtils.js

@@ -43,10 +43,13 @@ export class StringUtils {
      */
     static findAndReplace(contents, variables) {
         let output = contents;
-        // Pre-compile one regex per key (O(n)) rather than creating new RegExp inside nested loops (O(n²))
+        // Pre-compile one regex per key (O(n)) rather than creating new RegExp inside nested loops (O(n²)).
+        // The key is escaped since it may contain regex metacharacters (e.g. from external input), which could
+        // otherwise be used for regex injection or catastrophic backtracking (ReDoS).
         const regexCache = new Map();
         for (const key in variables) {
-            regexCache.set(key, new RegExp("(\\{\\{" + key + "\\}\\})", "g"));
+            const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            regexCache.set(key, new RegExp("(\\{\\{" + escapedKey + "\\}\\})", "g"));
         }
         // Go through all variables and perform replacement
         for (const key in variables) {
@@ -67,11 +70,11 @@ export class StringUtils {
      * Replaces all instances of the match regex pattern with the contents of the inner regular expression pattern for
      * the given string.
      *
-     * e.g.
-     *
+     * @example
+     * ```ts
      * let result = replaceAll('/my/path/{id}', new RegExp('\\{([^\\}]+)\\}'), ':');
      * console.log(result); // -> /my/path/:id
-     *
+     * ```
      * @param {string} str The string to perform replacement on.
      * @param {RegExp} match The regular expression pattern to match containing an outer and inner pattern.
      * @param {string} prefix The prefix to prepend the replacement text with.

package/dist/lib/StringUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"StringUtils.js","sourceRoot":"","sources":["../../src/StringUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACpB;;;;;;OAMG;IACI,MAAM,CAAC,aAAa,CAAC,GAAW;QACnC,IAAI,OAAO,GAAkB,IAAI,KAAK,EAAE,CAAC;QAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC,GAAG,GAAG,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACJ,MAAM;gBACV,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM;YACV,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,SAAc;QACzD,IAAI,MAAM,GAAW,QAAQ,CAAC;QAE9B,mGAAmG;QACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,CAAC;QAED,mDAAmD;QACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,6FAA6F;YAC7F,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,IAAI,KAAK,GAAW,SAAS,CAAC,GAAG,CAAW,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,SAAS,CAAC,IAAI,CAAW,CAAC,CAAC;oBACvF,CAAC;gBACL,CAAC;gBAED,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW,EAAE,KAAsB,EAAE,MAAc;QACxE,qGAAqG;QACrG,MAAM,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,MAAM;gBACZ,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,GAAW;QAClC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;CACJ"}
+{"version":3,"file":"StringUtils.js","sourceRoot":"","sources":["../../src/StringUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACpB;;;;;;OAMG;IACI,MAAM,CAAC,aAAa,CAAC,GAAW;QACnC,IAAI,OAAO,GAAkB,IAAI,KAAK,EAAE,CAAC;QAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC,GAAG,GAAG,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACJ,MAAM;gBACV,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM;YACV,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,SAAc;QACzD,IAAI,MAAM,GAAW,QAAQ,CAAC;QAE9B,oGAAoG;QACpG,uGAAuG;QACvG,8EAA8E;QAC9E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9D,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,mDAAmD;QACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,6FAA6F;YAC7F,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,IAAI,KAAK,GAAW,SAAS,CAAC,GAAG,CAAW,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,SAAS,CAAC,IAAI,CAAW,CAAC,CAAC;oBACvF,CAAC;gBACL,CAAC;gBAED,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW,EAAE,KAAsB,EAAE,MAAc;QACxE,qGAAqG;QACrG,MAAM,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,MAAM;gBACZ,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,GAAW;QAClC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;CACJ"}

package/dist/lib/ValidationUtils.js

@@ -69,8 +69,8 @@ export class ValidationUtils {
      * Validates that the provided string matches the regexp pattern /[a-zA-Z0-9_\-\.@:\+]+/.
      */
     static checkName(val) {
-        if (!/[a-zA-Z0-9_\-]+/.test(val)) {
-            throw new Error("Value is not a name matching pattern /[a-zA-Z0-9_\-\.@:\+]+/");
+        if (!/^[a-zA-Z0-9_\-.@:+]+$/.test(val)) {
+            throw new Error("Value is not a name matching pattern /^[a-zA-Z0-9_\-\.@:\+]+$/");
         }
         return val;
     }

