@suveren/gateway 0.5.0 → 0.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/suveren-gateway.js +107 -12
- package/content/integrations/deploy-github.json +164 -0
- package/content/integrations/gmail.json +10 -4
- package/content/integrations/index.json +2 -1
- package/dist/control-plane/index.mjs +31 -7
- package/dist/mcp-server/http.mjs +49 -4
- package/dist/ui/assets/index-DecSrutK.js +105 -0
- package/dist/ui/index.html +1 -1
- package/node_modules/@hap/core/dist/index.d.mts +21 -0
- package/node_modules/@hap/core/dist/index.d.ts +21 -0
- package/node_modules/@hap/core/dist/index.js +17 -0
- package/node_modules/@hap/core/dist/index.mjs +17 -0
- package/node_modules/@hap/core/package.json +1 -1
- package/node_modules/@hap/core/src/gatekeeper.ts +28 -0
- package/node_modules/@hap/core/src/types.ts +21 -0
- package/node_modules/fast-uri/index.js +37 -1
- package/node_modules/fast-uri/package.json +1 -1
- package/node_modules/fast-uri/test/security.test.js +136 -0
- package/node_modules/hono/dist/cjs/helper/proxy/index.js +4 -0
- package/node_modules/hono/dist/cjs/jsx/base.js +1 -9
- package/node_modules/hono/dist/cjs/jsx/hooks/index.js +14 -11
- package/node_modules/hono/dist/cjs/middleware/cors/index.js +1 -1
- package/node_modules/hono/dist/cjs/middleware/language/language.js +10 -6
- package/node_modules/hono/dist/cjs/utils/cookie.js +2 -1
- package/node_modules/hono/dist/helper/proxy/index.js +4 -0
- package/node_modules/hono/dist/jsx/base.js +1 -9
- package/node_modules/hono/dist/jsx/hooks/index.js +14 -11
- package/node_modules/hono/dist/middleware/cors/index.js +1 -1
- package/node_modules/hono/dist/middleware/language/language.js +10 -6
- package/node_modules/hono/dist/utils/cookie.js +2 -1
- package/node_modules/hono/package.json +2 -3
- package/node_modules/ip-address/README.md +142 -128
- package/node_modules/ip-address/dist/common.d.ts +6 -0
- package/node_modules/ip-address/dist/common.js +17 -1
- package/node_modules/ip-address/dist/common.js.map +1 -1
- package/node_modules/ip-address/dist/ipv4.js +3 -12
- package/node_modules/ip-address/dist/ipv4.js.map +1 -1
- package/node_modules/ip-address/dist/ipv6.d.ts +9 -2
- package/node_modules/ip-address/dist/ipv6.js +35 -16
- package/node_modules/ip-address/dist/ipv6.js.map +1 -1
- package/node_modules/ip-address/package.json +5 -3
- package/node_modules/jose/dist/types/types.d.ts +7 -9
- package/node_modules/jose/dist/webapi/jwe/compact/decrypt.js +2 -2
- package/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js +12 -12
- package/node_modules/jose/dist/webapi/jwe/general/encrypt.js +50 -51
- package/node_modules/jose/dist/webapi/jwks/local.js +10 -31
- package/node_modules/jose/dist/webapi/jwks/remote.js +17 -26
- package/node_modules/jose/dist/webapi/jws/compact/verify.js +2 -2
- package/node_modules/jose/dist/webapi/jws/flattened/sign.js +1 -9
- package/node_modules/jose/dist/webapi/jws/general/sign.js +12 -21
- package/node_modules/jose/dist/webapi/jws/general/verify.js +13 -11
- package/node_modules/jose/dist/webapi/jwt/decrypt.js +3 -3
- package/node_modules/jose/dist/webapi/jwt/verify.js +4 -4
- package/node_modules/jose/dist/webapi/key/export.js +3 -3
- package/node_modules/jose/dist/webapi/key/generate_key_pair.js +7 -6
- package/node_modules/jose/dist/webapi/lib/asn1.js +29 -62
- package/node_modules/jose/dist/webapi/lib/content_encryption.js +16 -34
- package/node_modules/jose/dist/webapi/lib/crypto_key.js +6 -0
- package/node_modules/jose/dist/webapi/lib/invalid_key_input.js +0 -1
- package/node_modules/jose/dist/webapi/lib/jwe_algorithms.js +44 -71
- package/node_modules/jose/dist/webapi/lib/jwe_decrypt.js +46 -41
- package/node_modules/jose/dist/webapi/lib/jwe_encrypt.js +14 -13
- package/node_modules/jose/dist/webapi/lib/jwk_to_key.js +5 -10
- package/node_modules/jose/dist/webapi/lib/jws_algorithms.js +20 -18
- package/node_modules/jose/dist/webapi/lib/jws_sign.js +12 -6
- package/node_modules/jose/dist/webapi/lib/jws_verify.js +26 -27
- package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js +60 -102
- package/node_modules/jose/dist/webapi/lib/key.js +61 -99
- package/node_modules/jose/dist/webapi/lib/key_algorithm.js +2 -8
- package/node_modules/jose/dist/webapi/lib/key_descriptor.js +1 -1
