@rapidrest/core 1.3.2 → 1.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/AlertUtils.js +7 -8
- package/dist/lib/AlertUtils.js.map +1 -1
- package/dist/lib/ClassLoader.js +7 -0
- package/dist/lib/ClassLoader.js.map +1 -1
- package/dist/lib/FileUtils.js +58 -79
- package/dist/lib/FileUtils.js.map +1 -1
- package/dist/lib/JWTUtils.js +26 -2
- package/dist/lib/JWTUtils.js.map +1 -1
- package/dist/lib/MessagingUtils.js +6 -3
- package/dist/lib/MessagingUtils.js.map +1 -1
- package/dist/lib/OASUtils.js +22 -1
- package/dist/lib/OASUtils.js.map +1 -1
- package/dist/lib/StringUtils.js +5 -2
- package/dist/lib/StringUtils.js.map +1 -1
- package/dist/lib/ValidationUtils.js +2 -2
- package/dist/lib/ValidationUtils.js.map +1 -1
- package/dist/types/FileUtils.d.ts +27 -9
- package/dist/types/JWTUtils.d.ts +9 -0
- package/dist/types/OASUtils.d.ts +17 -1
- package/package.json +1 -2
package/dist/lib/AlertUtils.js
CHANGED
|
@@ -3,9 +3,9 @@
|
|
|
3
3
|
///////////////////////////////////////////////////////////////////////////////
|
|
4
4
|
import axios from "axios";
|
|
5
5
|
import FormData from "form-data";
|
|
6
|
-
import handlebars from "handlebars";
|
|
7
6
|
import JSZip from "jszip";
|
|
8
7
|
import { sleep } from "./sleep.js";
|
|
8
|
+
import { StringUtils } from "./StringUtils.js";
|
|
9
9
|
const MAX_ATTEMPTS = 60;
|
|
10
10
|
const MAX_CHARS_ALIAS = 512;
|
|
11
11
|
const MAX_CHARS_DESCRIPTION = 15000;
|
|
@@ -122,14 +122,13 @@ export class AlertUtils {
|
|
|
122
122
|
}
|
|
123
123
|
alert.tags = tags;
|
|
124
124
|
}
|
|
125
|
-
//
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
alert.message =
|
|
125
|
+
// Perform variable substitution on the alert's text fields. Note: these fields are treated as plain
|
|
126
|
+
// data, never as a template to compile/execute, since `description`/`message`/`note` frequently
|
|
127
|
+
// originate from untrusted event or exception text and must not be interpretable as code.
|
|
128
|
+
alert.description = StringUtils.findAndReplace(alert.description, vars);
|
|
129
|
+
alert.message = StringUtils.findAndReplace(alert.message, vars);
|
|
130
130
|
if (alert.note) {
|
|
131
|
-
|
|
132
|
-
alert.note = template(vars);
|
|
131
|
+
alert.note = StringUtils.findAndReplace(alert.note, vars);
|
|
133
132
|
}
|
|
134
133
|
let response = await axios.post(this.serviceUrl, alert, {
|
|
135
134
|
headers: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AlertUtils.js","sourceRoot":"","sources":["../../src/AlertUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,OAAO,
|
|
1
|
+
{"version":3,"file":"AlertUtils.js","sourceRoot":"","sources":["../../src/AlertUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,YAAY,GAAW,EAAE,CAAC;AAChC,MAAM,eAAe,GAAW,GAAG,CAAC;AACpC,MAAM,qBAAqB,GAAW,KAAK,CAAC;AAC5C,MAAM,gBAAgB,GAAW,GAAG,CAAC;AACrC,MAAM,iBAAiB,GAAW,GAAG,CAAC;AACtC,MAAM,cAAc,GAAW,KAAK,CAAC;AACrC,MAAM,gBAAgB,GAAW,GAAG,CAAC;AACrC,MAAM,cAAc,GAAW,EAAE,CAAC;AAClC,MAAM,QAAQ,GAAW,EAAE,CAAC;AAE5B;;GAEG;AACH,MAAM,CAAN,IAAY,aAWX;AAXD,WAAY,aAAa;IACrB,0FAA0F;IAC1F,gCAAe,CAAA;IACf,kGAAkG;IAClG,8BAAa,CAAA;IACb,gGAAgG;IAChG,iCAAgB,CAAA;IAChB,gHAAgH;IAChH,+BAAc,CAAA;IACd,6GAA6G;IAC7G,8BAAa,CAAA;AACjB,CAAC,EAXW,aAAa,KAAb,aAAa,QAWxB;AA6ED;;;GAGG;AACH,MAAM,OAAO,UAAU;IAQnB;;;OAGG;IACH,YAAY,OAA0B;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,OAAmB,EAAE;QAChD,IAAI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,GAAG,GAAW,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,QAAQ,CAAC;YACrD,MAAM,QAAQ,GAAkB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;gBACxD,OAAO,EAAE;oBACL,aAAa,EAAE,IAAI,CAAC,IAAI;iBAC3B;aACJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,EAAU;QACvB,IAAI,CAAC;YACD,MAAM,GAAG,GAAW,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAkB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;gBACjD,OAAO,EAAE;oBACL,aAAa,EAAE,IAAI,CAAC,IAAI;iBAC3B;aACJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,IAAI,CAAC,KAAY,EAAE,OAAY,EAAE,EAAE,WAAyC;QACrF,IAAI,CAAC;YACD,6GAA6G;YAC7G,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACxD,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC/D,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,IAAI,GAAa,EAAE,CAAC;gBACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAW,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;gBAChD,CAAC;gBACD,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YACtB,CAAC;YAED,oGAAoG;YACpG,gGAAgG;YAChG,0FAA0F;YAC1F,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACxE,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,QAAQ,GAAkB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;gBACnE,OAAO,EAAE;oBACL,aAAa,EAAE,IAAI,CAAC,IAAI;iBAC3B;aACJ,CAAC,CAAC;YACH,MAAM,SAAS,GAAkB,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YAClH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,uCAAuC;YACvC,IAAI,EAAE,GAAkB,IAAI,CAAC;YAC7B,IAAI,KAAK,GAAW,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACD,MAAM,GAAG,GAAW,GAAG,IAAI,CAAC,UAAU,aAAa,SAAS,GAAG,CAAC;oBAChE,MAAM,QAAQ,GAAkB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;wBACjD,OAAO,EAAE;4BACL,aAAa,EAAE,IAAI,CAAC,IAAI;yBAC3B;qBACJ,CAAC,CAAC;oBACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAK,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;wBACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;4BACjD,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;wBAC/B,CAAC;oBACL,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAChB,wFAAwF;oBACxF,gCAAgC;oBAChC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC;gBAED,KAAK,EAAE,CAAC;YACZ,CAAC;YAED,mDAAmD;YACnD,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;gBACpB,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;oBAClB,4DAA4D;oBAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;oBACxB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;wBACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBACvC,CAAC;oBACD,MAAM,IAAI,GAAW,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrE,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE;wBACzB,WAAW,EAAE,iBAAiB;wBAC9B,IAAI;wBACJ,QAAQ,EAAE,GAAG,EAAE,MAAM;wBACrB,IAAI,EAAE,IAAI,CAAC,MAAM;qBACpB,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACJ,sCAAsC;oBACtC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;wBACnC,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;oBAC9D,CAAC;gBACL,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,UAA2B,EAAE,SAAkB;QAClF,IAAI,CAAC;YACD,MAAM,IAAI,GAAa,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,EAAE;gBACjC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,WAAW,EAAE,UAAU,CAAC,IAAI;aAC/B,CAAC,CAAC;YAEH,IAAI,GAAG,GAAW,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,cAAc,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACZ,GAAG,IAAI,aAAa,GAAG,SAAS,CAAC;YACrC,CAAC;YACD,MAAM,QAAQ,GAAkB,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;gBACxD,OAAO,EAAE;oBACL,aAAa,EAAE,IAAI,CAAC,IAAI;oBACxB,cAAc,EAAE,qBAAqB;iBACxC;aACJ,CAAC,CAAC;YAEH,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,yDAAyD;YACzD,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,+BAA+B,UAAU,CAAC,QAAQ,aAAa,EAAE,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;CACJ"}
|
package/dist/lib/ClassLoader.js
CHANGED
|
@@ -103,6 +103,13 @@ export class ClassLoader {
|
|
|
103
103
|
*/
|
|
104
104
|
async load(dir = "") {
|
|
105
105
|
let fqp = path.resolve(path.join(this.rootDir, dir));
|
|
106
|
+
// Ensure the resolved directory is still contained within rootDir. Prevents a caller-supplied `dir`
|
|
107
|
+
// (e.g. containing "../") from escaping rootDir and dynamically importing/executing arbitrary modules
|
|
108
|
+
// found elsewhere on disk.
