@unchainedshop/api 3.1.10 → 3.1.12

package/lib/utils/inputValidation.js

@@ -0,0 +1,51 @@
+import { GraphQLError } from 'graphql';
+// Dangerous patterns to check for
+const DANGEROUS_PATTERNS = [
+    /<script/i, // Script tags
+    /<iframe/i, // Iframes
+    /<object/i, // Object embeds
+    /<embed/i, // Embed tags
+    /<link/i, // Link tags (can load CSS)
+    /javascript:/i, // JavaScript protocol
+    /vbscript:/i, // VBScript protocol
+    /on\w+\s*=/i, // Event handlers (onclick, onload, etc)
+    /<meta/i, // Meta tags
+    /data:text\/html/i, // Data URLs with HTML
+    /<svg.*onload/i, // SVG with event handlers
+    /&#x?[0-9a-f]+;/i, // HTML entities (could be obfuscation)
+    /\\u[0-9a-f]{4}/i, // Unicode escapes
+    /expression\s*\(/i, // CSS expressions
+    /@import/i, // CSS imports
+    /<!--|-->/, // HTML comments
+];
+// Check for dangerous patterns in any string
+export function checkForDangerousContent(value) {
+    if (!value)
+        return;
+    for (const dangerous of DANGEROUS_PATTERNS) {
+        if (dangerous.test(value)) {
+            throw new GraphQLError('Input contains potentially dangerous content', {
+                extensions: { code: 'SECURITY_VALIDATION_ERROR' },
+            });
+        }
+    }
+}
+// Validate an entire object recursively
+export function validateObject(obj, path = '') {
+    if (typeof obj === 'string') {
+        checkForDangerousContent(obj);
+        return obj;
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item, index) => validateObject(item, `${path}[${index}]`));
+    }
+    if (obj && typeof obj === 'object') {
+        const validated = {};
+        for (const [key, value] of Object.entries(obj)) {
+            validated[key] = validateObject(value, path ? `${path}.${key}` : key);
+        }
+        return validated;
+    }
+    return obj;
+}
+//# sourceMappingURL=inputValidation.js.map

package/lib/utils/inputValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputValidation.js","sourceRoot":"","sources":["../../src/utils/inputValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,kCAAkC;AAClC,MAAM,kBAAkB,GAAG;IACzB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,gBAAgB;IAC5B,SAAS,EAAE,aAAa;IACxB,QAAQ,EAAE,2BAA2B;IACrC,cAAc,EAAE,sBAAsB;IACtC,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,wCAAwC;IACtD,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,sBAAsB;IAC1C,eAAe,EAAE,0BAA0B;IAC3C,iBAAiB,EAAE,uCAAuC;IAC1D,iBAAiB,EAAE,kBAAkB;IACrC,kBAAkB,EAAE,kBAAkB;IACtC,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,gBAAgB;CAC7B,CAAC;AAEF,6CAA6C;AAC7C,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,KAAK,MAAM,SAAS,IAAI,kBAAkB,EAAE,CAAC;QAC3C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,YAAY,CAAC,8CAA8C,EAAE;gBACrE,UAAU,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,cAAc,CAAC,GAAQ,EAAE,IAAI,GAAG,EAAE;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/api",
-  "version": "3.1.10",
+  "version": "3.1.12",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",