- package/node_modules/jose/dist/webapi/lib/key_management.js +74 -161
- package/node_modules/jose/dist/webapi/lib/options.js +11 -14
- package/node_modules/jose/dist/webapi/lib/signing.js +6 -16
- package/node_modules/jose/dist/webapi/lib/type_checks.js +13 -18
- package/node_modules/jose/dist/webapi/util/base64url.js +4 -3
- package/node_modules/jose/package.json +1 -1
- package/package.json +2 -2
- package/profiles/deploy/0.6.profile.json +168 -0
- package/profiles/deploy/0.7.profile.json +168 -0
- package/profiles/email/0.4.profile.json +7 -1
- package/profiles/index.json +3 -1
- package/dist/ui/assets/index-DedRWpBs.js +0 -105
package/dist/ui/index.html
CHANGED
|
@@ -4,7 +4,7 @@
|
|
|
4
4
|
<meta charset="UTF-8" />
|
|
5
5
|
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
|
6
6
|
<title>Suveren</title>
|
|
7
|
-
<script type="module" crossorigin src="/assets/index-
|
|
7
|
+
<script type="module" crossorigin src="/assets/index-DecSrutK.js"></script>
|
|
8
8
|
<link rel="stylesheet" crossorigin href="/assets/index-JHaCddDE.css">
|
|
9
9
|
</head>
|
|
10
10
|
<body>
|
|
@@ -113,6 +113,27 @@ interface Attestation {
|
|
|
113
113
|
interface FieldConstraint {
|
|
114
114
|
type: 'number' | 'string';
|
|
115
115
|
enforceable: Array<'max' | 'enum' | 'subset'>;
|
|
116
|
+
/**
|
|
117
|
+
* Action types for which this dimension MUST be present in the execution
|
|
118
|
+
* context. When the grant constrains this field and the action is one of
|
|
119
|
+
* these, an absent value is a denial rather than a skipped check.
|
|
120
|
+
*
|
|
121
|
+
* Without it, a constraint is only enforced against calls that happen to
|
|
122
|
+
* expose the value. Gmail's `send_message` is the live case: pass `raw` and
|
|
123
|
+
* `to` is never populated, so `allowed_recipients` had nothing to compare and
|
|
124
|
+
* the check passed — a send to an unverified recipient looked authorized.
|
|
125
|
+
* `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
|
|
126
|
+
* see to whom.
|
|
127
|
+
*
|
|
128
|
+
* Keyed on `action_type` because "does this action engage recipients?" is a
|
|
129
|
+
* property of the action, not of the field name — deleting a draft has no
|
|
130
|
+
* recipients and must keep passing, while sending one must not. This keeps
|
|
131
|
+
* the engine profile-agnostic: it compares declared strings and knows nothing
|
|
132
|
+
* about email, calendars or payments.
|
|
133
|
+
*
|
|
134
|
+
* Omitted → previous behaviour: absence skips the check.
|
|
135
|
+
*/
|
|
136
|
+
requiredFor?: string[];
|
|
116
137
|
}
|
|
117
138
|
/**
|
|
118
139
|
* Frame field definition within a profile.
|
|
@@ -113,6 +113,27 @@ interface Attestation {
|
|
|
113
113
|
interface FieldConstraint {
|
|
114
114
|
type: 'number' | 'string';
|
|
115
115
|
enforceable: Array<'max' | 'enum' | 'subset'>;
|
|
116
|
+
/**
|
|
117
|
+
* Action types for which this dimension MUST be present in the execution
|
|
118
|
+
* context. When the grant constrains this field and the action is one of
|
|
119
|
+
* these, an absent value is a denial rather than a skipped check.
|
|
120
|
+
*
|
|
121
|
+
* Without it, a constraint is only enforced against calls that happen to
|
|
122
|
+
* expose the value. Gmail's `send_message` is the live case: pass `raw` and
|
|
123
|
+
* `to` is never populated, so `allowed_recipients` had nothing to compare and
|
|
124
|
+
* the check passed — a send to an unverified recipient looked authorized.
|
|
125
|
+
* `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
|
|
126
|
+
* see to whom.
|
|
127
|
+
*
|
|
128
|
+
* Keyed on `action_type` because "does this action engage recipients?" is a
|
|
129
|
+
* property of the action, not of the field name — deleting a draft has no
|
|
130
|
+
* recipients and must keep passing, while sending one must not. This keeps
|
|
131
|
+
* the engine profile-agnostic: it compares declared strings and knows nothing
|
|
132
|
+
* about email, calendars or payments.
|
|
133
|
+
*
|
|
134
|
+
* Omitted → previous behaviour: absence skips the check.
|
|
135
|
+
*/
|
|
136
|
+
requiredFor?: string[];
|
|
116
137
|
}
|
|
117
138
|
/**
|
|
118
139
|
* Frame field definition within a profile.
