@squiz/render-runtime-lib 1.2.1-alpha.68 → 1.2.1-alpha.69

package/lib/worker/worker-root.js

@@ -99,6 +99,8 @@ var require_bridge = __commonJS({
     var thisErrorCaptureStackTrace = Error.captureStackTrace;
     var thisSymbolToString = Symbol.prototype.toString;
     var thisSymbolToStringTag = Symbol.toStringTag;
+    var thisSymbolIterator = Symbol.iterator;
+    var thisSymbolNodeJSUtilInspectCustom = Symbol.for("nodejs.util.inspect.custom");
     var VMError = class extends Error {
       constructor(message, code) {
         super(message);
@@ -305,7 +307,10 @@ var require_bridge = __commonJS({
       class BaseHandler extends SafeBase {
         constructor(object) {
           super();
-          this.object = object;
+          this.objectWrapper = () => object;
+        }
+        getObject() {
+          return this.objectWrapper();
         }
         getFactory() {
           return defaultFactory;
@@ -362,7 +367,7 @@ var require_bridge = __commonJS({
             throw thisUnexpected();
         }
         get(target, key, receiver) {
-          const object = this.object;
+          const object = this.getObject();
           switch (key) {
             case "constructor": {
               const desc = otherSafeGetOwnPropertyDescriptor(object, key);
@@ -402,7 +407,7 @@ var require_bridge = __commonJS({
           return this.fromOtherWithContext(ret);
         }
         set(target, key, value, receiver) {
-          const object = this.object;
+          const object = this.getObject();
           if (key === "__proto__" && !thisOtherHasOwnProperty(object, key)) {
             return this.setPrototypeOf(target, value);
           }
@@ -420,7 +425,7 @@ var require_bridge = __commonJS({
           throw new VMError(OPNA);
         }
         apply(target, context, args) {
-          const object = this.object;
+          const object = this.getObject();
           let ret;
           try {
             context = otherFromThis(context);
@@ -432,7 +437,7 @@ var require_bridge = __commonJS({
           return thisFromOther(ret);
         }
         construct(target, args, newTarget) {
-          const object = this.object;
+          const object = this.getObject();
           let ret;
           try {
             args = otherFromThisArguments(args);
@@ -443,13 +448,13 @@ var require_bridge = __commonJS({
           return thisFromOtherWithFactory(this.getFactory(), ret, thisFromOther(object));
         }
         getOwnPropertyDescriptorDesc(target, prop, desc) {
-          const object = this.object;
+          const object = this.getObject();
           if (desc && typeof object === "function" && (prop === "arguments" || prop === "caller" || prop === "callee"))
             desc.value = null;
           return desc;
         }
         getOwnPropertyDescriptor(target, prop) {
-          const object = this.object;
+          const object = this.getObject();
           let desc;
           try {
             desc = otherSafeGetOwnPropertyDescriptor(object, prop);
@@ -490,7 +495,7 @@ var require_bridge = __commonJS({
           return desc;
         }
         defineProperty(target, prop, desc) {
-          const object = this.object;
+          const object = this.getObject();
           if (!thisReflectSetPrototypeOf(desc, null))
             throw thisUnexpected();
           desc = this.definePropertyDesc(target, prop, desc);
@@ -540,7 +545,7 @@ var require_bridge = __commonJS({
           return true;
         }
         deleteProperty(target, prop) {
-          const object = this.object;
+          const object = this.getObject();
           try {
             return otherReflectDeleteProperty(object, prop) === true;
           } catch (e) {
@@ -548,7 +553,7 @@ var require_bridge = __commonJS({
           }
         }
         has(target, key) {
-          const object = this.object;
+          const object = this.getObject();
           try {
             return otherReflectHas(object, key) === true;
           } catch (e) {
@@ -556,7 +561,7 @@ var require_bridge = __commonJS({
           }
         }
         isExtensible(target) {
-          const object = this.object;
+          const object = this.getObject();
           try {
             if (otherReflectIsExtensible(object))
               return true;
@@ -569,7 +574,7 @@ var require_bridge = __commonJS({
           return false;
         }
         ownKeys(target) {
-          const object = this.object;
+          const object = this.getObject();
           let res;