package/src/loaders/buildLocaleMap.test.ts

@@ -0,0 +1,72 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import buildLocaleMap from './buildLocaleMap.js';
+
+const testTexts = [
+  // 1 has translations in French and German
+  { locale: 'fr', _id: '1', entityId: '1' },
+  { locale: 'de', _id: '2', entityId: '1' },
+  
+  // 2 only has Ialien translations
+  { locale: 'it', _id: '3', entityId: '2' },
+
+  // 3 only has English translations
+  { locale: 'en', _id: '4', entityId: '3' },
+
+  // 4 only has German translations
+  { locale: 'de', _id: '5', entityId: '4' },
+];
+
+describe('buildLocaleMap', () => {
+  it('Mixed usage of default locale and forced languages', () => {
+    const queries = [
+      { locale: 'de-CH' },
+      { locale: 'fr' },
+      { locale: 'it' },
+    ];
+    const expected = {
+      'de': ['de-CH', 'fr', 'it'],
+      'fr': ['fr'],
+      'it': ['it'],
+    };
+    const result = buildLocaleMap(queries, testTexts);
+    assert.deepStrictEqual(result, expected);
+  });
+
+  it('Mixed usage of forced languages', () => {
+    const queries = [
+      { locale: 'fr' },
+      { locale: 'it' },
+    ];
+    const expected = {
+      'de': ['fr', 'it'],
+      'fr': ['fr'],
+      'it': ['it'],
+    };
+    const result = buildLocaleMap(queries, testTexts);
+    assert.deepStrictEqual(result, expected);
+  });
+
+  it('Only default locale', () => {
+    const queries = [
+      { locale: 'de_CH' },
+    ];
+    const expected = {
+      'de': ['de_CH'],
+    };
+    const result = buildLocaleMap(queries, testTexts);
+    assert.deepStrictEqual(result, expected);
+  });
+
+  it('Only one forced language locale', () => {
+    const queries = [
+      { locale: 'fr' },
+    ];
+    const expected = {
+      'fr': ['fr'],
+      'de': ['fr'],
+    };
+    const result = buildLocaleMap(queries, testTexts);
+    assert.deepStrictEqual(result, expected);
+  });
+});

package/src/loaders/buildLocaleMap.ts

@@ -0,0 +1,39 @@
+import { systemLocale } from '@unchainedshop/utils';
+
+function getLocaleStrings(locale: string): string[] {
+  try {
+    const localeObj = new Intl.Locale(locale);
+    // Optimized Set creation and spread
+    const locales = new Set<string>();
+    locales.add(localeObj.baseName);
+    locales.add(localeObj.language);
+    locales.add(systemLocale.baseName);
+    locales.add(systemLocale.language);
+    return Array.from(locales);
+  } catch {
+    // Optimized Set creation and spread
+    const locales = new Set<string>();
+    locales.add(systemLocale.baseName);
+    locales.add(systemLocale.language);
+    return Array.from(locales);
+  }
+}
+export default function buildLocaleMap(
+  queries: Readonly<Array<{ locale: string }>>,
+  texts: Readonly<Array<{ locale?: string }>>,
+): Record<string, string[]> {
+  // key = texts.locale
+  // value = input query locale
+  const queryLocales = new Set(queries.map((q) => q.locale));
+  const textLocales = new Set(texts.map((t) => t.locale));
+  const localeMap = {};
+  for (const queryLocale of queryLocales) {
+    const potentialMatches = getLocaleStrings(queryLocale);
+    const matches = potentialMatches.filter((l) => textLocales.has(l));
+    for (const match of matches) {
+      if (!localeMap[match]) localeMap[match] = [];
+      localeMap[match].push(queryLocale);
+    }
+  }
+  return localeMap;
+}

package/src/loaders/buildTextMap.test.ts

@@ -0,0 +1,55 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import buildTextMap from './buildTextMap.js';
+
+const testTexts = [
+  // 1 has translations in French and German
+  { locale: 'fr', _id: 'french-1', entityId: '1' },
+  { locale: 'de', _id: 'german-1', entityId: '1' },
+  
+  // 2 only has Ialien translations
+  { locale: 'it', _id: 'italian-2', entityId: '2' },
+
+  // 3 only has English translations
+  { locale: 'en', _id: 'english-3', entityId: '3' },
+
+  // 4 only has German translations
+  { locale: 'de', _id: 'german-4', entityId: '4' },
+];
+
+describe('buildTextMap', () => {
+  it('Generate a correct text map for all fallbacks', () => {
+    const localeMap = {
+      'de': ['de-CH', 'fr', 'it'],
+      'fr': ['fr'],
+      'it': ['it'],
+    };
+    const expected = {
+      'de-CH1': {
+        _id: 'german-1',
+      },
+      'fr1': {
+        _id: 'french-1',
+      },
+      'it1': {
+        _id: 'german-1',
+      },
+      'de-CH4': {
+        _id: 'german-4',
+      },
+      'fr4': {
+        _id: 'german-4',
+      },
+      'it4': {
+        _id: 'german-4',
+      },
+      'it2': {
+        _id: 'italian-2',
+      },
+    };
+    const result = buildTextMap(localeMap, testTexts, (text) => text.entityId);
+
+    assert.partialDeepStrictEqual(result, expected);
+  });
+
+});

package/src/loaders/buildTextMap.ts

@@ -1,17 +1,33 @@
 type ArrayElement<T> = T extends (infer U)[] ? U : never;
 