|
|
@@ -757,6 +757,23 @@ function checkContextConstraints(context, execution, profile) {
|
|
|
757
757
|
if (!profile.contextSchema) return errors;
|
|
758
758
|
for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
|
|
759
759
|
if (!fieldDef.constraint) continue;
|
|
760
|
+
const requiredFor = fieldDef.constraint.requiredFor;
|
|
761
|
+
if (requiredFor?.length) {
|
|
762
|
+
const boundValue = context[fieldName];
|
|
763
|
+
const actualValue = execution[fieldName];
|
|
764
|
+
const actionType = execution["action_type"];
|
|
765
|
+
const constrained = boundValue !== void 0 && boundValue !== "";
|
|
766
|
+
const engaged = actionType !== void 0 && requiredFor.includes(String(actionType));
|
|
767
|
+
if (constrained && engaged && (actualValue === void 0 || actualValue === "")) {
|
|
768
|
+
errors.push({
|
|
769
|
+
code: "BOUND_EXCEEDED",
|
|
770
|
+
field: fieldName,
|
|
771
|
+
message: `Authorization limits "${fieldName}" to [${boundValue}], but this "${String(actionType)}" call exposes no ${fieldName} to check against it. Refusing: the call cannot be shown to stay in scope.`,
|
|
772
|
+
bound: boundValue
|
|
773
|
+
});
|
|
774
|
+
continue;
|
|
775
|
+
}
|
|
776
|
+
}
|
|
760
777
|
for (const enforceType of fieldDef.constraint.enforceable) {
|
|
761
778
|
if (enforceType === "enum") {
|
|
762
779
|
const boundValue = context[fieldName];
|
|
@@ -686,6 +686,23 @@ function checkContextConstraints(context, execution, profile) {
|
|
|
686
686
|
if (!profile.contextSchema) return errors;
|
|
687
687
|
for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
|
|
688
688
|
if (!fieldDef.constraint) continue;
|
|
689
|
+
const requiredFor = fieldDef.constraint.requiredFor;
|
|
690
|
+
if (requiredFor?.length) {
|
|
691
|
+
const boundValue = context[fieldName];
|
|
692
|
+
const actualValue = execution[fieldName];
|
|
693
|
+
const actionType = execution["action_type"];
|
|
694
|
+
const constrained = boundValue !== void 0 && boundValue !== "";
|
|
695
|
+
const engaged = actionType !== void 0 && requiredFor.includes(String(actionType));
|
|
696
|
+
if (constrained && engaged && (actualValue === void 0 || actualValue === "")) {
|
|
697
|
+
errors.push({
|
|
698
|
+
code: "BOUND_EXCEEDED",
|
|
699
|
+
field: fieldName,
|
|
700
|
+
message: `Authorization limits "${fieldName}" to [${boundValue}], but this "${String(actionType)}" call exposes no ${fieldName} to check against it. Refusing: the call cannot be shown to stay in scope.`,
|
|
701
|
+
bound: boundValue
|
|
702
|
+
});
|
|
703
|
+
continue;
|
|
704
|
+
}
|
|
705
|
+
}
|
|
689
706
|
for (const enforceType of fieldDef.constraint.enforceable) {
|
|
690
707
|
if (enforceType === "enum") {
|
|
691
708
|
const boundValue = context[fieldName];
|
|
@@ -612,6 +612,34 @@ function checkContextConstraints(
|
|
|
612
612
|
for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
|
|
613
613
|
if (!fieldDef.constraint) continue;
|
|
614
614
|
|
|
615
|
+
// A constrained dimension that the call does not expose cannot be checked.
|
|
616
|
+
// Skipping is only safe when the action does not engage that dimension —
|
|
617
|
+
// deleting a draft has no recipients. When it DOES engage it, silence must
|
|
618
|
+
// not read as compliance: an absent value means the Gatekeeper cannot show
|
|
619
|
+
// the call is in scope, and an unverifiable send is exactly what the scope
|
|
620
|
+
// exists to prevent. The profile declares which actions engage the field.