|
|
109
|
+
const rel = path.relative(this.rootDir, fqp);
|
|
110
|
+
if (rel !== "" && (rel.startsWith("..") || path.isAbsolute(rel))) {
|
|
111
|
+
throw new Error(`Directory "${dir}" escapes the allowed root directory "${this.rootDir}".`);
|
|
112
|
+
}
|
|
106
113
|
let files = await fs.promises.readdir(fqp, { withFileTypes: true });
|
|
107
114
|
for (let file of files) {
|
|
108
115
|
// Is the file in the ignore list?
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ClassLoader.js","sourceRoot":"","sources":["../../src/ClassLoader.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,OAAO,WAAW;IAWpB;;;;;;;OAOG;IACH,YAAY,OAAe,EAAE,oBAA6B,IAAI,EAAE,oBAA6B,IAAI,EAAE,SAA8B,EAAE;QAlBnI,6CAA6C;QACnC,YAAO,GAAqB,IAAI,GAAG,EAAe,CAAC;QACnD,WAAM,GAAwB,EAAE,CAAC;QAC3C,wDAAwD;QAC9C,sBAAiB,GAAY,IAAI,CAAC;QAC5C,wDAAwD;QAC9C,sBAAiB,GAAY,IAAI,CAAC;QAC5C,qEAAqE;QAC3D,YAAO,GAAW,GAAG,CAAC;QAW5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,UAAU;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE;QAC9B,IAAI,GAAG,GAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"ClassLoader.js","sourceRoot":"","sources":["../../src/ClassLoader.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAClD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,OAAO,WAAW;IAWpB;;;;;;;OAOG;IACH,YAAY,OAAe,EAAE,oBAA6B,IAAI,EAAE,oBAA6B,IAAI,EAAE,SAA8B,EAAE;QAlBnI,6CAA6C;QACnC,YAAO,GAAqB,IAAI,GAAG,EAAe,CAAC;QACnD,WAAM,GAAwB,EAAE,CAAC;QAC3C,wDAAwD;QAC9C,sBAAiB,GAAY,IAAI,CAAC;QAC5C,wDAAwD;QAC9C,sBAAiB,GAAY,IAAI,CAAC;QAC5C,qEAAqE;QAC3D,YAAO,GAAW,GAAG,CAAC;QAW5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,UAAU;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACI,QAAQ,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE;QAC9B,IAAI,GAAG,GAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAE7D,oGAAoG;QACpG,sGAAsG;QACtG,2BAA2B;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,yCAAyC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,KAAK,GAAgB,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YACrB,kCAAkC;YAClC,IAAI,QAAQ,GAAY,KAAK,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM;gBACV,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACX,SAAS;YACb,CAAC;YAED,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;YAC1B,CAAC;YAED,IAAI,OAAO,GAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvD,IAAI,QAAQ,GAAW,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjF,IAAI,GAAG,GAAW,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAEjD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,MAAM,GAAW,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvE,MAAM,GAAG,GAAQ,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5D,IAAI,GAAG,EAAE,CAAC;oBACN,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;wBACnB,IAAI,KAAK,GAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,GAAG,GAAW,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC7G,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;wBAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACjC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,QAAQ,CAAC,CAAC;gBAC/D,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,CAAC,iBAAiB,IAAI,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC3E,MAAM,GAAG,GAAQ,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5D,IAAI,GAAG,EAAE,CAAC;oBACN,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;wBACnB,IAAI,KAAK,GAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC3B,IAAI,GAAG,GAAW,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC7G,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;wBAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBACjC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,QAAQ,CAAC,CAAC;gBAC/D,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}
|
package/dist/lib/FileUtils.js
CHANGED
|
@@ -1,13 +1,11 @@
|
|
|
1
1
|
///////////////////////////////////////////////////////////////////////////////
|
|
2
2
|
// Copyright (C) 2020-2026 Jean-Philippe Steinmetz
|
|
3
3
|
///////////////////////////////////////////////////////////////////////////////
|
|
4
|
-
import child_process from "child_process";
|
|
5
4
|
import fs from "fs";
|
|
6
5
|
import path from "path";
|
|
7
6
|
import { StringUtils } from "./StringUtils.js";
|
|
8
7
|
import { mkdirp } from "mkdirp";
|
|
9
8
|
import { Logger } from "./Logger.js";
|
|
10
|
-
import { createInterface } from "readline";
|
|
11
9
|
const logger = Logger();
|
|
12
10
|
/**
|
|
13
11
|
* Utility functions for working with files.
|
|
@@ -15,18 +13,40 @@ const logger = Logger();
|
|
|
15
13
|
*/
|
|
16
14
|
export class FileUtils {
|
|
17
15
|
/**
|
|
18
|
-
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
16
|
+
* Throws an error if the resolved `target` path is not contained within the resolved `rootDir` directory. Used
|
|
17
|
+
* to prevent path traversal (e.g. `../`) from escaping an intended root when a caller opts in by providing
|
|
18
|
+
* `rootDir`.
|
|
21
19
|
*
|
|
22
|
-
* @param {string}
|
|
20
|
+
* @param {string} rootDir The directory that `target` must be contained within.
|
|
21
|
+
* @param {string} target The fully resolved path to verify.
|
|
22
|
+
*/
|
|
23
|
+
static assertContained(rootDir, target) {
|
|
24
|
+
const rootResolved = path.resolve(rootDir);
|
|
25
|
+
const targetResolved = path.resolve(target);
|
|
26
|
+
const rel = path.relative(rootResolved, targetResolved);
|
|
27
|
+
if (rel !== "" && (rel.startsWith("..") || path.isAbsolute(rel))) {
|
|
28
|
+
throw new Error(`Path "${target}" escapes the allowed root directory "${rootResolved}".`);
|
|
29
|
+
}
|
|
30
|
+
}
|
|
31
|
+
/**
|
|
32
|
+
* Attempts to write the provided contents to the file path given. If a file already exists at the destination
|
|
33
|
+
* an error is thrown unless `overwrite` is set to `true`.
|
|
34
|
+
*
|
|
35
|
+
* @param {string} srcPath The baseline template file the contents were generated from.
|
|
23
36
|
* @param {string} outPath The destination file path to be written.
|
|
24
37
|
* @param {any} contents The contents of the file to write.
|
|
25
|
-
* @param {boolean} overwrite Set to `true` to
|
|
38
|
+
* @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
|
|
39
|
+
* @param {string} rootDir Optional. When provided, `srcPath` and `outPath` must both resolve to a location
|
|
40
|
+
* contained within this directory, otherwise an error is thrown. Callers that pass externally-influenced paths
|
|
41
|
+
* should always supply this to prevent path traversal.