           try {
             res = otherReflectOwnKeys(object);
@@ -579,7 +584,7 @@ var require_bridge = __commonJS({
           return thisFromOther(res);
         }
         preventExtensions(target) {
-          const object = this.object;
+          const object = this.getObject();
           try {
             if (!otherReflectPreventExtensions(object))
               return false;
@@ -592,7 +597,7 @@ var require_bridge = __commonJS({
           return true;
         }
         enumerate(target) {
-          const object = this.object;
+          const object = this.getObject();
           let res;
           try {
             res = otherReflectEnumerate(object);
@@ -602,6 +607,9 @@ var require_bridge = __commonJS({
           return this.fromOtherWithContext(res);
         }
       }
+      BaseHandler.prototype[thisSymbolNodeJSUtilInspectCustom] = void 0;
+      BaseHandler.prototype[thisSymbolToStringTag] = "VM2 Wrapper";
+      BaseHandler.prototype[thisSymbolIterator] = void 0;
       function defaultFactory(object) {
         return new BaseHandler(object);
       }
@@ -668,7 +676,7 @@ var require_bridge = __commonJS({
           this.mock = mock;
         }
         get(target, key, receiver) {
-          const object = this.object;
+          const object = this.getObject();
           const mock = this.mock;
           if (thisReflectApply(thisObjectHasOwnProperty, mock, key) && !thisOtherHasOwnProperty(object, key)) {
             return mock[key];
@@ -910,7 +918,7 @@ var require_compiler = __commonJS({
       return removeShebang(code);
     }
     function lookupCompiler(compiler) {
-      if (typeof compiler === "function")
+      if ("function" === typeof compiler)
         return compiler;
       switch (compiler) {
         case "coffeescript":
@@ -6229,6 +6237,9 @@ ${error.stack}`;
       let argsOffset;
       if (args === null) {
         code = body;
+        if (!/\b(?:catch|import|async)\b/.test(code)) {
+          return { __proto__: null, code, hasAsync: false };
+        }
       } else {
         code = isAsync ? "(async function" : "(function";
         if (isGenerator)
@@ -6647,7 +6658,7 @@ return exports;})`);
         const allowEval = options.eval !== false;
         const allowWasm = options.wasm !== false;
         const allowAsync = optAllowAsync && !options.fixAsync;
-        if (sandbox && typeof sandbox !== "object") {
+        if (sandbox && "object" !== typeof sandbox) {
           throw new VMError("Sandbox must be object.");
         }
         const resolvedCompiler = lookupCompiler(compiler);
@@ -7838,7 +7849,7 @@ var require_nodevm = __commonJS({
           strict = false,
           sandbox
         } = options;
-        if (sandbox && typeof sandbox !== "object") {
+        if (sandbox && "object" !== typeof sandbox) {
           throw new VMError("Sandbox must be an object.");
         }
         super({ __proto__: null, compiler, eval: allowEval, wasm });
@@ -7908,7 +7919,7 @@ var require_nodevm = __commonJS({
         }
       }
       call(method, ...args) {
-        if (typeof method === "function") {
+        if ("function" === typeof method) {
           return method(...args);
         } else {
           throw new VMError("Unrecognized method type.");
@@ -7981,15 +7992,15 @@ var require_nodevm = __commonJS({
       static code(script2, filename, options) {
         let unresolvedFilename;
         if (filename != null) {
-          if (typeof filename === "object") {
+          if ("object" === typeof filename) {
             options = filename;
             unresolvedFilename = options.filename;
-          } else if (typeof filename === "string") {
+          } else if ("string" === typeof filename) {
             unresolvedFilename = filename;
           } else {
             throw new VMError("Invalid arguments.");
           }
-        } else if (typeof options === "object") {
+        } else if ("object" === typeof options) {
           unresolvedFilename = options.filename;
         }
         if (arguments.length > 3) {
@@ -19690,7 +19701,7 @@ var require_jsonpointer = __commonJS({
         obj = obj[untilde(pointer[p++])];
         if (len === p)
           return obj;
-        if (typeof obj !== "object")
+        if (typeof obj !== "object" || obj === null)
           return void 0;
       }
     }
@@ -20560,12 +20571,12 @@ var require_legacy_streams = __commonJS({
         if (this.encoding)
           this.setEncoding(this.encoding);
         if (this.start !== void 0) {