|
|
621
|
+
const requiredFor = fieldDef.constraint.requiredFor;
|
|
622
|
+
if (requiredFor?.length) {
|
|
623
|
+
const boundValue = context[fieldName];
|
|
624
|
+
const actualValue = execution[fieldName];
|
|
625
|
+
const actionType = execution['action_type'];
|
|
626
|
+
const constrained = boundValue !== undefined && boundValue !== '';
|
|
627
|
+
const engaged = actionType !== undefined && requiredFor.includes(String(actionType));
|
|
628
|
+
|
|
629
|
+
if (constrained && engaged && (actualValue === undefined || actualValue === '')) {
|
|
630
|
+
errors.push({
|
|
631
|
+
code: 'BOUND_EXCEEDED',
|
|
632
|
+
field: fieldName,
|
|
633
|
+
message:
|
|
634
|
+
`Authorization limits "${fieldName}" to [${boundValue}], but this ` +
|
|
635
|
+
`"${String(actionType)}" call exposes no ${fieldName} to check against it. ` +
|
|
636
|
+
`Refusing: the call cannot be shown to stay in scope.`,
|
|
637
|
+
bound: boundValue,
|
|
638
|
+
});
|
|
639
|
+
continue; // nothing further to compare for this field
|
|
640
|
+
}
|
|
641
|
+
}
|
|
642
|
+
|
|
615
643
|
for (const enforceType of fieldDef.constraint.enforceable) {
|
|
616
644
|
if (enforceType === 'enum') {
|
|
617
645
|
// The context field value is the allowed value; execution must match
|
|
@@ -121,6 +121,27 @@ export interface Attestation {
|
|
|
121
121
|
export interface FieldConstraint {
|
|
122
122
|
type: 'number' | 'string';
|
|
123
123
|
enforceable: Array<'max' | 'enum' | 'subset'>;
|
|
124
|
+
/**
|
|
125
|
+
* Action types for which this dimension MUST be present in the execution
|
|
126
|
+
* context. When the grant constrains this field and the action is one of
|
|
127
|
+
* these, an absent value is a denial rather than a skipped check.
|
|
128
|
+
*
|
|
129
|
+
* Without it, a constraint is only enforced against calls that happen to
|
|
130
|
+
* expose the value. Gmail's `send_message` is the live case: pass `raw` and
|
|
131
|
+
* `to` is never populated, so `allowed_recipients` had nothing to compare and
|
|
132
|
+
* the check passed — a send to an unverified recipient looked authorized.
|
|
133
|
+
* `send_draft` has the same shape: it transmits, and the Gatekeeper cannot
|
|
134
|
+
* see to whom.
|
|
135
|
+
*
|
|
136
|
+
* Keyed on `action_type` because "does this action engage recipients?" is a
|
|
137
|
+
* property of the action, not of the field name — deleting a draft has no
|
|
138
|
+
* recipients and must keep passing, while sending one must not. This keeps
|
|
139
|
+
* the engine profile-agnostic: it compares declared strings and knows nothing
|
|
140
|
+
* about email, calendars or payments.
|
|
141
|
+
*
|
|
142
|
+
* Omitted → previous behaviour: absence skips the check.
|
|
143
|
+
*/
|
|
144
|
+
requiredFor?: string[];
|
|
124
145
|
}
|
|
125
146
|
|
|
126
147
|
/**
|
|
@@ -26,7 +26,12 @@ function normalize (uri, options) {
|
|
|
26
26
|
*/
|
|
27
27
|
function resolve (baseURI, relativeURI, options) {
|
|
28
28
|
const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
|
|
29
|
-
const
|
|
29
|
+
const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
|
|
30
|
+
const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
|
|
31
|
+
if (baseMalformed || relativeMalformed) {
|
|
32
|
+
throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
|
|
33
|
+
}
|
|
34
|
+
const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
|
|
30
35
|
schemelessOptions.skipEscape = true
|
|
31
36
|
return serialize(resolved, schemelessOptions)
|
|
32
37
|
}
|
|
@@ -206,6 +211,15 @@ const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:
|
|
|
206
211
|
// with or without a scheme prefix, for the literal-backslash rejection below.
|
|
207
212
|
const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
|
|
208
213
|
|
|
214
|
+
// Captures the leading authority-introducer region after an optional scheme: a
|
|
215
|
+
// run of forward slashes, backslashes, and the characters the WHATWG URL parser
|
|
216
|
+
// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
|
|
217
|
+
// is exactly "//". Node treats "\" as "/" on special schemes and strips those
|
|
218
|
+
// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
|
|
219
|
+
// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
|
|
220
|
+
// the path group (host confusion / SSRF / redirect bypass).
|
|
221
|
+
const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
|
|
222
|
+
|
|
209
223
|
/**
|
|
210
224
|
* @param {import('./types/index').URIComponent} parsed
|
|
211
225
|
* @param {RegExpMatchArray} matches
|
|
@@ -265,6 +279,28 @@ function parseWithStatus (uri, opts) {
|
|
|
265
279
|
malformedAuthorityOrPort = true
|
|
266
280
|
}
|
|
267
281
|
|
|
282
|
+
// Reject a malformed or whitespace-smuggled authority introducer. fast-uri
|
|
283
|
+
// only recognizes a literal "//"; anything else in the leading separator run
|
|
284
|
+
// (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
|
|
285
|
+
// Node strips) means the authority fast-uri parses differs from the one Node's
|
|
286
|
+
// URL resolves. Reject rather than rewrite, mirroring the literal-backslash
|
|
287
|
+
// guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
|
|
288
|
+
const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
|
|
289
|
+
if (introducerMatch !== null) {
|
|
290
|
+
const region = introducerMatch[1]
|
|
291
|
+
const normalizedRegion = region.replace(/[\t\n\r]/g, '')
|
|
292
|
+
// Two or more leading separators introduce an authority.
