@sasjs/utils 3.6.4 → 3.6.5

package/.git-hooks/pre-commit

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# Scan staged changes for secrets before anything else runs.
+# The binary is pinned by the @nogoo9/gitleaks devDependency and lands
+# in node_modules/.bin after npm i. Commits are blocked until it is
+# installed so no clone silently skips the secrets scan.
+gitleaks_bin=node_modules/.bin/gitleaks
+
+if [ ! -x "$gitleaks_bin" ]; then
+    echo "❌ gitleaks not found - run 'npm i' to install it"
+    exit 1
+fi
+
+if ! "$gitleaks_bin" protect --staged --redact; then
+    echo "❌ gitleaks detected a potential secret in your staged changes"
+    echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
+    exit 1
+fi
+
+# Avoid commits to the main branch
+BRANCH=`git rev-parse --abbrev-ref HEAD`
+
+if [[ "$BRANCH" =~ ^(master|main|develop)$ ]]; then
+  echo "You are on branch $BRANCH. Are you sure you want to commit to this branch?"
+  echo "If so, commit with -n to bypass the pre-commit hook."
+  exit 1
+fi

package/package.json

@@ -39,7 +39,8 @@
     "test": "jest --config=jest.config.js --coverage",
     "lint:fix": "npx prettier --write \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
     "lint": "npx prettier --check \"{src,test}/**/*.{ts,tsx,js,jsx,html,css,sass,less,json,yml,md,graphql}\"",
-    "semantic-release": "semantic-release"
+    "semantic-release": "semantic-release",
+    "setup": "git config core.hooksPath ./.git-hooks"
   },
   "repository": {
     "type": "git",
@@ -64,7 +65,8 @@
     "ts-jest": "29.4.14",
     "ts-loader": "9.6.2",
     "ts-node": "10.9.2",
-    "typescript": "4.5.4"
+    "typescript": "4.5.4",
+    "@nogoo9/gitleaks": "8.30.1-post.2"
   },
   "dependencies": {
     "@fast-csv/format": "4.3.5",
@@ -77,5 +79,5 @@
     "jwt-decode": "3.1.2",
     "prompts": "2.4.2"
   },
-  "version": "3.6.4"
+  "version": "3.6.5"
 }

package/utils/url.d.ts

@@ -1,3 +1,14 @@
 export declare const urlOrigin: (str: string) => string;
+/**
+ * The literal prefix is checked as well as the parsed protocol, because the URL
+ * parser normalises a backslash to a forward slash for special schemes:
+ * `new URL('http:\\server')` yields `http://server`. `valid-url`, which these
+ * replaced, required the literal prefix and so rejected such input.
+ *
+ * The prefix comparison is case-insensitive: the parser lowercases the scheme,
+ * so `HTTP://example.com` is a usable URL, and `valid-url` compared the scheme
+ * case-insensitively too. A backslash still fails, since it is not a slash in
+ * either case.
+ */
 export declare const isHttpUri: (str: string) => boolean;
 export declare const isHttpsUri: (str: string) => boolean;

package/utils/url.js

@@ -23,8 +23,29 @@ const hasHttpProtocol = (str, protocol) => {
         return false;
     }
 };
-const isHttpUri = (str) => hasHttpProtocol(str, 'http:');
+// The parser strips ASCII tab, newline and carriage return before parsing, so
+// `new URL('http://exa\tmple.com')` yields `http://example.com`. Those are
+// illegal in a URL, and `valid-url` rejected them.
+const hasControlChars = (str) => /[\u0000-\u001F\u007F]/.test(str);
+/**
+ * The literal prefix is checked as well as the parsed protocol, because the URL
+ * parser normalises a backslash to a forward slash for special schemes:
+ * `new URL('http:\\server')` yields `http://server`. `valid-url`, which these
+ * replaced, required the literal prefix and so rejected such input.
+ *
+ * The prefix comparison is case-insensitive: the parser lowercases the scheme,
+ * so `HTTP://example.com` is a usable URL, and `valid-url` compared the scheme
+ * case-insensitively too. A backslash still fails, since it is not a slash in
+ * either case.
+ */
+const isHttpUri = (str) => typeof str === 'string' &&
+    !hasControlChars(str) &&
+    str.toLowerCase().startsWith('http://') &&
+    hasHttpProtocol(str, 'http:');
 exports.isHttpUri = isHttpUri;
-const isHttpsUri = (str) => hasHttpProtocol(str, 'https:');
+const isHttpsUri = (str) => typeof str === 'string' &&
+    !hasControlChars(str) &&
+    str.toLowerCase().startsWith('https://') &&
+    hasHttpProtocol(str, 'https:');
 exports.isHttpsUri = isHttpsUri;
 //# sourceMappingURL=url.js.map

package/utils/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":";;;AAAO,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE;IACvC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAA;IAE1B,IAAI,MAAM,CAAA;IAEV,IAAI;QACF,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;KAC7B;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;KAChC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAED,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;IACxD,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAExB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;KACnD;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,KAAK,CAAA;KACb;AACH,CAAC,CAAA;AAEM,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAA1D,QAAA,SAAS,aAAiD;AAEhE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAA5D,QAAA,UAAU,cAAkD"}
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../src/utils/url.ts"],"names":[],"mappings":";;;AAAO,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE;IACvC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAA;IAE1B,IAAI,MAAM,CAAA;IAEV,IAAI;QACF,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;KAC7B;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;KAChC;IAED,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAZY,QAAA,SAAS,aAYrB;AAED,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE;IACxD,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAExB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAA;KACnD;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,KAAK,CAAA;KACb;AACH,CAAC,CAAA;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,mDAAmD;AACnD,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE1E;;;;;;;;;;GAUG;AACI,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CACvC,OAAO,GAAG,KAAK,QAAQ;IACvB,CAAC,eAAe,CAAC,GAAG,CAAC;IACrB,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;IACvC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAJlB,QAAA,SAAS,aAIS;AAExB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CACxC,OAAO,GAAG,KAAK,QAAQ;IACvB,CAAC,eAAe,CAAC,GAAG,CAAC;IACrB,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACxC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAJnB,QAAA,UAAU,cAIS"}