|
|
26
42
|
*/
|
|
27
|
-
static async writeFile(srcPath, outPath, contents, overwrite = false) {
|
|
43
|
+
static async writeFile(srcPath, outPath, contents, overwrite = false, rootDir) {
|
|
28
44
|
let srcPathFull = path.resolve(srcPath);
|
|
29
45
|
let outPathFull = path.resolve(outPath);
|
|
46
|
+
if (rootDir) {
|
|
47
|
+
FileUtils.assertContained(rootDir, srcPathFull);
|
|
48
|
+
FileUtils.assertContained(rootDir, outPathFull);
|
|
49
|
+
}
|
|
30
50
|
let fileExists = fs.existsSync(outPathFull);
|
|
31
51
|
// Make sure the path leading to the final destination exists
|
|
32
52
|
let outDirPath = path.dirname(outPath);
|
|
@@ -34,71 +54,11 @@ export class FileUtils {
|
|
|
34
54
|
await mkdirp(outDirPath);
|
|
35
55
|
}
|
|
36
56
|
if (fileExists && !overwrite) {
|
|
37
|
-
|
|
38
|
-
let invalidResponse = false;
|
|
39
|
-
while (invalidResponse) {
|
|
40
|
-
let response = await new Promise((resolve, reject) => {
|
|
41
|
-
const rl = createInterface({
|
|
42
|
-
input: process.stdin,
|
|
43
|
-
output: process.stdout
|
|
44
|
-
});
|
|
45
|
-
rl.question("Overwrite existing file: " + outPath + "? [Y]es, [N]o, [M]erge: ", (answer) => {
|
|
46
|
-
rl.close();
|
|
47
|
-
resolve(answer);
|
|
48
|
-
});
|
|
49
|
-
});
|
|
50
|
-
response = response.toLocaleLowerCase();
|
|
51
|
-
if (response.length > 0) {
|
|
52
|
-
if (response[0] === "y" || response[0] === "n" || response[0] === "m") {
|
|
53
|
-
if (response[0] === "n") {
|
|
54
|
-
// Immediately exit, no point in continuing
|
|
55
|
-
return;
|
|
56
|
-
}
|
|
57
|
-
overwrite = response[0] === "y";
|
|
58
|
-
}
|
|
59
|
-
else {
|
|
60
|
-
logger.info("Invalid input: " + response);
|
|
61
|
-
}
|
|
62
|
-
}
|
|
63
|
-
else {
|
|
64
|
-
logger.info("Invalid input: " + response);
|
|
65
|
-
}
|
|
66
|
-
}
|
|
67
|
-
}
|
|
68
|
-
if (!fileExists || overwrite) {
|
|
69
|
-
// Write the final output to disk
|
|
70
|
-
logger.info("Writing: " + outPathFull);
|
|
71
|
-
fs.writeFileSync(outPathFull, contents);
|
|
72
|
-
}
|
|
73
|
-
else {
|
|
74
|
-
// Attempt to merge the results
|
|
75
|
-
let tmpPath = path.resolve(outPathFull + ".new");
|
|
76
|
-
fs.writeFileSync(tmpPath, contents);
|
|
77
|
-
// Attempt to merge the updated version of the file with the original.
|
|
78
|
-
let mergedPath = path.resolve(outPathFull + ".merged");
|
|
79
|
-
let success = true;
|
|
80
|
-
try {
|
|
81
|
-
let { stdout, stderr } = child_process.exec("kdiff3 " +
|
|
82
|
-
srcPathFull +
|
|
83
|
-
" " +
|
|
84
|
-
outPathFull +
|
|
85
|
-
" " +
|
|
86
|
-
tmpPath +
|
|
87
|
-
' -m --auto --cs "ShowInfoDialogs=0" --cs "LineEndStyle=0" -o ' +
|
|
88
|
-
mergedPath);
|
|
89
|
-
}
|
|
90
|
-
catch (err) {
|
|
91
|
-
success = false;
|
|
92
|
-
}
|
|
93
|
-
// Read back in the newly merged file so we can replace write a new generated date
|
|
94
|
-
let merged = fs.readFileSync(mergedPath, "utf-8");
|
|
95
|
-
merged = merged.replace(new RegExp("^// Last Generated.*$", "g"), "// Last Generated: " + new Date());
|
|
96
|
-
// Write the merged copy to the final destination and clean up temporary files
|
|
97
|
-
logger.info("Writing: " + outPathFull);
|
|
98
|
-
fs.writeFileSync(outPathFull, merged);
|
|
99
|
-
fs.unlinkSync(mergedPath);
|
|
100
|
-
fs.unlinkSync(tmpPath);
|
|
57
|
+
throw new Error(`File already exists at "${outPathFull}". Pass overwrite=true to replace it.`);
|
|
101
58
|
}
|
|
59
|
+
// Write the final output to disk
|
|
60
|
+
logger.info("Writing: " + outPathFull);
|
|
61
|
+
fs.writeFileSync(outPathFull, contents);
|
|
102
62
|
}
|
|
103
63
|
/**
|
|
104
64
|
* Generates a copy of the source file at the desired output destination and performs a swap of all values of the
|
|
@@ -107,9 +67,15 @@ export class FileUtils {
|
|
|
107
67
|
* @param {string} srcPath The source file to copy.
|
|
108
68
|
* @param {string} outPath The destination file to generate.
|
|
109
69
|
* @param {any} variables The map of variable names to values to swap.
|
|
70
|
+
* @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
|
|
71
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
72
|
+
* within this directory, otherwise an error is thrown.
|
|
110
73
|
*/
|
|
111
|
-
static async copyFile(srcPath, outPath, variables = {}, overwrite = false) {
|
|
74
|
+
static async copyFile(srcPath, outPath, variables = {}, overwrite = false, rootDir) {
|
|
112
75
|
let srcPathFull = path.resolve(srcPath);
|
|
76
|
+
if (rootDir) {
|
|
77
|
+
FileUtils.assertContained(rootDir, srcPathFull);
|
|
78
|
+
}
|
|
113
79
|
if (!fs.existsSync(srcPathFull)) {
|
|
114
80
|
throw new Error("File does not exist: " + srcPathFull);
|
|
115
81
|
}
|
|
@@ -123,7 +89,7 @@ export class FileUtils {
|
|
|
123
89
|
let output = StringUtils.findAndReplace(template, variables);
|
|
124
90
|
let outPathFinal = path.resolve(StringUtils.findAndReplace(outPath, variables));
|
|
125
91
|
logger.info("Writing: " + outPathFinal);
|
|
126
|
-
await FileUtils.writeFile(srcPath, outPathFinal, output, overwrite);
|
|
92
|
+
await FileUtils.writeFile(srcPath, outPathFinal, output, overwrite, rootDir);
|
|
127
93
|
}
|
|
128
94
|
else {
|
|
129
95
|
throw new Error("Failed to read file: " + srcPathFull);
|
|
@@ -135,9 +101,14 @@ export class FileUtils {
|
|
|
135
101
|
* @param {string} srcPath The source file to copy.
|
|
136
102
|
* @param {string} outPath The destination file to generate.
|
|
137
103
|
* @param {Map<string,string>} variables The map of variable names to values to swap. Applies to outPath only.
|
|
104
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
105
|
+
* within this directory, otherwise an error is thrown.