|
|
293
|
+
if (normalizedRegion.length >= 2) {
|
|
294
|
+
if (normalizedRegion.slice(0, 2) !== '//') {
|
|
295
|
+
parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
|
|
296
|
+
malformedAuthorityOrPort = true
|
|
297
|
+
} else if (region.length !== normalizedRegion.length) {
|
|
298
|
+
parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
|
|
299
|
+
malformedAuthorityOrPort = true
|
|
300
|
+
}
|
|
301
|
+
}
|
|
302
|
+
}
|
|
303
|
+
|
|
268
304
|
const matches = uri.match(URI_PARSE)
|
|
269
305
|
|
|
270
306
|
if (matches) {
|
|
@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) =
|
|
|
221
221
|
t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
|
|
222
222
|
t.equal(parsed.host, 'host.example.com', 'host parsed normally')
|
|
223
223
|
})
|
|
224
|
+
|
|
225
|
+
test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {
|
|
226
|
+
// Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority
|
|
227
|
+
// introducers. Node's URL treats "\\" as interchangeable with "/" on special
|
|
228
|
+
// schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by
|
|
229
|
+
// Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.
|
|
230
|
+
const cases = [
|
|
231
|
+
'http:\\\\evil.com/path',
|
|
232
|
+
'http:/\\evil.com/path',
|
|
233
|
+
'http:\\/evil.com/path',
|
|
234
|
+
'ws:\\\\evil.com/chat',
|
|
235
|
+
'wss:\\\\evil.com/chat',
|
|
236
|
+
'ftp:\\\\evil.com/',
|
|
237
|
+
'\\\\evil.com/path'
|
|
238
|
+
]
|
|
239
|
+
|
|
240
|
+
t.plan(cases.length)
|
|
241
|
+
|
|
242
|
+
cases.forEach((input) => {
|
|
243
|
+
t.equal(
|
|
244
|
+
fastURI.parse(input).error,
|
|
245
|
+
'URI authority must not contain a literal backslash.',
|
|
246
|
+
input
|
|
247
|
+
)
|
|
248
|
+
})
|
|
249
|
+
})
|
|
250
|
+
|
|
251
|
+
test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {
|
|
252
|
+
const cases = [
|
|
253
|
+
'http:\\\\evil.com/path',
|
|
254
|
+
'http:/\\evil.com/path'
|
|
255
|
+
]
|
|
256
|
+
|
|
257
|
+
t.plan(cases.length)
|
|
258
|
+
|
|
259
|
+
cases.forEach((input) => {
|
|
260
|
+
t.equal(fastURI.normalize(input), input, input)
|
|
261
|
+
})
|
|
262
|
+
})
|
|
263
|
+
|
|
264
|
+
test('equal returns false for malformed-authority-introducer URIs', (t) => {
|
|
265
|
+
const pairs = [
|
|
266
|
+
['http:\\\\evil.com/path', 'http://evil.com/path'],
|
|
267
|
+
['http:/\\evil.com/path', 'http://evil.com/path']
|
|
268
|
+
]
|
|
269
|
+
|
|
270
|
+
t.plan(pairs.length)
|
|
271
|
+
|
|
272
|
+
pairs.forEach(([left, right]) => {
|
|
273
|
+
t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)
|
|
274
|
+
})
|
|
275
|
+
})
|
|
276
|
+
|
|
277
|
+
test('resolve throws on malformed authority introducer', (t) => {
|
|
278
|
+
// resolve() returns a plain string with no error field, so the only safe
|
|
279
|
+
// behavior is to throw when either component has a malformed authority.
|
|
280
|
+
const pairs = [
|
|
281
|
+
['https://allowed.com/', '\\\\evil.com/path'],
|
|
282
|
+
['\\\\evil.com/path', 'https://allowed.com/'],
|
|
283
|
+
['https://allowed.com/', 'http:/\\evil.com/path'],
|
|
284
|
+
['https://allowed.com/', 'http:\\/evil.com/path']
|
|
285
|
+
]
|
|
286
|
+
|
|
287
|
+
t.plan(pairs.length)
|
|
288
|
+
|
|
289
|
+
pairs.forEach(([base, rel]) => {
|
|
290
|
+
t.throws(
|
|
291
|
+
() => fastURI.resolve(base, rel),
|
|
292
|
+
/URI authority must not contain a literal backslash/,
|
|
293
|
+
`${base} + ${rel}`
|
|
294
|
+
)
|
|
295
|
+
})
|
|
296
|
+
})
|
|
297
|
+
|
|
298
|
+
test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {
|
|
299
|
+
// The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from
|
|
300
|
+
// the input before parsing, so a stripped character wedged into the introducer
|
|
301
|
+
// ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node
|
|
302
|
+
// while fast-uri would otherwise fold it into the path. These must be rejected
|
|
303
|
+
// like the adjacent "\\", "/\\", "\\/" forms.
