@ukhomeoffice/cop-react-form-renderer 5.19.2 → 5.20.1

package/dist/utils/Validate/additional/index.js

@@ -17,6 +17,7 @@ var _mustBeLessThan = _interopRequireDefault(require("./mustBeLessThan"));
 var _mustBeNumbersOnly = _interopRequireDefault(require("./mustBeNumbersOnly"));
 var _mustEnterAtLeastOne = _interopRequireDefault(require("./mustEnterAtLeastOne"));
 var _mustHaveLessThanDecimalPlaces = _interopRequireDefault(require("./mustHaveLessThanDecimalPlaces"));
+var _mustNotContainSql = _interopRequireDefault(require("./mustNotContainSql"));
 var _mustSelectOnlyOne = _interopRequireDefault(require("./mustSelectOnlyOne"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 // Local imports
@@ -26,15 +27,16 @@ var functions = {
   mustBeAfter: _mustBeAfter.default,
   mustBeBefore: _mustBeBefore.default,
   mustBeEarlierDateTime: _mustBeEarlierDateTime.default,
-  mustBeInThePast: _mustBeInThePast.default,
+  mustBeGreaterThan: _mustBeGreaterThan.default,
   mustBeInTheFuture: _mustBeInTheFuture.default,
+  mustBeInThePast: _mustBeInThePast.default,
+  mustBeLessThan: _mustBeLessThan.default,
   mustBeLongerThan: _mustBeLongerThan.default,
+  mustBeNumbersOnly: _mustBeNumbersOnly.default,
   mustBeShorterThan: _mustBeShorterThan.default,
   mustEnterAtLeastOne: _mustEnterAtLeastOne.default,
-  mustBeNumbersOnly: _mustBeNumbersOnly.default,
-  mustBeLessThan: _mustBeLessThan.default,
-  mustBeGreaterThan: _mustBeGreaterThan.default,
   mustHaveLessThanDecimalPlaces: _mustHaveLessThanDecimalPlaces.default,
+  mustNotContainSql: _mustNotContainSql.default,
   mustSelectOnlyOne: _mustSelectOnlyOne.default
 };
 var additionalValidation = function additionalValidation(value, config, component) {

package/dist/utils/Validate/additional/mustNotContainSql.js

@@ -0,0 +1,20 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+function _typeof(obj) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (obj) { return typeof obj; } : function (obj) { return obj && "function" == typeof Symbol && obj.constructor === Symbol && obj !== Symbol.prototype ? "symbol" : typeof obj; }, _typeof(obj); }
+// NOTE: SQL RegEx reference:
+// http://www.symantec.com/connect/articles/detection-sql-injection-and-cross-site-scripting-attacks
+var SQL_COMBINED = /(%27)|(')|(--)|(%23)|(#)|((%3D)|(=))[^\n]*((%27)|(')|(--)|(%3B)|(;))|w*((%27)|('))((%6F)|o|(%4F))((%72)|r|(%52))|((%27)|('))union/i;
+var mustNotContainSql = function mustNotContainSql(value) {
+  // eslint-disable-next-line no-extra-boolean-cast
+  if (!!value) {
+    var string = _typeof(value) === 'object' ? JSON.stringify(value) : String(value);
+    return !SQL_COMBINED.test(string);
+  }
+  return false;
+};
+var _default = mustNotContainSql;
+exports.default = _default;

package/dist/utils/Validate/additional/mustNotContainSql.test.js

@@ -0,0 +1,32 @@
+"use strict";
+
+var _mustNotContainSql = _interopRequireDefault(require("./mustNotContainSql"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+describe('utils', function () {
+  describe('Validate', function () {
+    describe('additional', function () {
+      describe('mustNotContainSql', function () {
+        test('should return true given a string not containing sql characters', function () {
+          var result = (0, _mustNotContainSql.default)('test');
+          expect(result).toEqual(true);
+        });
+        test('should return true given non-string datatype is converted to string', function () {
+          var result = (0, _mustNotContainSql.default)(123);
+          expect(result).toEqual(true);
+        });
+        test('should return false given a string containing sql characters', function () {
+          var result = (0, _mustNotContainSql.default)("test' OR '1'='1'");
+          expect(result).toEqual(false);
+        });
+        test('should return false given string is null', function () {
+          var result = (0, _mustNotContainSql.default)(null);
+          expect(result).toEqual(false);
+        });
+        test('should return false given string is not defined', function () {
+          var result = (0, _mustNotContainSql.default)(undefined);
+          expect(result).toEqual(false);
+        });
+      });
+    });
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ukhomeoffice/cop-react-form-renderer",
-  "version": "5.19.2",
+  "version": "5.20.1",
   "private": false,
   "scripts": {
     "clean": "rimraf dist",
@@ -16,7 +16,7 @@
     "post-compile": "rimraf dist/*.test.* dist/**/*.test.* dist/**/*.stories.* dist/docs dist/assets"
   },
   "dependencies": {
-    "@ukhomeoffice/cop-react-components": "^3.6.2",
+    "@ukhomeoffice/cop-react-components": "^3.9.0",
     "axios": "^0.23.0",
     "dayjs": "^1.11.0",
     "govuk-frontend": "^4.3.1",