|
|
138
106
|
*/
|
|
139
|
-
static async copyBinaryFile(srcPath, outPath, variables = {}) {
|
|
107
|
+
static async copyBinaryFile(srcPath, outPath, variables = {}, rootDir) {
|
|
140
108
|
let srcPathFull = path.resolve(srcPath);
|
|
109
|
+
if (rootDir) {
|
|
110
|
+
FileUtils.assertContained(rootDir, srcPathFull);
|
|
111
|
+
}
|
|
141
112
|
if (!fs.existsSync(srcPathFull)) {
|
|
142
113
|
throw new Error("File does not exist: " + srcPathFull);
|
|
143
114
|
}
|
|
@@ -147,6 +118,9 @@ export class FileUtils {
|
|
|
147
118
|
await mkdirp(outDirPath);
|
|
148
119
|
}
|
|
149
120
|
let outPathFinal = path.resolve(StringUtils.findAndReplace(outPath, variables));
|
|
121
|
+
if (rootDir) {
|
|
122
|
+
FileUtils.assertContained(rootDir, outPathFinal);
|
|
123
|
+
}
|
|
150
124
|
fs.copyFileSync(srcPathFull, outPathFinal);
|
|
151
125
|
}
|
|
152
126
|
/**
|
|
@@ -159,9 +133,14 @@ export class FileUtils {
|
|
|
159
133
|
* @param {array} excludeFilters The list of file extension filters to exclude during the copy process.
|
|
160
134
|
* @param {array} binaryFilters The list of file extension filters to copy as binary only.
|
|
161
135
|
* @param {boolean} force Set to `true` to force writing over any existing files.
|
|
136
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
137
|
+
* within this directory, otherwise an error is thrown.
|
|
162
138
|
*/
|
|
163
|
-
static async copyDirectory(srcPath, outPath, vars = {}, excludeFilters = [], binaryFilters = [], force = false) {
|
|
139
|
+
static async copyDirectory(srcPath, outPath, vars = {}, excludeFilters = [], binaryFilters = [], force = false, rootDir) {
|
|
164
140
|
const templatePath = path.resolve(srcPath);
|
|
141
|
+
if (rootDir) {
|
|
142
|
+
FileUtils.assertContained(rootDir, templatePath);
|
|
143
|
+
}
|
|
165
144
|
let files = fs.readdirSync(templatePath, { withFileTypes: true });
|
|
166
145
|
files.forEach(async (file) => {
|
|
167
146
|
let extension = path.extname(file.name);
|
|
@@ -175,13 +154,13 @@ export class FileUtils {
|
|
|
175
154
|
if (!fs.existsSync(destPath)) {
|
|
176
155
|
fs.mkdirSync(destPath);
|
|
177
156
|
}
|
|
178
|
-
await FileUtils.copyDirectory(path.join(templatePath, file.name), destPath, vars, excludeFilters, binaryFilters, force);
|
|
157
|
+
await FileUtils.copyDirectory(path.join(templatePath, file.name), destPath, vars, excludeFilters, binaryFilters, force, rootDir);
|
|
179
158
|
}
|
|
180
159
|
else if (binaryFilters.indexOf(extension) >= 0) {
|
|
181
|
-
await FileUtils.copyBinaryFile(path.join(templatePath, file.name), destPath, vars);
|
|
160
|
+
await FileUtils.copyBinaryFile(path.join(templatePath, file.name), destPath, vars, rootDir);
|
|
182
161
|
}
|
|
183
162
|
else {
|
|
184
|
-
await FileUtils.copyFile(path.join(templatePath, file.name), destPath, vars, force);
|
|
163
|
+
await FileUtils.copyFile(path.join(templatePath, file.name), destPath, vars, force, rootDir);
|
|
185
164
|
}
|
|
186
165
|
}
|
|
187
166
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"FileUtils.js","sourceRoot":"","sources":["../../src/FileUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,
|
|
1
|
+
{"version":3,"file":"FileUtils.js","sourceRoot":"","sources":["../../src/FileUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB;;;GAGG;AACF,MAAM,OAAO,SAAS;IACnB;;;;;;;OAOG;IACK,MAAM,CAAC,eAAe,CAAC,OAAe,EAAE,MAAc;QAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,yCAAyC,YAAY,IAAI,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CACzB,OAAe,EACf,OAAe,EACf,QAAa,EACb,YAAqB,KAAK,EAC1B,OAAgB;QAEhB,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE5C,6DAA6D;QAC7D,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACX,2BAA2B,WAAW,uCAAuC,CAChF,CAAC;QACN,CAAC;QAED,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,QAAQ,CACxB,OAAe,EACf,OAAe,EACf,YAAiB,EAAE,EACnB,YAAqB,KAAK,EAC1B,OAAgB;QAEhB,IAAI,WAAW,GAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC;QAC3D,CAAC;QAED,6DAA6D;QAC7D,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACX,IAAI,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7D,IAAI,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;YACxC,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,OAAe,EAAE,YAAiB,EAAE,EAAE,OAAgB;QACtG,IAAI,WAAW,GAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC;QAC3D,CAAC;QAED,6DAA6D;QAC7D,IAAI,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,YAAY,GAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAExF,IAAI,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACrD,CAAC;QAED,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAC7B,OAAe,EACf,OAAe,EACf,OAAY,EAAE,EACd,iBAAgC,EAAE,EAClC,gBAA+B,EAAE,EACjC,QAAiB,KAAK,EACtB,OAAgB;QAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,CAAC;YACV,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAS,EAAE,EAAE;YAC9B,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;YAC1B,CAAC;YACD,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3C,IAAI,QAAQ,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBAE/E,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACrB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC3B,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBAC3B,CAAC;oBACD,MAAM,SAAS,CAAC,aAAa,CACzB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAClC,QAAQ,EACR,IAAI,EACJ,cAAc,EACd,aAAa,EACb,KAAK,EACL,OAAO,CACV,CAAC;gBACN,CAAC;qBAAM,IAAI,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAChG,CAAC;qBAAM,CAAC;oBACJ,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjG,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;CACJ"}
|
package/dist/lib/JWTUtils.js
CHANGED
|
@@ -18,6 +18,22 @@ export var JWTUtilsCompressionMethods;
|
|
|
18
18
|
* @author Jean-Philippe Steinmetz <rapidrests@gmail.com>
|
|
19
19
|
*/
|
|
20
20
|
export class JWTUtils {
|
|
21
|
+
/**
|
|
22
|
+
* Throws if `config.secret` looks like an asymmetric (RSA/EC) key but `config.options.algorithms` was not
|
|
23
|
+
* explicitly restricted. Signing/verifying with an asymmetric key while leaving `algorithms` unset opens the
|
|
24
|
+
* door to algorithm-confusion attacks (e.g. an attacker forging an HS256 token using the public key as the
|
|
25
|
+
* HMAC secret). HMAC secrets (plain strings/buffers that aren't PEM-encoded) are unaffected.
|
|
26
|
+
*
|
|
27
|
+
* @param config The JWT configuration to validate.
|
|
28
|
+
*/
|
|
29
|
+
static assertSafeAlgorithm(config) {
|
|
30
|
+
const secret = config.secret;
|
|
31
|
+
const looksAsymmetric = typeof secret === "string" && /-----BEGIN [A-Z ]*(PRIVATE|PUBLIC) KEY-----/.test(secret);
|
|
32
|
+
if (looksAsymmetric && (!config.options?.algorithms || config.options.algorithms.length === 0)) {
|
|
33
|
+
throw new Error("config.secret appears to be an asymmetric key. config.options.algorithms must be explicitly set " +
|
|
34
|
+
"(e.g. ['RS256']) to prevent algorithm-confusion attacks.");
|
|
35
|
+
}
|
|
36
|
+
}
|
|
21
37
|
/**
|
|
22
38
|
* Generates a new JWT token for the given config and user object. The user object must be a valid RapidREST
|
|
23
39
|
* user.