|
|
304
|
+
const cases = [
|
|
305
|
+
{ input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
|
|
306
|
+
{ input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
|
|
307
|
+
{ input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
|
|
308
|
+
{ input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
|
|
309
|
+
{ input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },
|
|
310
|
+
{ input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },
|
|
311
|
+
{ input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }
|
|
312
|
+
]
|
|
313
|
+
|
|
314
|
+
t.plan(cases.length)
|
|
315
|
+
|
|
316
|
+
cases.forEach(({ input, expectedError }) => {
|
|
317
|
+
t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))
|
|
318
|
+
})
|
|
319
|
+
})
|
|
320
|
+
|
|
321
|
+
test('resolve throws on a whitespace-split authority introducer', (t) => {
|
|
322
|
+
const pairs = [
|
|
323
|
+
['https://allowed.com/', '/\t\\evil.com/path'],
|
|
324
|
+
['https://allowed.com/', '/\t/evil.com/path'],
|
|
325
|
+
['https://allowed.com/', '/\n\\evil.com/path'],
|
|
326
|
+
['/\t/evil.com/path', 'https://allowed.com/']
|
|
327
|
+
]
|
|
328
|
+
|
|
329
|
+
t.plan(pairs.length)
|
|
330
|
+
|
|
331
|
+
pairs.forEach(([base, rel]) => {
|
|
332
|
+
t.throws(
|
|
333
|
+
() => fastURI.resolve(base, rel),
|
|
334
|
+
/URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,
|
|
335
|
+
`${JSON.stringify(base)} + ${JSON.stringify(rel)}`
|
|
336
|
+
)
|
|
337
|
+
})
|
|
338
|
+
})
|
|
339
|
+
|
|
340
|
+
test('parse does not reject valid authority introducer patterns', (t) => {
|
|
341
|
+
// No false positives: "//" introducer and scheme-less "//" must be valid.
|
|
342
|
+
const cases = [
|
|
343
|
+
'http://good.com/',
|
|
344
|
+
'https://good.com/',
|
|
345
|
+
'ws://good.com/chat',
|
|
346
|
+
'wss://good.com/chat',
|
|
347
|
+
'ftp://good.com/',
|
|
348
|
+
'//good.com/path',
|
|
349
|
+
'/absolute/path',
|
|
350
|
+
'relative/path'
|
|
351
|
+
]
|
|
352
|
+
|
|
353
|
+
t.plan(cases.length)
|
|
354
|
+
|
|
355
|
+
cases.forEach((input) => {
|
|
356
|
+
const parsed = fastURI.parse(input)
|
|
357
|
+
t.notOk(parsed.error, input)
|
|
358
|
+
})
|
|
359
|
+
})
|
|
@@ -92,6 +92,10 @@ const proxy = async (input, proxyInit) => {
|
|
|
92
92
|
req.headers.delete("accept-encoding");
|
|
93
93
|
const res = await (customFetch || fetch)(req);
|
|
94
94
|
const resHeaders = new Headers(res.headers);
|
|
95
|
+
const connectionValue = resHeaders.get("connection");
|
|
96
|
+
if (connectionValue) {
|
|
97
|
+
connectionValue.split(",").map((h) => h.trim()).filter((h) => ALLOWED_TOKEN_PATTERN.test(h)).forEach((h) => resHeaders.delete(h));
|
|
98
|
+
}
|
|
95
99
|
hopByHopHeaders.forEach((header) => {
|
|
96
100
|
resHeaders.delete(header);
|
|
97
101
|
});
|
|
@@ -315,15 +315,7 @@ const shallowEqual = (a, b) => {
|
|
|
315
315
|
return true;
|
|
316
316
|
};
|
|
317
317
|
const memo = (component, propsAreEqual = shallowEqual) => {
|
|
318
|
-
|
|
319
|
-
let prevProps = void 0;
|
|
320
|
-
const wrapper = ((props) => {
|
|
321
|
-
if (prevProps && !propsAreEqual(prevProps, props)) {
|
|
322
|
-
computed = null;
|
|
323
|
-
}
|
|
324
|
-
prevProps = props;
|
|
325
|
-
return computed ||= component(props);
|
|
326
|
-
});
|
|
318
|
+
const wrapper = ((props) => component(props));
|
|
327
319
|