+/* This file has been optimized for performance to the last drop. Don't refactor! */
+
 export default function buildTextMap<T extends Array<{ locale?: string }>>(
   localeMap: Record<string, string[]>,
   texts: Readonly<T>,
   buildId: (item: ArrayElement<T>) => string,
 ) {
-  const textsMap = {};
-  for (const [originLocale, localesForText] of Object.entries(localeMap)) {
-    for (const text of texts) {
+  const textsMap: Record<string, ArrayElement<T>> = {}; // Added type for textsMap
+  const localeMapKeys = Object.keys(localeMap);
+
+  for (let i = 0; i < localeMapKeys.length; i++) {
+    const originLocale = localeMapKeys[i];
+    const localesForText = localeMap[originLocale];
+
+    for (let j = 0; j < texts.length; j++) {
+      const text = texts[j];
       if (originLocale !== text.locale) continue;
-      for (const locale of localesForText) {
-        if (textsMap[locale + buildId(text as any)]) continue;
-        textsMap[locale + buildId(text as any)] = text;
+
+      const idPart = buildId(text as ArrayElement<T>); // Ensured correct type for buildId argument
+
+      for (let k = 0; k < localesForText.length; k++) {
+        const locale = localesForText[k];
+        const key = locale + idPart;
+        if (textsMap[key] && locale !== text.locale) {
+          // If the key already exists and the locale is a fallback, skip this text
+          continue;
+        }
+        textsMap[key] = text as ArrayElement<T>; // Ensured correct type for assignment
       }
     }
   }

package/src/loaders/index.ts

@@ -1,5 +1,4 @@
 import DataLoader from 'dataloader';
-import { systemLocale } from '@unchainedshop/utils';
 import { UnchainedCore } from '@unchainedshop/core';
 import { Product, ProductText, ProductMediaText, ProductMedia } from '@unchainedshop/core-products';
 import { Filter, FilterText } from '@unchainedshop/core-filters';
@@ -13,37 +12,8 @@ import {
 } from '@unchainedshop/core-assortments';
 import { File } from '@unchainedshop/core-files';
 import buildTextMap from './buildTextMap.js';
+import buildLocaleMap from './buildLocaleMap.js';
 
-function getLocaleStrings(locale: string) {
-  try {
-    const localeObj = new Intl.Locale(locale);
-    return [
-      ...new Set([localeObj.baseName, localeObj.language, systemLocale.baseName, systemLocale.language]),
-    ];
-  } catch {
-    return [...new Set([systemLocale.baseName, systemLocale.language])];
-  }
-}
-
-function buildLocaleMap(
-  queries: Readonly<Array<{ locale: string }>>,
-  texts: Readonly<Array<{ locale?: string }>>,
-): Record<string, string[]> {
-  // key = texts.locale
-  // value = input query locale
-  const queryLocales: Array<any> = [...new Set(queries.map((q) => q.locale))];
-  const textLocales: Array<string> = [...new Set(texts.map((t) => t.locale))];
-  const localeMap = {};
-  for (const queryLocale of queryLocales) {
-    const potentialMatches = getLocaleStrings(queryLocale);
-    const matches = potentialMatches.filter((l) => textLocales.includes(l));
-    for (const match of matches) {
-      if (!localeMap[match]) localeMap[match] = [];
-      localeMap[match].push(queryLocale);
-    }
-  }
-  return localeMap;
-}
 
 const loaders = async (unchainedAPI: UnchainedCore) => {
   return {

package/src/schema/mutation.ts

@@ -339,7 +339,7 @@ export default [
       """
       Set a new password for a specific user
       """
-      setPassword(newPassword!: String, userId: ID!): User!
+      setPassword(newPassword: String!, userId: ID!): User!
 
       """
       Set roles of a user