-          if (typeof this.start !== "number") {
+          if ("number" !== typeof this.start) {
             throw TypeError("start must be a Number");
           }
           if (this.end === void 0) {
             this.end = Infinity;
-          } else if (typeof this.end !== "number") {
+          } else if ("number" !== typeof this.end) {
             throw TypeError("end must be a Number");
           }
           if (this.start > this.end) {
@@ -20608,7 +20619,7 @@ var require_legacy_streams = __commonJS({
           this[key] = options[key];
         }
         if (this.start !== void 0) {
-          if (typeof this.start !== "number") {
+          if ("number" !== typeof this.start) {
             throw TypeError("start must be a Number");
           }
           if (this.start < 0) {
@@ -22892,7 +22903,7 @@ var require_LoadedComponent = __commonJS({
         return `${this.getUniqueComponentSlug()}-${functionName}`;
       }
       getFullFunctionEntryPointFilePath(functionEntryPath) {
-        return path_1.default.join(this.componentFilesRoot, this.manifest.name, this.manifest.version, functionEntryPath);
+        return path_1.default.resolve(path_1.default.join(this.componentFilesRoot, functionEntryPath));
       }
     };
     exports.LoadedComponent = LoadedComponent;
@@ -23054,14 +23065,11 @@ var require_loadManifest = __commonJS({
     var ManifestValidationError = class extends Error {
     };
     exports.ManifestValidationError = ManifestValidationError;
-    async function loadManifest(componentName, version, componentRoot) {
-      const manifestPath = path_1.default.join(componentRoot, componentName, version, "manifest.json");
+    async function loadManifest(manifestPath) {
       if (await fs_extra_1.default.pathExists(manifestPath)) {
         const { manifest, validation } = await readManifest(manifestPath);
         if (!validation.isValid) {
           throw new ManifestValidationError(validation.message);
-        } else if (version !== manifest.version) {
-          throw new error_1.InternalServerError(`manifest version miss match, expected version ${version} does not equal loaded version ${manifest.version}`);
         } else {
           return manifest;
         }
@@ -23074,7 +23082,7 @@ var require_loadManifest = __commonJS({
       const manifestValidationResult = (0, validateManifest_1.validateManifest)(manifest);
       return { manifest, validation: manifestValidationResult };
     }
-    async function findComponentManifests(directory, nesting = 3) {
+    async function findComponentManifests(directory, nesting = 10) {
       if (await isComponentDirectory(directory)) {
         return [await tryReadManifest(directory)];
       }
@@ -23091,16 +23099,53 @@ var require_loadManifest = __commonJS({
       return fs_extra_1.default.pathExists(path_1.default.join(directory, "manifest.json"));
     }
     async function tryReadManifest(directory) {
-      const { manifest, validation } = await readManifest(path_1.default.join(directory, "manifest.json"));
-      if (validation.isValid) {
-        return { directory, manifest, status: "valid" };
-      } else {
-        return { directory, validationError: new ManifestValidationError(validation.message), status: "invalid" };
+      try {
+        const { manifest, validation } = await readManifest(path_1.default.join(directory, "manifest.json"));
+        if (validation.isValid) {
+          return { directory, manifest, status: "valid" };
+        } else {
+          return {
+            directory,
+            manifest,
+            validationError: new ManifestValidationError(validation.message),
+            status: "invalid"
+          };
+        }
+      } catch (e) {
+        let message = "Unknown error occurred";
+        if (e instanceof Error && e.message) {
+          message = e.message;
+        }
+        return {
+          directory,
+          manifest: void 0,
+          validationError: new ManifestValidationError(message),
+          status: "invalid"
+        };
       }
     }
   }
 });
 
+// ../component-lib/lib/util/isPathTryingToAccessOutsideOfRoot.js
+var require_isPathTryingToAccessOutsideOfRoot = __commonJS({
+  "../component-lib/lib/util/isPathTryingToAccessOutsideOfRoot.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.isPathTryingToAccessOutsideOfRoot = void 0;
+    var path_1 = __importDefault(require("path"));
+    function isPathTryingToAccessOutsideOfRoot(rootPath, filePath) {
+      const resolvedRoot = path_1.default.resolve(rootPath);