wrapper[import_constants.DOM_MEMO] = propsAreEqual;
|
|
328
320
|
wrapper[import_constants.DOM_RENDERER] = component;
|
|
329
321
|
return wrapper;
|
|
@@ -330,19 +330,22 @@ const useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
|
|
|
330
330
|
}
|
|
331
331
|
return getServerSnapshot();
|
|
332
332
|
}
|
|
333
|
-
const
|
|
334
|
-
const [
|
|
335
|
-
|
|
336
|
-
|
|
333
|
+
const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
|
|
334
|
+
const [, setVersion] = useState(0);
|
|
335
|
+
const latestSnapshot = useRef([snapshot, getSnapshot]);
|
|
336
|
+
latestSnapshot.current = [snapshot, getSnapshot];
|
|
337
|
+
const unsubscribeRef = useRef(null);
|
|
337
338
|
useEffect(() => {
|
|
338
|
-
|
|
339
|
-
|
|
339
|
+
const update2 = () => setVersion((version) => version + 1);
|
|
340
|
+
unsubscribeRef.current?.();
|
|
341
|
+
unsubscribeRef.current = subscribe(update2);
|
|
342
|
+
const [snapshot2, getSnapshot2] = latestSnapshot.current;
|
|
343
|
+
if (!Object.is(snapshot2, getSnapshot2())) {
|
|
344
|
+
update2();
|
|
340
345
|
}
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
}, []);
|
|
345
|
-
return state;
|
|
346
|
+
}, [subscribe]);
|
|
347
|
+
useEffect(() => () => unsubscribeRef.current?.(), []);
|
|
348
|
+
return snapshot;
|
|
346
349
|
};
|
|
347
350
|
// Annotate the CommonJS export names for ESM import in node:
|
|
348
351
|
0 && (module.exports = {
|
|
@@ -79,7 +79,7 @@ const cors = (options) => {
|
|
|
79
79
|
if (!headers?.length) {
|
|
80
80
|
const requestHeaders = c.req.header("Access-Control-Request-Headers");
|
|
81
81
|
if (requestHeaders) {
|
|
82
|
-
headers = requestHeaders.split(
|
|
82
|
+
headers = requestHeaders.split(",").map((h) => h.trim());
|
|
83
83
|
}
|
|
84
84
|
}
|
|
85
85
|
if (headers?.length) {
|
|
@@ -69,14 +69,18 @@ const normalizeLanguage = (lang, options) => {
|
|
|
69
69
|
if (exactIndex !== -1) {
|
|
70
70
|
return options.supportedLanguages[exactIndex];
|
|
71
71
|
}
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
const
|
|
76
|
-
if (
|
|
77
|
-
|
|
72
|
+
let longestMatchIndex = -1;
|
|
73
|
+
let longestMatchLength = -1;
|
|
74
|
+
for (let i = 0; i < compSupported.length; i++) {
|
|
75
|
+
const candidate = compSupported[i];
|
|
76
|
+
if (candidate.length < compLang.length && candidate.length > longestMatchLength && compLang.startsWith(candidate) && compLang[candidate.length] === "-") {
|
|
77
|
+
longestMatchIndex = i;
|
|
78
|
+
longestMatchLength = candidate.length;
|
|
78
79
|
}
|
|
79
80
|
}
|
|
81
|
+
if (longestMatchIndex !== -1) {
|
|
82
|
+
return options.supportedLanguages[longestMatchIndex];
|
|
83
|
+
}
|
|
80
84
|
return void 0;
|
|
81
85
|
} catch {
|
|
82
86
|
return void 0;
|
|
@@ -47,6 +47,7 @@ const verifySignature = async (base64Signature, value, secret) => {
|
|
|
47
47
|
}
|
|
48
48
|
};
|
|
49
49
|
const validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
|
|
50
|
+
const relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
|
|
50
51
|
const validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
|
|
51
52
|
const trimCookieWhitespace = (value) => {
|
|
52
53
|
let start = 0;
|
|
@@ -79,7 +80,7 @@ const parse = (cookie, name) => {
|
|
|
79
80
|
continue;
|
|
80
81
|
}
|
|
81
82
|
const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
|
|
82
|
-
if (name && name !== cookieName || !
