@riocrypto/common-server 1.0.1909 → 1.0.1911

package/build/helpers/send-with-xss-guard.js

@@ -5,30 +5,23 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sendWithXSSGuard = void 0;
 const xss_1 = __importDefault(require("xss"));
+const lodash_1 = __importDefault(require("lodash"));
 function sendWithXSSGuard(res, data, statusCode) {
-    const sanitize = (input, depth = 0) => {
-        const MAX_DEPTH = 1000;
-        if (depth > MAX_DEPTH) {
-            throw new Error("Maximum recursion depth exceeded");
+    const seen = new WeakSet();
+    const sanitizedData = lodash_1.default.cloneDeepWith(data, (value) => {
+        if (typeof value === "string") {
+            return (0, xss_1.default)(value);
         }
-        if (typeof input === "string") {
-            return (0, xss_1.default)(input);
-        }
-        else if (Array.isArray(input)) {
-            return input.map((item) => sanitize(item, depth + 1));
-        }
-        else if (typeof input === "object" && input !== null) {
-            const sanitizedObject = {};
-            for (const key in input) {
-                if (Object.prototype.hasOwnProperty.call(input, key)) {
-                    sanitizedObject[key] = sanitize(input[key], depth + 1);
-                }
+        if (typeof value === "object" && value !== null) {
+            if (seen.has(value)) {
+                // Handle circular references by returning the already processed object
+                return value;
             }
-            return sanitizedObject;
+            seen.add(value);
         }
-        return input;
-    };
-    const sanitizedData = sanitize(data);
+        // Returning undefined tells lodash to handle cloning this value
+        return undefined;
+    });
     res.status(statusCode).send(sanitizedData);
 }
 exports.sendWithXSSGuard = sendWithXSSGuard;

package/build/middlewares/verify-csrf-token.js

@@ -17,15 +17,15 @@ const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const secret_manager_client_1 = require("../clients/secret-manager-client");
 const common_1 = require("@riocrypto/common");
 const verifyCsrfToken = (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
-    const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
-    if (!CSRF_TOKEN_SECRET) {
-        throw new common_1.SecretManagerError();
-    }
     // Check for the presence of accessToken or adminAccessToken cookies
     const hasAccessToken = req.cookies.accessToken || req.cookies.adminAccessToken;
     // Only apply CSRF check if accessToken or adminAccessToken cookies are present
     if (hasAccessToken &&
         ["POST", "PUT", "PATCH", "DELETE"].includes(req.method.toUpperCase())) {
+        const CSRF_TOKEN_SECRET = yield secret_manager_client_1.secretManagerClient.getSecretValue("CSRF_TOKEN_SECRET");
+        if (!CSRF_TOKEN_SECRET) {
+            throw new common_1.SecretManagerError();
+        }
         // Retrieve CSRF token from the header
         const csrfToken = Array.isArray(req.headers["x-csrf-token"])
             ? req.headers["x-csrf-token"][0]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.1909",
+  "version": "1.0.1911",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -19,6 +19,7 @@
     "@types/csurf": "^1.11.5",
     "@types/he": "^1.2.0",
     "@types/jsonwebtoken": "^8.5.8",
+    "@types/lodash": "^4.17.12",
     "@types/uuid": "^9.0.1",
     "del-cli": "^5.0.0",
     "typescript": "^4.7.4"
@@ -38,6 +39,7 @@
     "googleapis": "^135.1.0",
     "he": "^1.2.0",
     "jsonwebtoken": "^9.0.1",
+    "lodash": "^4.17.21",
     "mongoose": "^8.0.0",
     "node-cache": "^5.1.2",
     "uuid": "^9.0.0",