|
|
@@ -47,7 +63,9 @@ export class JWTUtils {
|
|
|
47
63
|
if (!user || !user.uid) {
|
|
48
64
|
throw new Error("Invalid or null user object provided.");
|
|
49
65
|
}
|
|
50
|
-
|
|
66
|
+
// `data` is spread before `profile` so that a `profile` key present in caller-supplied `data` can never
|
|
67
|
+
// silently override the authoritative, server-derived user profile before signing.
|
|
68
|
+
let payload = { ...data, profile: JSON.stringify(user) };
|
|
51
69
|
// Encrypt the profile if desired
|
|
52
70
|
if (config.payload && config.payload.encrypt) {
|
|
53
71
|
const payloadOptions = config.payload;
|
|
@@ -76,6 +94,7 @@ export class JWTUtils {
|
|
|
76
94
|
payload.compression = "zlib";
|
|
77
95
|
}
|
|
78
96
|
}
|
|
97
|
+
JWTUtils.assertSafeAlgorithm(config);
|
|
79
98
|
return jwt.sign(payload, config.secret, config.options);
|
|
80
99
|
}
|
|
81
100
|
static createTokenSync(config, user, data) {
|
|
@@ -87,7 +106,9 @@ export class JWTUtils {
|
|
|
87
106
|
if (!user || !user.uid) {
|
|
88
107
|
throw new Error("Invalid or null user object provided.");
|
|
89
108
|
}
|
|
90
|
-
|
|
109
|
+
// `data` is spread before `profile` so that a `profile` key present in caller-supplied `data` can never
|
|
110
|
+
// silently override the authoritative, server-derived user profile before signing.
|
|
111
|
+
let payload = { ...data, profile: JSON.stringify(user) };
|
|
91
112
|
// Encrypt the profile if desired
|
|
92
113
|
if (config.payload && config.payload.encrypt) {
|
|
93
114
|
const payloadOptions = config.payload;
|
|
@@ -116,6 +137,7 @@ export class JWTUtils {
|
|
|
116
137
|
payload.compression = "zlib";
|
|
117
138
|
}
|
|
118
139
|
}
|
|
140
|
+
JWTUtils.assertSafeAlgorithm(config);
|
|
119
141
|
return jwt.sign(payload, config.secret, config.options);
|
|
120
142
|
}
|
|
121
143
|
/**
|
|
@@ -127,6 +149,7 @@ export class JWTUtils {
|
|
|
127
149
|
* @returns The data encoded in the token's payload.
|
|
128
150
|
*/
|
|
129
151
|
static async decodeToken(config, token) {
|
|
152
|
+
JWTUtils.assertSafeAlgorithm(config);
|
|
130
153
|
// Decode the token
|
|
131
154
|
let payload = jwt.verify(token, config.secret, config.options);
|
|
132
155
|
// Validate the payload
|
|
@@ -171,6 +194,7 @@ export class JWTUtils {
|
|
|
171
194
|
* @returns The data encoded in the token's payload.
|
|
172
195
|
*/
|
|
173
196
|
static decodeTokenSync(config, token) {
|
|
197
|
+
JWTUtils.assertSafeAlgorithm(config);
|
|
174
198
|
// Decode the token
|
|
175
199
|
let payload = jwt.verify(token, config.secret, config.options);
|
|
176
200
|
// Validate the payload
|
package/dist/lib/JWTUtils.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"JWTUtils.js","sourceRoot":"","sources":["../../src/JWTUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AA8CxB;;GAEG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAClC,wCAAwC;IACxC,2CAAa,CAAA;AACjB,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAkFD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAGjB;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAY;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CACtF,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAY;QACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC7E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,GAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,
|
|
1
|
+
{"version":3,"file":"JWTUtils.js","sourceRoot":"","sources":["../../src/JWTUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AA8CxB;;GAEG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAClC,wCAAwC;IACxC,2CAAa,CAAA;AACjB,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAkFD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAGjB;;;;;;;OAOG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAsB;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,eAAe,GACjB,OAAO,MAAM,KAAK,QAAQ,IAAI,6CAA6C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7F,IAAI,eAAe,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CACX,kGAAkG;gBAC9F,0DAA0D,CACjE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAY;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CACtF,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAY;QACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC7E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,wGAAwG;QACxG,mFAAmF;QACnF,IAAI,OAAO,GAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAE9D,iCAAiC;QACjC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAElE,IAAI,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;YACjC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC3E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,wGAAwG;QACxG,mFAAmF;QACnF,IAAI,OAAO,GAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAE9D,iCAAiC;QACjC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAElE,IAAI,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;YACjC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,KAAa;QACjE,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,mBAAmB;QACnB,IAAI,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,uBAAuB;QACvB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAEtE,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAChC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,KAAa;QAC/D,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,mBAAmB;QACnB,IAAI,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,uBAAuB;QACvB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAEtE,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAChC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC;IACnB,CAAC;;AApPc,wBAAe,GAAG,IAAI,GAAG,EAAE,CAAC"}
|
|
@@ -144,10 +144,12 @@ export class MessagingUtils {
|
|
|
144
144
|
this.logger?.warn("Unable to send email missing from.email in message template");
|
|
145
145
|
return undefined;
|
|
146
146
|
}
|
|
147
|
+
// `options` is spread before the protected fields below so a caller cannot use it to override the
|
|
148
|
+
// configured sender or the rendered message contents (e.g. spoofed `from`, injected `bcc`).
|
|
147
149
|
const result = await this._transporter.sendMail({
|
|
148
|
-
from: this.templates.from.email,
|
|
149
150
|
...tplConfig.email_options,
|
|
150
151
|
...options,
|
|
152
|
+
from: this.templates.from.email,
|
|
151
153
|
subject,
|
|
152
154
|
text: message,
|
|
153
155
|
html: htmlMessage,
|
|
@@ -198,11 +200,12 @@ export class MessagingUtils {
|
|
|
198
200
|
}
|
|
199
201
|
// Render using cached compiled delegate
|
|
200
202
|
const message = this._compiledTemplates.get(`${templateName}:sms`)(templateVars);
|
|
201
|
-
// Send the message to the user
|
|
203
|
+
// Send the message to the user. `options` is spread before the protected fields below so a caller cannot
|
|
204
|
+
// use it to override the configured sender or the rendered message body.