|
|
83
|
+
if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
|
|
83
84
|
continue;
|
|
84
85
|
}
|
|
85
86
|
let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
|
|
@@ -71,6 +71,10 @@ var proxy = async (input, proxyInit) => {
|
|
|
71
71
|
req.headers.delete("accept-encoding");
|
|
72
72
|
const res = await (customFetch || fetch)(req);
|
|
73
73
|
const resHeaders = new Headers(res.headers);
|
|
74
|
+
const connectionValue = resHeaders.get("connection");
|
|
75
|
+
if (connectionValue) {
|
|
76
|
+
connectionValue.split(",").map((h) => h.trim()).filter((h) => ALLOWED_TOKEN_PATTERN.test(h)).forEach((h) => resHeaders.delete(h));
|
|
77
|
+
}
|
|
74
78
|
hopByHopHeaders.forEach((header) => {
|
|
75
79
|
resHeaders.delete(header);
|
|
76
80
|
});
|
|
@@ -284,15 +284,7 @@ var shallowEqual = (a, b) => {
|
|
|
284
284
|
return true;
|
|
285
285
|
};
|
|
286
286
|
var memo = (component, propsAreEqual = shallowEqual) => {
|
|
287
|
-
|
|
288
|
-
let prevProps = void 0;
|
|
289
|
-
const wrapper = ((props) => {
|
|
290
|
-
if (prevProps && !propsAreEqual(prevProps, props)) {
|
|
291
|
-
computed = null;
|
|
292
|
-
}
|
|
293
|
-
prevProps = props;
|
|
294
|
-
return computed ||= component(props);
|
|
295
|
-
});
|
|
287
|
+
const wrapper = ((props) => component(props));
|
|
296
288
|
wrapper[DOM_MEMO] = propsAreEqual;
|
|
297
289
|
wrapper[DOM_RENDERER] = component;
|
|
298
290
|
return wrapper;
|
|
@@ -289,19 +289,22 @@ var useSyncExternalStore = (subscribe, getSnapshot, getServerSnapshot) => {
|
|
|
289
289
|
}
|
|
290
290
|
return getServerSnapshot();
|
|
291
291
|
}
|
|
292
|
-
const
|
|
293
|
-
const [
|
|
294
|
-
|
|
295
|
-
|
|
292
|
+
const snapshot = buildData[0][4] && getServerSnapshot ? getServerSnapshot() : getSnapshot();
|
|
293
|
+
const [, setVersion] = useState(0);
|
|
294
|
+
const latestSnapshot = useRef([snapshot, getSnapshot]);
|
|
295
|
+
latestSnapshot.current = [snapshot, getSnapshot];
|
|
296
|
+
const unsubscribeRef = useRef(null);
|
|
296
297
|
useEffect(() => {
|
|
297
|
-
|
|
298
|
-
|
|
298
|
+
const update2 = () => setVersion((version) => version + 1);
|
|
299
|
+
unsubscribeRef.current?.();
|
|
300
|
+
unsubscribeRef.current = subscribe(update2);
|
|
301
|
+
const [snapshot2, getSnapshot2] = latestSnapshot.current;
|
|
302
|
+
if (!Object.is(snapshot2, getSnapshot2())) {
|
|
303
|
+
update2();
|
|
299
304
|
}
|
|
300
|
-
|
|
301
|
-
|
|
302
|
-
|
|
303
|
-
}, []);
|
|
304
|
-
return state;
|
|
305
|
+
}, [subscribe]);
|
|
306
|
+
useEffect(() => () => unsubscribeRef.current?.(), []);
|
|
307
|
+
return snapshot;
|
|
305
308
|
};
|
|
306
309
|
export {
|
|
307
310
|
STASH_EFFECT,
|
|
@@ -58,7 +58,7 @@ var cors = (options) => {
|
|
|
58
58
|
if (!headers?.length) {
|
|
59
59
|
const requestHeaders = c.req.header("Access-Control-Request-Headers");
|
|
60
60
|
if (requestHeaders) {
|
|
61
|
-
headers = requestHeaders.split(
|
|
61
|
+
headers = requestHeaders.split(",").map((h) => h.trim());
|
|
62
62
|
}
|
|
63
63
|
}
|
|
64
64
|
if (headers?.length) {
|
|
@@ -39,14 +39,18 @@ var normalizeLanguage = (lang, options) => {
|
|
|
39
39
|
if (exactIndex !== -1) {
|
|
40
40
|
return options.supportedLanguages[exactIndex];
|
|
41
41
|
}
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
const
|
|
46
|
-
if (
|
|
47
|
-
|
|
42
|
+
let longestMatchIndex = -1;
|
|
43
|
+
let longestMatchLength = -1;
|
|
44
|
+
for (let i = 0; i < compSupported.length; i++) {
|
|
45
|
+
const candidate = compSupported[i];
|
|
46
|
+
if (candidate.length < compLang.length && candidate.length > longestMatchLength && compLang.startsWith(candidate) && compLang[candidate.length] === "-") {
|
|
47
|
+
longestMatchIndex = i;
|
|
48
|
+
longestMatchLength = candidate.length;
|
|
48
49
|
}
|
|
49
50
|
}
|
|
51
|
+
if (longestMatchIndex !== -1) {
|
|
52
|
+
return options.supportedLanguages[longestMatchIndex];
|
|
53
|
+
}
|
|
50
54
|
return void 0;
|
|
51
55
|
} catch {
|
|
52
56
|
return void 0;
|
|
@@ -23,6 +23,7 @@ var verifySignature = async (base64Signature, value, secret) => {
|
|
|
23
23
|
}
|
|
24
24
|
};
|
|
25
25
|
var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
|
|
26
|
+
var relaxedCookieNameRegEx = /^[!#-:<>-[\]-~]+$/;
|
|
26
27
|
var validCookieValueRegEx = /^[ !#-:<-[\]-~]*$/;
|
|
27
28
|
var trimCookieWhitespace = (value) => {
|
|
28
29
|
let start = 0;
|
|
@@ -55,7 +56,7 @@ var parse = (cookie, name) => {
|
|
|
55
56
|
continue;
|
|
56
57
|
}
|
|
57
58
|
const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));
|
|
58
|
-
if (name && name !== cookieName || !
|
|
59
|
+
if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {
|
|
59
60
|
continue;
|
|
60
61
|
}
|
|
61
62
|
let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));
|