package/dist/lib/ValidationUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"ValidationUtils.js","sourceRoot":"","sources":["../../src/ValidationUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;GAEG;AACH,MAAM,OAAO,eAAe;IACxB;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAe;QACpC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,GAAW;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAQ;QAC5B,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ,CAAC,GAAW;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,GAAQ;QAC/B,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;CACJ"}
+{"version":3,"file":"ValidationUtils.js","sourceRoot":"","sources":["../../src/ValidationUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;GAEG;AACH,MAAM,OAAO,eAAe;IACxB;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAe;QACpC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,GAAW;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAQ;QAC5B,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ,CAAC,GAAW;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,GAAQ;QAC/B,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;CACJ"}

package/dist/types/FileUtils.d.ts

@@ -4,16 +4,27 @@
  */
 export declare class FileUtils {
     /**
-     * Attempts to write the provided contents to the file path given. If a file already exists the user is prompted to
-     * allow the file to be overwritten or merged. In the case of a merge, srcPath is used as a baseline in order to
-     * perform a 3-way merge.
+     * Throws an error if the resolved `target` path is not contained within the resolved `rootDir` directory. Used
+     * to prevent path traversal (e.g. `../`) from escaping an intended root when a caller opts in by providing
+     * `rootDir`.
      *
-     * @param {string} srcPath The baseline template file to use during a merge.
+     * @param {string} rootDir The directory that `target` must be contained within.
+     * @param {string} target The fully resolved path to verify.
+     */
+    private static assertContained;
+    /**
+     * Attempts to write the provided contents to the file path given. If a file already exists at the destination
+     * an error is thrown unless `overwrite` is set to `true`.
+     *
+     * @param {string} srcPath The baseline template file the contents were generated from.
      * @param {string} outPath The destination file path to be written.
      * @param {any} contents The contents of the file to write.
-     * @param {boolean} overwrite Set to `true` to overwite the file and not perform a merge.
+     * @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
+     * @param {string} rootDir Optional. When provided, `srcPath` and `outPath` must both resolve to a location
+     * contained within this directory, otherwise an error is thrown. Callers that pass externally-influenced paths
+     * should always supply this to prevent path traversal.
      */
-    static writeFile(srcPath: string, outPath: string, contents: any, overwrite?: boolean): Promise<void>;
+    static writeFile(srcPath: string, outPath: string, contents: any, overwrite?: boolean, rootDir?: string): Promise<void>;
     /**
      * Generates a copy of the source file at the desired output destination and performs a swap of all values of the
      * variables specified.
@@ -21,16 +32,21 @@ export declare class FileUtils {
      * @param {string} srcPath The source file to copy.
      * @param {string} outPath The destination file to generate.
      * @param {any} variables The map of variable names to values to swap.
+     * @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
+     * @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
+     * within this directory, otherwise an error is thrown.
      */
-    static copyFile(srcPath: string, outPath: string, variables?: any, overwrite?: boolean): Promise<void>;
+    static copyFile(srcPath: string, outPath: string, variables?: any, overwrite?: boolean, rootDir?: string): Promise<void>;
     /**
      * Generates a copy of the source file at the desired output destination using binary copy mode.
      *
      * @param {string} srcPath The source file to copy.
      * @param {string} outPath The destination file to generate.
      * @param {Map<string,string>} variables The map of variable names to values to swap. Applies to outPath only.
+     * @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
+     * within this directory, otherwise an error is thrown.
      */
-    static copyBinaryFile(srcPath: string, outPath: string, variables?: any): Promise<void>;
+    static copyBinaryFile(srcPath: string, outPath: string, variables?: any, rootDir?: string): Promise<void>;
     /**
      * Performs a deep copy of a directory tree at the given srcPath to the specified output directory. Performs
      * template replacement for all variables given and skips any files in the specified filter.
@@ -41,6 +57,8 @@ export declare class FileUtils {
      * @param {array} excludeFilters The list of file extension filters to exclude during the copy process.
      * @param {array} binaryFilters The list of file extension filters to copy as binary only.
      * @param {boolean} force Set to `true` to force writing over any existing files.
+     * @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
+     * within this directory, otherwise an error is thrown.
      */
-    static copyDirectory(srcPath: string, outPath: string, vars?: any, excludeFilters?: Array<string>, binaryFilters?: Array<string>, force?: boolean): Promise<void>;
+    static copyDirectory(srcPath: string, outPath: string, vars?: any, excludeFilters?: Array<string>, binaryFilters?: Array<string>, force?: boolean, rootDir?: string): Promise<void>;
 }