|
|
202
205
|
const result = await this.twilio.messages.create({
|
|
203
|
-
from: this.templates.from.sms,
|
|
204
206
|
...tplConfig.sms_options,
|
|
205
207
|
...options,
|
|
208
|
+
from: this.templates.from.sms,
|
|
206
209
|
body: message,
|
|
207
210
|
});
|
|
208
211
|
return result;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"MessagingUtils.js","sourceRoot":"","sources":["../../src/MessagingUtils.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,MAAM,IAAI,CAAC;AAkEpB;;GAEG;AACH,MAAM,OAAO,cAAc;IAA3B;QACc,cAAS,GAAU,EAAE,CAAC;QAEtB,iBAAY,GAAU,EAAE,CAAC;QAK3B,iBAAY,GAAQ,IAAI,CAAC;QAEzB,cAAS,GAAgB,EAAS,CAAC;QAO3C,gFAAgF;QACxE,uBAAkB,GAA6C,IAAI,GAAG,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"MessagingUtils.js","sourceRoot":"","sources":["../../src/MessagingUtils.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,MAAM,IAAI,CAAC;AAkEpB;;GAEG;AACH,MAAM,OAAO,cAAc;IAA3B;QACc,cAAS,GAAU,EAAE,CAAC;QAEtB,iBAAY,GAAU,EAAE,CAAC;QAK3B,iBAAY,GAAQ,IAAI,CAAC;QAEzB,cAAS,GAAgB,EAAS,CAAC;QAO3C,gFAAgF;QACxE,uBAAkB,GAA6C,IAAI,GAAG,EAAE,CAAC;IAiNrF,CAAC;IA9MgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;oBAC1C,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;wBACnD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAChE,CAAC;oBAED,MAAM,GAAG,GAAQ,IAAI,GAAG,CAAC;wBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;wBACxB,aAAa,EAAE,WAAW,CAAC,aAAa;qBAC3C,CAAC,CAAC;oBACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,CAAC;gBACD,MAAM,UAAU,GAAQ,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnD,IAAI,CAAC,UAAU,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBACpF,CAAC;gBAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAChE,CAAC;gBAED,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBAC1D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBAC5D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBAC9D,CAAC;gBAED,MAAM,MAAM,GAAQ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC3D,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,YAAY,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,SAAS,GAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,qEAAqE;QACrE,IAAI,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,qEAAqE;QACrE,IAAI,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;QAExB,2DAA2D;QAC3D,IAAI,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpG,IAAI,SAAS,CAAC,IAAI;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpG,IAAI,SAAS,CAAC,OAAO;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7G,IAAI,SAAS,CAAC,GAAG;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACjG,IAAI,SAAS,CAAC,UAAU;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAEtH,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,YAAiB,EAAE,UAAe,EAAE;QAC7E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,SAAS,GAAa,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,yCAAyC;QACzC,MAAM,OAAO,GAAkB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QAC3G,MAAM,WAAW,GAAkB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QAC/G,MAAM,OAAO,GAAW,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,YAAY,UAAU,CAAE,CAAC,YAAY,CAAC,CAAC;QAE9F,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,UAAU,GAAQ,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpE,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACjF,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,kGAAkG;QAClG,4FAA4F;QAC5F,MAAM,MAAM,GAAQ,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YACjD,GAAG,SAAS,CAAC,aAAa;YAC1B,GAAG,OAAO;YACV,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK;YAC/B,OAAO;YACP,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;SACpB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,YAAiB;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,SAAS,GAAa,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,wCAAwC;QACxC,MAAM,OAAO,GAAW,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,YAAY,aAAa,CAAE,CAAC,YAAY,CAAC,CAAC;QAEjG,MAAM,MAAM,GAAU,EAAE,CAAC;QACzB,gDAAgD;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAQ,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC/C,OAAO,EAAE,SAAS,CAAC,aAAa;gBAChC,IAAI,EAAE,OAAO;aAChB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,YAAiB,EAAE,UAAe,EAAE;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,SAAS,GAAa,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,wCAAwC;QACxC,MAAM,OAAO,GAAW,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,YAAY,MAAM,CAAE,CAAC,YAAY,CAAC,CAAC;QAE1F,yGAAyG;QACzG,yEAAyE;QACzE,MAAM,MAAM,GAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAClD,GAAG,SAAS,CAAC,WAAW;YACxB,GAAG,OAAO;YACV,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;YAC7B,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAhOa;IADT,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;;oDACe;AAE3B;IADP,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC;;kDACI;AAGxB;IADP,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;;oDACU;AAEzB;IADP,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;;iDACmB;AAEnC;IADP,MAAM;;8CACc;AASR;IADZ,IAAI;;;;0CA2DJ"}
|
package/dist/lib/OASUtils.js
CHANGED
|
@@ -158,13 +158,34 @@ export class OASUtils {
|
|
|
158
158
|
/**
|
|
159
159
|
* Attempts to load the Open API specification at the given path or URL.
|
|
160
160
|
*
|
|
161
|
+
* **Security note**: `file` is used directly for local file access and outbound HTTP requests. If `file` may
|
|
162
|
+
* ever originate from an external or untrusted caller (e.g. a request parameter), pass `options.allowedDirs`
|
|
163
|
+
* and/or `options.allowedHosts` to restrict what can be loaded and prevent path traversal or SSRF.
|
|
164
|
+
*
|
|
161
165
|
* @param {string} file The path or URL of the OpenAPI Specification file to load.
|
|
166
|
+
* @param {LoadSpecOptions} options Optional restrictions on what `file` is permitted to resolve to.
|
|
162
167
|
* @returns {Promise<any>} A promise whose result will be the loaded OpenAPI Specification as an object.
|
|
163
168
|
*/
|
|
164
|
-
static async loadSpec(file) {
|
|
169
|
+
static async loadSpec(file, options) {
|
|
165
170
|
if (_specCache.has(file)) {
|
|
166
171
|
return _specCache.get(file);
|
|
167
172
|
}
|
|
173
|
+
if (options?.allowedDirs && fs.existsSync(file)) {
|
|
174
|
+
const resolved = path.resolve(file);
|
|
175
|
+
const allowed = options.allowedDirs.some(dir => {
|
|
176
|
+
const rel = path.relative(path.resolve(dir), resolved);
|
|
177
|
+
return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
|
|
178
|
+
});
|
|
179
|
+
if (!allowed) {
|
|
180
|
+
throw new Error(`File "${file}" is not within an allowed directory.`);
|
|
181
|
+
}
|
|
182
|
+
}
|
|
183
|
+
if (options?.allowedHosts && _urlRegex.test(file)) {
|
|
184
|
+
const hostname = new URL(file).hostname;
|
|
185
|
+
if (!options.allowedHosts.includes(hostname)) {
|
|
186
|
+
throw new Error(`Host "${hostname}" is not an allowed host.`);
|
|
187
|
+
}
|
|
188
|
+
}
|
|
168
189
|
let apiSpec = null;
|
|
169
190
|
if (fs.existsSync(file)) {
|
|
170
191
|
let fileType = path.extname(file);
|
package/dist/lib/OASUtils.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"OASUtils.js","sourceRoot":"","sources":["../../src/OASUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,iGAAiG;AACjG,MAAM,UAAU,GAAqB,IAAI,GAAG,EAAE,CAAC;AAE/C,MAAM,SAAS,GAAG,oCAAoC,CAAC;
|
|
1
|
+
{"version":3,"file":"OASUtils.js","sourceRoot":"","sources":["../../src/OASUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;AAExB,iGAAiG;AACjG,MAAM,UAAU,GAAqB,IAAI,GAAG,EAAE,CAAC;AAE/C,MAAM,SAAS,GAAG,oCAAoC,CAAC;AAcvD,MAAM,OAAO,QAAQ;IACjB;;;;;;OAMG;IACI,MAAM,CAAC,YAAY,CAAC,IAAS,EAAE,IAAY;QAC9C,IAAI,MAAM,GAAQ,SAAS,CAAC;QAE5B,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,SAAS,CAAC,IAAS,EAAE,IAAY;QAC3C,IAAI,MAAM,GAAQ,IAAI,CAAC;QAEvB,IAAI,IAAI,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClB,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,KAAK,GAAa,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBACjB,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACP,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,SAAS,CAAC;QACvB,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,WAAW,CAAC,GAAQ;QAC9B,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAChB,KAAK,IAAI,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACpB,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;wBACrC,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;oBACjC,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,kBAAkB,CAAC,GAAQ;QACrC,IAAI,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,SAAS,CAAC,IAAS,EAAE,IAAY;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,qGAAqG;QACrG,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/E,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,WAAW,CAAC,SAAc,EAAE,IAAS,EAAE,eAAyB;QAC1E,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,MAAM,GAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACpE,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpB,IAAI,OAAO,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC/D,IAAI,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;oBACxC,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACtF,CAAC;qBAAM,CAAC;oBACJ,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;gBACvC,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACrB,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC1B,IAAI,OAAO,GAAQ,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;wBACrE,IAAI,OAAO,EAAE,CAAC;4BACV,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;4BAC9C,MAAM,CAAC,OAAO,GAAG,eAAe,CAC5B,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,EACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CACrC,CAAC;4BACF,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;wBAC3D,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACJ,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;wBACvC,MAAM,CAAC,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC/E,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC3D,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACnD,CAAC;YACL,CAAC;iBAAM,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC;gBACrB,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;gBACjC,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;gBAChE,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC;gBACnC,CAAC;YACL,CAAC;YAED,OAAO,MAAM,CAAC;QAClB,CAAC;aAAM,CAAC;YACJ,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAyB;QAChE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACvD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,uCAAuC,CAAC,CAAC;YAC1E,CAAC;QACL,CAAC;QAED,IAAI,OAAO,EAAE,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,2BAA2B,CAAC,CAAC;YAClE,CAAC;QACL,CAAC;QAED,IAAI,OAAO,GAAQ,IAAI,CAAC;QAExB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,IAAI,GAAW,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAEjD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;gBACrC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;gBACrC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,QAAQ,CAAC,CAAC;YAC1D,CAAC;QACL,CAAC;aAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAU,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAQ,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAC,CAAC;oBAClC,yDAAyD;oBACzD,IAAI,CAAC;wBACD,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACvC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACX,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;oBAC5B,CAAC;gBACL,CAAC;qBAAM,IAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1C,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACJ,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5D,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;YAC/C,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,iFAAiF;IAC1E,MAAM,CAAC,cAAc;QACxB,UAAU,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACJ"}
|
package/dist/lib/StringUtils.js
CHANGED
|
@@ -43,10 +43,13 @@ export class StringUtils {
|
|
|
43
43
|
*/
|
|
44
44
|
static findAndReplace(contents, variables) {
|
|
45
45
|
let output = contents;
|
|
46
|
-
// Pre-compile one regex per key (O(n)) rather than creating new RegExp inside nested loops (O(n²))
|
|
46
|
+
// Pre-compile one regex per key (O(n)) rather than creating new RegExp inside nested loops (O(n²)).