+      const joinedPath = path_1.default.join(resolvedRoot, filePath);
+      return !joinedPath.includes(resolvedRoot);
+    }
+    exports.isPathTryingToAccessOutsideOfRoot = isPathTryingToAccessOutsideOfRoot;
+  }
+});
+
 // ../component-lib/lib/loaders/loadComponent.js
 var require_loadComponent = __commonJS({
   "../component-lib/lib/loaders/loadComponent.js"(exports) {
@@ -23115,25 +23160,37 @@ var require_loadComponent = __commonJS({
     var LoadedComponent_1 = require_LoadedComponent();
     var loadManifest_1 = require_loadManifest();
     var fs_1 = require("fs");
-    async function loadComponent(componentName, version, componentFileRoot, componentRootUrl, executor) {
+    var isPathTryingToAccessOutsideOfRoot_1 = require_isPathTryingToAccessOutsideOfRoot();
+    var error_1 = require_error();
+    async function loadComponent(componentManifestPath, componentName, componentVersion, componentRootUrl, executor, loadInProductionMode) {
       var _a;
-      const manifest = await (0, loadManifest_1.loadManifest)(componentName, version, componentFileRoot);
-      const root = path_1.default.join(componentFileRoot, manifest.name, manifest.version);
+      const componentRootPath = path_1.default.resolve(componentManifestPath, "..");
+      const manifest = await (0, loadManifest_1.loadManifest)(componentManifestPath);
       const staticFileLocationRoot = ((_a = manifest["static-files"]) === null || _a === void 0 ? void 0 : _a["location-root"]) || "";
-      if (await isPathTraversing(root, staticFileLocationRoot)) {
+      if ((0, isPathTryingToAccessOutsideOfRoot_1.isPathTryingToAccessOutsideOfRoot)(componentRootPath, staticFileLocationRoot)) {
         throw new Error(`access to a static file location root outside the parent directory in "${manifest.name} ${manifest.version}" is not alllowed`);
       }
       for (const func of manifest.functions) {
-        await assertFuncEntryFilesAreValid(root, manifest, func);
+        await assertFuncEntryFilesAreValid(componentRootPath, manifest, func);
         if (func.output["response-type"] === "html" && staticFileLocationRoot) {
-          await assertStaticFilesAreValid(root, manifest, func, staticFileLocationRoot);
+          await assertStaticFilesAreValid(componentRootPath, manifest, func, staticFileLocationRoot);
+        }
+      }
+      const component = new LoadedComponent_1.LoadedComponent(manifest, componentRootPath, componentRootUrl, executor);
+      if (loadInProductionMode) {
+        const manifest2 = component.getManifest();
+        if (componentVersion !== manifest2.version) {
+          throw new error_1.InternalServerError(`manifest version miss match, expected version ${componentVersion} does not equal loaded version ${manifest2.version}`);
+        }
+        if (componentName !== manifest2.name) {
+          throw new error_1.InternalServerError(`manifest name miss match, expected name ${componentVersion} does not equal loaded name ${manifest2.name}`);
         }
       }
-      return new LoadedComponent_1.LoadedComponent(manifest, componentFileRoot, componentRootUrl, executor);
+      return component;
     }
     exports.loadComponent = loadComponent;
     async function assertFuncEntryFilesAreValid(componentRoot, manifest, func) {
-      if (await isPathTraversing(componentRoot, func.entry) || !await isReadable(componentRoot, func.entry)) {
+      if ((0, isPathTryingToAccessOutsideOfRoot_1.isPathTryingToAccessOutsideOfRoot)(componentRoot, func.entry) || !await isReadable(componentRoot, func.entry)) {
         throw new Error(`access to component "${func.name}'s" entry file "${func.entry}"  outside the parent directory in "${manifest.name} ${manifest.version}" is not alllowed`);
       }
     }
@@ -23144,15 +23201,11 @@ var require_loadComponent = __commonJS({
         if (staticFile.file.startsWith("http://") || staticFile.file.startsWith("https://")) {
           continue;
         }
-        if (await isPathTraversing(staticFileRoot, staticFile.file) || !await isReadable(staticFileRoot, staticFile.file)) {
+        if ((0, isPathTryingToAccessOutsideOfRoot_1.isPathTryingToAccessOutsideOfRoot)(staticFileRoot, staticFile.file) || !await isReadable(staticFileRoot, staticFile.file)) {
           throw new Error(`access to a static file "${staticFile.file}" for "${func.name}" outside the parent directory in "${manifest.name} ${manifest.version}" is not alllowed`);
         }
       }
     }
-    async function isPathTraversing(basePath, file) {