package/dist/types/JWTUtils.d.ts

@@ -119,6 +119,15 @@ export interface JWTUtilsConfig {
  */
 export declare class JWTUtils {
     private static _parsedKeyCache;
+    /**
+     * Throws if `config.secret` looks like an asymmetric (RSA/EC) key but `config.options.algorithms` was not
+     * explicitly restricted. Signing/verifying with an asymmetric key while leaving `algorithms` unset opens the
+     * door to algorithm-confusion attacks (e.g. an attacker forging an HS256 token using the public key as the
+     * HMAC secret). HMAC secrets (plain strings/buffers that aren't PEM-encoded) are unaffected.
+     *
+     * @param config The JWT configuration to validate.
+     */
+    private static assertSafeAlgorithm;
     /**
      * Generates a new JWT token for the given config and user object. The user object must be a valid RapidREST
      * user.

package/dist/types/OASUtils.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Options that restrict where `OASUtils.loadSpec` is permitted to load a specification from. Intended for callers
+ * that accept a spec path/URL from an external or untrusted source (e.g. a request parameter), to prevent path
+ * traversal (arbitrary local file read) and SSRF (requests to arbitrary/internal hosts).
+ */
+export interface LoadSpecOptions {
+    /** If set, `file` must resolve to a path contained within one of these directories. */
+    allowedDirs?: string[];
+    /** If set, a `file` given as a URL must have a hostname contained in this list. */
+    allowedHosts?: string[];
+}
 export declare class OASUtils {
     /**
      * Gets the datastore definition with the specified name.
@@ -47,10 +58,15 @@ export declare class OASUtils {
     /**
      * Attempts to load the Open API specification at the given path or URL.
      *
+     * **Security note**: `file` is used directly for local file access and outbound HTTP requests. If `file` may
+     * ever originate from an external or untrusted caller (e.g. a request parameter), pass `options.allowedDirs`
+     * and/or `options.allowedHosts` to restrict what can be loaded and prevent path traversal or SSRF.
+     *
      * @param {string} file The path or URL of the OpenAPI Specification file to load.
+     * @param {LoadSpecOptions} options Optional restrictions on what `file` is permitted to resolve to.
      * @returns {Promise<any>} A promise whose result will be the loaded OpenAPI Specification as an object.
      */
-    static loadSpec(file: string): Promise<any>;
+    static loadSpec(file: string, options?: LoadSpecOptions): Promise<any>;
     /** Clears the spec parse cache. Useful in tests to force re-loading of specs. */
     static clearSpecCache(): void;
 }

package/dist/types/StringUtils.d.ts

@@ -24,11 +24,11 @@ export declare class StringUtils {
      * Replaces all instances of the match regex pattern with the contents of the inner regular expression pattern for
      * the given string.
      *
-     * e.g.
-     *
+     * @example
+     * ```ts
      * let result = replaceAll('/my/path/{id}', new RegExp('\\{([^\\}]+)\\}'), ':');
      * console.log(result); // -> /my/path/:id
-     *
+     * ```
      * @param {string} str The string to perform replacement on.
      * @param {RegExp} match The regular expression pattern to match containing an outer and inner pattern.
      * @param {string} prefix The prefix to prepend the replacement text with.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rapidrest/core",
-    "version": "1.3.1",
+    "version": "1.4.0",
     "description": "A collection of common utilities and core functionality for rapidly building RESTful applications.",
     "repository": "https://github.com/rapidrest/core.git",
     "author": "RapidREST <rapidrests@gmail.com>",
@@ -12,8 +12,6 @@
     ],
     "scripts": {
         "build": "yarn lint && rimraf dist && tsc",
-        "deploy-docs": "ts-node tools/gh-pages-publish",
-        "docs": "typedoc --plugin typedoc-plugin-markdown --out docs/reference src",
         "lint": "eslint ./src ./test",
         "local-audit": "yarn install && yarn npm audit -A -R \"$@\"",
         "checkup": "yarn dlx @yarnpkg/doctor \"$@\"",
@@ -30,7 +28,6 @@
         "jsonwebtoken": "^9.0.3",
         "jszip": "^3.10.1",
         "mkdirp": "^3.0.1",
-        "readline": "^1.3.0",
         "triple-beam": "^1.4.1",
         "uuid": "^14.0.0",
         "validator": "^13.15.35"
@@ -69,8 +66,6 @@
         "rimraf": "^6.1.3",
         "ts-node": "^10.9.2",
         "twilio": "^6.0.2",
-        "typedoc": "^0.28.19",
-        "typedoc-plugin-markdown": "^4.12.0",
         "typescript": "^6.0.3",
         "vitest": "^4.1.8",
         "winston": "^3.19.0",
@@ -90,7 +85,6 @@
     "type": "module",
     "typings": "dist/types/index.d.ts",
     "files": [
-        "dist",
-        "docs"
+        "dist"
     ]
 }