|
|
47
|
+
// The key is escaped since it may contain regex metacharacters (e.g. from external input), which could
|
|
48
|
+
// otherwise be used for regex injection or catastrophic backtracking (ReDoS).
|
|
47
49
|
const regexCache = new Map();
|
|
48
50
|
for (const key in variables) {
|
|
49
|
-
|
|
51
|
+
const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
52
|
+
regexCache.set(key, new RegExp("(\\{\\{" + escapedKey + "\\}\\})", "g"));
|
|
50
53
|
}
|
|
51
54
|
// Go through all variables and perform replacement
|
|
52
55
|
for (const key in variables) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"StringUtils.js","sourceRoot":"","sources":["../../src/StringUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACpB;;;;;;OAMG;IACI,MAAM,CAAC,aAAa,CAAC,GAAW;QACnC,IAAI,OAAO,GAAkB,IAAI,KAAK,EAAE,CAAC;QAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC,GAAG,GAAG,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACJ,MAAM;gBACV,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM;YACV,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,SAAc;QACzD,IAAI,MAAM,GAAW,QAAQ,CAAC;QAE9B,
|
|
1
|
+
{"version":3,"file":"StringUtils.js","sourceRoot":"","sources":["../../src/StringUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACpB;;;;;;OAMG;IACI,MAAM,CAAC,aAAa,CAAC,GAAW;QACnC,IAAI,OAAO,GAAkB,IAAI,KAAK,EAAE,CAAC;QAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC5C,CAAC,GAAG,GAAG,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACJ,MAAM;gBACV,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM;YACV,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAAC,QAAgB,EAAE,SAAc;QACzD,IAAI,MAAM,GAAW,QAAQ,CAAC;QAE9B,oGAAoG;QACpG,uGAAuG;QACvG,8EAA8E;QAC9E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9D,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,UAAU,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,mDAAmD;QACnD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC1B,6FAA6F;YAC7F,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,IAAI,KAAK,GAAW,SAAS,CAAC,GAAG,CAAW,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,EAAE,SAAS,CAAC,IAAI,CAAW,CAAC,CAAC;oBACvF,CAAC;gBACL,CAAC;gBAED,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW,EAAE,KAAsB,EAAE,MAAc;QACxE,qGAAqG;QACrG,MAAM,MAAM,GACR,OAAO,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,CAAC,MAAM;gBACZ,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,YAAY,CAAC,GAAW;QAClC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;CACJ"}
|
|
@@ -69,8 +69,8 @@ export class ValidationUtils {
|
|
|
69
69
|
* Validates that the provided string matches the regexp pattern /[a-zA-Z0-9_\-\.@:\+]+/.
|
|
70
70
|
*/
|
|
71
71
|
static checkName(val) {
|
|
72
|
-
if (
|
|
73
|
-
throw new Error("Value is not a name matching pattern
|
|
72
|
+
if (!/^[a-zA-Z0-9_\-.@:+]+$/.test(val)) {
|
|
73
|
+
throw new Error("Value is not a name matching pattern /^[a-zA-Z0-9_\-\.@:\+]+$/");
|
|
74
74
|
}
|
|
75
75
|
return val;
|
|
76
76
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ValidationUtils.js","sourceRoot":"","sources":["../../src/ValidationUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;GAEG;AACH,MAAM,OAAO,eAAe;IACxB;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAe;QACpC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,GAAW;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"ValidationUtils.js","sourceRoot":"","sources":["../../src/ValidationUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,SAAS,MAAM,WAAW,CAAC;AAOlC;;GAEG;AACH,MAAM,OAAO,eAAe;IACxB;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,GAAQ,EAAE,IAAiB;QAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAe;QACpC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,GAAW;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAQ;QAC5B,IAAI,OAAO,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,UAAU,CAAC,GAAW;QAChC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,GAAW;QACjC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ,CAAC,GAAW;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,SAAS,CAAC,GAAW;QAC/B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,GAAQ;QAC/B,MAAM,GAAG,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;CACJ"}
|
|
@@ -4,16 +4,27 @@
|
|
|
4
4
|
*/
|
|
5
5
|
export declare class FileUtils {
|
|
6
6
|
/**
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
7
|
+
* Throws an error if the resolved `target` path is not contained within the resolved `rootDir` directory. Used
|
|
8
|
+
* to prevent path traversal (e.g. `../`) from escaping an intended root when a caller opts in by providing
|
|
9
|
+
* `rootDir`.
|
|
10
10
|
*
|
|
11
|
-
* @param {string}
|
|
11
|
+
* @param {string} rootDir The directory that `target` must be contained within.
|
|
12
|
+
* @param {string} target The fully resolved path to verify.
|
|
13
|
+
*/
|
|
14
|
+
private static assertContained;
|
|
15
|
+
/**
|
|
16
|
+
* Attempts to write the provided contents to the file path given. If a file already exists at the destination
|
|
17
|
+
* an error is thrown unless `overwrite` is set to `true`.
|
|
18
|
+
*
|
|
19
|
+
* @param {string} srcPath The baseline template file the contents were generated from.
|
|
12
20
|
* @param {string} outPath The destination file path to be written.
|
|
13
21
|
* @param {any} contents The contents of the file to write.
|
|
14
|
-
* @param {boolean} overwrite Set to `true` to
|
|
22
|
+
* @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
|
|
23
|
+
* @param {string} rootDir Optional. When provided, `srcPath` and `outPath` must both resolve to a location
|
|
24
|
+
* contained within this directory, otherwise an error is thrown. Callers that pass externally-influenced paths
|
|
25
|
+
* should always supply this to prevent path traversal.