-      const filePath = path_1.default.join(basePath, file);
-      return !filePath.includes(basePath);
-    }
     async function isReadable(basePath, file) {
       try {
         await fs_extra_1.default.access(path_1.default.join(basePath, file), fs_1.constants.R_OK);
@@ -27744,7 +27797,7 @@ var require_stream_readable = __commonJS({
         debug("ondata");
         increasedAwaitDrain = false;
         var ret = dest.write(chunk);
-        if (ret === false && !increasedAwaitDrain) {
+        if (false === ret && !increasedAwaitDrain) {
           if ((state.pipesCount === 1 && state.pipes === dest || state.pipesCount > 1 && indexOf(state.pipes, dest) !== -1) && !cleanedUp) {
             debug("false write response, pause", src._readableState.awaitDrain);
             src._readableState.awaitDrain++;
@@ -27886,7 +27939,7 @@ var require_stream_readable = __commonJS({
     }
     Readable.prototype.pause = function() {
       debug("call pause flowing=%j", this._readableState.flowing);
-      if (this._readableState.flowing !== false) {
+      if (false !== this._readableState.flowing) {
         debug("pause");
         this._readableState.flowing = false;
         this.emit("pause");
@@ -29875,7 +29928,7 @@ var require_stream_readable2 = __commonJS({
         debug("ondata");
         increasedAwaitDrain = false;
         var ret = dest.write(chunk);
-        if (ret === false && !increasedAwaitDrain) {
+        if (false === ret && !increasedAwaitDrain) {
           if ((state.pipesCount === 1 && state.pipes === dest || state.pipesCount > 1 && indexOf(state.pipes, dest) !== -1) && !cleanedUp) {
             debug("false write response, pause", src._readableState.awaitDrain);
             src._readableState.awaitDrain++;
@@ -30017,7 +30070,7 @@ var require_stream_readable2 = __commonJS({
     }
     Readable.prototype.pause = function() {
       debug("call pause flowing=%j", this._readableState.flowing);
-      if (this._readableState.flowing !== false) {
+      if (false !== this._readableState.flowing) {
         debug("pause");
         this._readableState.flowing = false;
         this.emit("pause");
@@ -32362,7 +32415,7 @@ var require_common = __commonJS({
     function setopts(self2, pattern, options) {
       if (!options)
         options = {};
-      if (options.matchBase && pattern.indexOf("/") === -1) {
+      if (options.matchBase && -1 === pattern.indexOf("/")) {
         if (options.noglobstar) {
           throw new Error("base matching requires globstar");
         }
@@ -36800,7 +36853,7 @@ var require_core3 = __commonJS({
       }
       var isDir = data.type === "directory";
       if (data.name) {
-        if (typeof data.prefix === "string" && data.prefix !== "") {
+        if (typeof data.prefix === "string" && "" !== data.prefix) {
           data.name = data.prefix + "/" + data.name;
           data.prefix = null;
         }
@@ -37983,9 +38036,9 @@ var require_crc32 = __commonJS({
     var CRC32;
     (function(factory) {
       if (typeof DO_NOT_EXPORT_CRC === "undefined") {
-        if (typeof exports === "object") {
+        if ("object" === typeof exports) {
           factory(exports);
-        } else if (typeof define === "function" && define.amd) {
+        } else if ("function" === typeof define && define.amd) {
           define(function() {
             var module3 = {};
             factory(module3);
@@ -40546,9 +40599,21 @@ var require_joinAbsoluteUrlPath = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.joinAbsoluteUrlPath = void 0;
     function joinAbsoluteUrlPath(...args) {
-      return args.map((pathPart) => pathPart.replace(/(^\/+|\/+$)/g, "")).join("/");
+      const [rootUrl] = args;
+      const url = new URL(getSanitisedString(args), "http://example.com");
+      if (urlIsAbsolute(rootUrl)) {
+        return url.toString();
+      } else {
+        return url.pathname.replace(/(^\/|\/$)/g, "");
+      }
     }
     exports.joinAbsoluteUrlPath = joinAbsoluteUrlPath;
+    function getSanitisedString(subdirs) {
+      return subdirs.map((dir) => dir.replace(/(^\.\/+)|(^\/+|\/+$)/g, "")).join("/");
+    }
+    function urlIsAbsolute(url) {
+      return url.match(/^http(s?):\/\//);
+    }
   }
 });
 
@@ -40687,6 +40752,7 @@ var require_lib6 = __commonJS({
     __exportStar(require_v12(), exports);
     __exportStar(require_parseEnvVarForVar(), exports);
     __exportStar(require_getNodeEnv(), exports);
+    __exportStar(require_isPathTryingToAccessOutsideOfRoot(), exports);
   }
 });