package/docs/Makefile

@@ -1,20 +0,0 @@
-# Minimal makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line, and also
-# from the environment for the first two.
-SPHINXOPTS    ?=
-SPHINXBUILD   ?= sphinx-build
-SOURCEDIR     = .
-BUILDDIR      = _build
-
-# Put it first so that "make" without argument is like "make help".
-help:
-	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
-
-.PHONY: help Makefile
-
-# Catch-all target: route all unknown targets to Sphinx using the new
-# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
-%: Makefile
-	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

package/docs/conf.py

@@ -1,58 +0,0 @@
-# Configuration file for the Sphinx documentation builder.
-#
-# This file only contains a selection of the most common options. For a full
-# list see the documentation:
-# https://www.sphinx-doc.org/en/master/usage/configuration.html
-
-# -- Path setup --------------------------------------------------------------
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-#
-# import os
-# import sys
-# sys.path.insert(0, os.path.abspath('.'))
-import recommonmark
-from recommonmark.transform import AutoStructify
-
-source_suffix = ['.rst', '.md']
-
-# -- Project information -----------------------------------------------------
-
-project = 'RapidREST: Core Library'
-copyright = 'Jean-Philippe Steinmetz. All rights reserved.'
-author = 'RapidREST <rapidrests@gmail.com>'
-
-# -- General configuration ---------------------------------------------------
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-# ones.
-extensions = [
-    'recommonmark',
-    'sphinx.ext.autodoc',
-]
-
-# List of patterns, relative to source directory, that match files and
-# directories to ignore when looking for source files.
-# This pattern also affects html_static_path and html_extra_path.
-exclude_patterns = []
-
-master_doc = 'index'
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-html_static_path = ['_static']
-
-# app setup hook
-def setup(app):
-    app.add_config_value('recommonmark_config', {
-        'auto_toc_tree_section': 'Contents',
-        'enable_math': False,
-        'enable_inline_math': False,
-        'enable_eval_rst': True,
-        'enable_auto_doc_ref': True,
-    }, True)
-    app.add_transform(AutoStructify)

package/docs/index.rst

@@ -1,17 +0,0 @@
-===============================================================================
-RapidREST: Core Library
-===============================================================================
-
-Repository: ``git@github.com:rapidrest/core.git``
-
-A collection of common utilities and core functionality for rapidly building RESTful applications.
-
-.. toctree::
-   :caption: Project Info
-
-   ../README
-   
-.. toctree::
-   :caption: API Reference
-   
-   reference/globals

package/docs/make.bat

@@ -1,35 +0,0 @@
-@ECHO OFF
-
-pushd %~dp0
-
-REM Command file for Sphinx documentation
-
-if "%SPHINXBUILD%" == "" (
-	set SPHINXBUILD=sphinx-build
-)
-set SOURCEDIR=.
-set BUILDDIR=_build
-
-if "%1" == "" goto help
-
-%SPHINXBUILD% >NUL 2>NUL
-if errorlevel 9009 (
-	echo.
-	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
-	echo.installed, then set the SPHINXBUILD environment variable to point
-	echo.to the full path of the 'sphinx-build' executable. Alternatively you
-	echo.may add the Sphinx directory to PATH.
-	echo.
-	echo.If you don't have Sphinx installed, grab it from
-	echo.http://sphinx-doc.org/
-	exit /b 1
-)
-
-%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
-goto end
-
-:help
-%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% %O%
-
-:end
-popd

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/README.md

@@ -1,21 +0,0 @@
-[**@rapidrest/core**](../../../README.md)
-
-***
-
-[@rapidrest/core](../../../globals.md) / ObjectDecorators
-
-# ObjectDecorators
-
-## Type Aliases
-
-- [ValidatorFunction](type-aliases/ValidatorFunction.md)
-
-## Functions
-
-- [Config](functions/Config.md)
-- [Destroy](functions/Destroy.md)
-- [Init](functions/Init.md)
-- [Inject](functions/Inject.md)
-- [Logger](functions/Logger.md)
-- [Nullable](functions/Nullable.md)
-- [Validator](functions/Validator.md)