|
|
15
26
|
*/
|
|
16
|
-
static writeFile(srcPath: string, outPath: string, contents: any, overwrite?: boolean): Promise<void>;
|
|
27
|
+
static writeFile(srcPath: string, outPath: string, contents: any, overwrite?: boolean, rootDir?: string): Promise<void>;
|
|
17
28
|
/**
|
|
18
29
|
* Generates a copy of the source file at the desired output destination and performs a swap of all values of the
|
|
19
30
|
* variables specified.
|
|
@@ -21,16 +32,21 @@ export declare class FileUtils {
|
|
|
21
32
|
* @param {string} srcPath The source file to copy.
|
|
22
33
|
* @param {string} outPath The destination file to generate.
|
|
23
34
|
* @param {any} variables The map of variable names to values to swap.
|
|
35
|
+
* @param {boolean} overwrite Set to `true` to overwrite an existing file at `outPath`.
|
|
36
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
37
|
+
* within this directory, otherwise an error is thrown.
|
|
24
38
|
*/
|
|
25
|
-
static copyFile(srcPath: string, outPath: string, variables?: any, overwrite?: boolean): Promise<void>;
|
|
39
|
+
static copyFile(srcPath: string, outPath: string, variables?: any, overwrite?: boolean, rootDir?: string): Promise<void>;
|
|
26
40
|
/**
|
|
27
41
|
* Generates a copy of the source file at the desired output destination using binary copy mode.
|
|
28
42
|
*
|
|
29
43
|
* @param {string} srcPath The source file to copy.
|
|
30
44
|
* @param {string} outPath The destination file to generate.
|
|
31
45
|
* @param {Map<string,string>} variables The map of variable names to values to swap. Applies to outPath only.
|
|
46
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
47
|
+
* within this directory, otherwise an error is thrown.
|
|
32
48
|
*/
|
|
33
|
-
static copyBinaryFile(srcPath: string, outPath: string, variables?: any): Promise<void>;
|
|
49
|
+
static copyBinaryFile(srcPath: string, outPath: string, variables?: any, rootDir?: string): Promise<void>;
|
|
34
50
|
/**
|
|
35
51
|
* Performs a deep copy of a directory tree at the given srcPath to the specified output directory. Performs
|
|
36
52
|
* template replacement for all variables given and skips any files in the specified filter.
|
|
@@ -41,6 +57,8 @@ export declare class FileUtils {
|
|
|
41
57
|
* @param {array} excludeFilters The list of file extension filters to exclude during the copy process.
|
|
42
58
|
* @param {array} binaryFilters The list of file extension filters to copy as binary only.
|
|
43
59
|
* @param {boolean} force Set to `true` to force writing over any existing files.
|
|
60
|
+
* @param {string} rootDir Optional. When provided, all resolved source and destination paths must be contained
|
|
61
|
+
* within this directory, otherwise an error is thrown.
|
|
44
62
|
*/
|
|
45
|
-
static copyDirectory(srcPath: string, outPath: string, vars?: any, excludeFilters?: Array<string>, binaryFilters?: Array<string>, force?: boolean): Promise<void>;
|
|
63
|
+
static copyDirectory(srcPath: string, outPath: string, vars?: any, excludeFilters?: Array<string>, binaryFilters?: Array<string>, force?: boolean, rootDir?: string): Promise<void>;
|
|
46
64
|
}
|
package/dist/types/JWTUtils.d.ts
CHANGED
|
@@ -119,6 +119,15 @@ export interface JWTUtilsConfig {
|
|
|
119
119
|
*/
|
|
120
120
|
export declare class JWTUtils {
|
|
121
121
|
private static _parsedKeyCache;
|
|
122
|
+
/**
|
|
123
|
+
* Throws if `config.secret` looks like an asymmetric (RSA/EC) key but `config.options.algorithms` was not
|
|
124
|
+
* explicitly restricted. Signing/verifying with an asymmetric key while leaving `algorithms` unset opens the
|
|
125
|
+
* door to algorithm-confusion attacks (e.g. an attacker forging an HS256 token using the public key as the
|
|
126
|
+
* HMAC secret). HMAC secrets (plain strings/buffers that aren't PEM-encoded) are unaffected.
|
|
127
|
+
*
|
|
128
|
+
* @param config The JWT configuration to validate.
|
|
129
|
+
*/
|
|
130
|
+
private static assertSafeAlgorithm;
|
|
122
131
|
/**
|
|
123
132
|
* Generates a new JWT token for the given config and user object. The user object must be a valid RapidREST
|
|
124
133
|
* user.
|
package/dist/types/OASUtils.d.ts
CHANGED
|
@@ -1,3 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Options that restrict where `OASUtils.loadSpec` is permitted to load a specification from. Intended for callers
|
|
3
|
+
* that accept a spec path/URL from an external or untrusted source (e.g. a request parameter), to prevent path
|
|
4
|
+
* traversal (arbitrary local file read) and SSRF (requests to arbitrary/internal hosts).
|
|
5
|
+
*/
|
|
6
|
+
export interface LoadSpecOptions {
|
|
7
|
+
/** If set, `file` must resolve to a path contained within one of these directories. */
|
|
8
|
+
allowedDirs?: string[];
|
|
9
|
+
/** If set, a `file` given as a URL must have a hostname contained in this list. */
|
|
10
|
+
allowedHosts?: string[];
|
|
11
|
+
}
|
|
1
12
|
export declare class OASUtils {
|
|
2
13
|
/**
|
|
3
14
|
* Gets the datastore definition with the specified name.
|
|
@@ -47,10 +58,15 @@ export declare class OASUtils {
|
|
|
47
58
|
/**
|
|
48
59
|
* Attempts to load the Open API specification at the given path or URL.
|
|
49
60
|
*
|
|
61
|
+
* **Security note**: `file` is used directly for local file access and outbound HTTP requests. If `file` may
|
|
62
|
+
* ever originate from an external or untrusted caller (e.g. a request parameter), pass `options.allowedDirs`
|
|
63
|
+
* and/or `options.allowedHosts` to restrict what can be loaded and prevent path traversal or SSRF.
|
|
64
|
+
*
|
|
50
65
|
* @param {string} file The path or URL of the OpenAPI Specification file to load.
|
|
66
|
+
* @param {LoadSpecOptions} options Optional restrictions on what `file` is permitted to resolve to.
|
|
51
67
|
* @returns {Promise<any>} A promise whose result will be the loaded OpenAPI Specification as an object.
|
|
52
68
|
*/
|
|
53
|
-
static loadSpec(file: string): Promise<any>;
|
|
69
|
+
static loadSpec(file: string, options?: LoadSpecOptions): Promise<any>;
|
|
54
70
|
/** Clears the spec parse cache. Useful in tests to force re-loading of specs. */
|
|
55
71
|
static clearSpecCache(): void;
|
|
56
72
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@rapidrest/core",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.4.0",
|
|
4
4
|
"description": "A collection of common utilities and core functionality for rapidly building RESTful applications.",
|
|
5
5
|
"repository": "https://github.com/rapidrest/core.git",
|
|
6
6
|
"author": "RapidREST <rapidrests@gmail.com>",
|
|
@@ -28,7 +28,6 @@
|
|
|
28
28
|
"jsonwebtoken": "^9.0.3",
|
|
29
29
|
"jszip": "^3.10.1",
|
|
30
30
|
"mkdirp": "^3.0.1",
|
|
31
|
-
"readline": "^1.3.0",
|
|
32
31
|
"triple-beam": "^1.4.1",
|
|
33
32
|
"uuid": "^14.0.0",
|
|
34
33
|
"validator": "^13.15.35"
|