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Config.md

@@ -1,33 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Config
-
-# Function: Config()
-
-> **Config**(`path?`, `defaultValue?`): (`target`, `propertyKey`) => `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:61](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L61)
-
-Apply this to a property to have a configuration variable be injected at instantiation. If no path is given, the
-global configuration object is injected.
-
-## Parameters
-
-### path?
-
-`string`
-
-The path to the configuration variable to inject.
-
-### defaultValue?
-
-`any` = `undefined`
-
-Set to the desired default value. If `undefined` is specified then an error is thrown if
-no config variable is found at the given path.
-
-## Returns
-
-(`target`, `propertyKey`) => `void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Destroy.md

@@ -1,27 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Destroy
-
-# Function: Destroy()
-
-> **Destroy**(`target`, `propertyKey`): `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:10](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L10)
-
-Apply this to a class function to mark it as a destructor to be called by the `ObjectFactory` during cleanup.
-
-## Parameters
-
-### target
-
-`any`
-
-### propertyKey
-
-`string`
-
-## Returns
-
-`void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Init.md

@@ -1,33 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Init
-
-# Function: Init()
-
-> **Init**(`target`, `propertyKey`, `descriptor`): `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:49](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L49)
-
-Apply this to a function to be executed once a new object instance has been created and all dependencies injected.
-Note: If the decorated function returns a Promise it is not gauranteed to finish execution before the object is
-returned during the instantiation process.
-
-## Parameters
-
-### target
-
-`any`
-
-### propertyKey
-
-`string`
-
-### descriptor
-
-`PropertyDescriptor`
-
-## Returns
-
-`void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Inject.md

@@ -1,33 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Inject
-
-# Function: Inject()
-
-> **Inject**(`type`, `options?`): (`target`, `propertyKey`) => `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:21](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L21)
-
-Injects an object instance to the decorated property of the given name and type using the provided arguments
-if no object has been created yet.
-
-## Parameters
-
-### type
-
-`any`
-
-The fully qualified name or type of the class to instantiate. If a type is given it's class name will be inferred
-via the constructor name.
-
-### options?
-
-[`InstanceOptions`](../../../../interfaces/InstanceOptions.md)
-
-The set of options to use when creating new instances of the injected class type.
-
-## Returns
-
-(`target`, `propertyKey`) => `void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Logger.md

@@ -1,27 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Logger
-
-# Function: Logger()
-
-> **Logger**(`target`, `propertyKey`): `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:77](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L77)
-
-Apply this to a property to have the logger utility injected at instantiation.
-
-## Parameters
-
-### target
-
-`any`
-
-### propertyKey
-
-`string` \| `symbol`
-
-## Returns
-
-`void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Nullable.md

@@ -1,27 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Nullable
-
-# Function: Nullable()
-
-> **Nullable**(`target`, `propertyKey`): `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:90](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L90)
-
-Apply this to a property to indicate that the value can be `null` or `undefined.`
-
-## Parameters
-
-### target
-
-`any`
-
-### propertyKey
-
-`string` \| `symbol`
-
-## Returns
-
-`void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/functions/Validator.md

@@ -1,25 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / Validator
-
-# Function: Validator()
-
-> **Validator**(`func`): (`target`, `propertyKey`) => `void`
-
-Defined in: [src/decorators/ObjectDecorators.ts:108](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L108)
-
-Apply this to a property to specify the function that will be used to perform validation of the value.
-
-## Parameters
-
-### func
-
-[`ValidatorFunction`](../type-aliases/ValidatorFunction.md)
-
-The validation function to use for the given property.
-
-## Returns
-
-(`target`, `propertyKey`) => `void`

package/docs/reference/@rapidrest/namespaces/ObjectDecorators/type-aliases/ValidatorFunction.md

@@ -1,31 +0,0 @@
-[**@rapidrest/core**](../../../../README.md)
-
-***
-
-[@rapidrest/core](../../../../globals.md) / [ObjectDecorators](../README.md) / ValidatorFunction
-
-# Type Alias: ValidatorFunction
-
-> **ValidatorFunction** = (`value`) => `any`
-
-Defined in: [src/decorators/ObjectDecorators.ts:101](https://github.com/rapidrest/core/blob/a4c031c9927a28230ae2f4bc0d881f4d5a54cdeb/src/decorators/ObjectDecorators.ts#L101)
-
-A function used to validate a property value.
-
-## Parameters
-
-### value
-
-`any`
-
-The value to validate.
-
-## Returns
-
-`any`
-
-The validated value to assign to the property.
-
-## Throws
-
-An exception if the value cannot be validated.