@verdaccio/middleware 6.0.0-6-next.51 → 6.0.0-6-next.53
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +24 -0
- package/build/index.d.ts +1 -1
- package/build/index.js +7 -0
- package/build/index.js.map +1 -1
- package/build/middlewares/validation.d.ts +3 -2
- package/build/middlewares/validation.js +4 -11
- package/build/middlewares/validation.js.map +1 -1
- package/build/middlewares/web/index.d.ts +3 -0
- package/build/middlewares/web/index.js +21 -0
- package/build/middlewares/web/index.js.map +1 -1
- package/build/middlewares/web/web-api.d.ts +2 -1
- package/build/middlewares/web/web-api.js +4 -4
- package/build/middlewares/web/web-api.js.map +1 -1
- package/build/middlewares/web/web-middleware.js +1 -1
- package/build/middlewares/web/web-middleware.js.map +1 -1
- package/package.json +6 -6
- package/src/index.ts +1 -1
- package/src/middlewares/validation.ts +21 -17
- package/src/middlewares/web/index.ts +3 -0
- package/src/middlewares/web/web-api.ts +8 -5
- package/src/middlewares/web/web-middleware.ts +2 -2
- package/test/final.spec.ts +2 -1
- package/test/json.spec.ts +2 -2
- package/test/params.spec.ts +1 -47
- package/test/validation.spec.ts +92 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,29 @@
|
|
|
1
1
|
# @verdaccio/middleware
|
|
2
2
|
|
|
3
|
+
## 6.0.0-6-next.53
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- ae93e039d: fix: expose middleware methods
|
|
8
|
+
|
|
9
|
+
### Patch Changes
|
|
10
|
+
|
|
11
|
+
- @verdaccio/core@6.0.0-6-next.74
|
|
12
|
+
- @verdaccio/config@6.0.0-6-next.74
|
|
13
|
+
- @verdaccio/url@11.0.0-6-next.40
|
|
14
|
+
- @verdaccio/utils@6.0.0-6-next.42
|
|
15
|
+
|
|
16
|
+
## 6.0.0-6-next.52
|
|
17
|
+
|
|
18
|
+
### Patch Changes
|
|
19
|
+
|
|
20
|
+
- f859d2b1a: fix: official package "-" cannot be synced
|
|
21
|
+
- Updated dependencies [f859d2b1a]
|
|
22
|
+
- @verdaccio/core@6.0.0-6-next.73
|
|
23
|
+
- @verdaccio/config@6.0.0-6-next.73
|
|
24
|
+
- @verdaccio/url@11.0.0-6-next.39
|
|
25
|
+
- @verdaccio/utils@6.0.0-6-next.41
|
|
26
|
+
|
|
3
27
|
## 6.0.0-6-next.51
|
|
4
28
|
|
|
5
29
|
### Patch Changes
|
package/build/index.d.ts
CHANGED
|
@@ -9,7 +9,7 @@ export { final } from './middlewares/final';
|
|
|
9
9
|
export { allow } from './middlewares/allow';
|
|
10
10
|
export { rateLimit } from './middlewares/rate-limit';
|
|
11
11
|
export { userAgent } from './middlewares/user-agent';
|
|
12
|
-
export { webMiddleware } from './middlewares/web';
|
|
12
|
+
export { webMiddleware, renderWebMiddleware } from './middlewares/web';
|
|
13
13
|
export { errorReportingMiddleware, handleError } from './middlewares/error';
|
|
14
14
|
export { log, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, } from './middlewares/log';
|
|
15
15
|
export * from './types';
|
package/build/index.js
CHANGED
|
@@ -17,6 +17,7 @@ var _exportNames = {
|
|
|
17
17
|
rateLimit: true,
|
|
18
18
|
userAgent: true,
|
|
19
19
|
webMiddleware: true,
|
|
20
|
+
renderWebMiddleware: true,
|
|
20
21
|
errorReportingMiddleware: true,
|
|
21
22
|
handleError: true,
|
|
22
23
|
log: true,
|
|
@@ -108,6 +109,12 @@ Object.defineProperty(exports, "rateLimit", {
|
|
|
108
109
|
return _rateLimit.rateLimit;
|
|
109
110
|
}
|
|
110
111
|
});
|
|
112
|
+
Object.defineProperty(exports, "renderWebMiddleware", {
|
|
113
|
+
enumerable: true,
|
|
114
|
+
get: function () {
|
|
115
|
+
return _web.renderWebMiddleware;
|
|
116
|
+
}
|
|
117
|
+
});
|
|
111
118
|
Object.defineProperty(exports, "setSecurityWebHeaders", {
|
|
112
119
|
enumerable: true,
|
|
113
120
|
get: function () {
|
package/build/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":["_match","require","_securityHeaders","_validation","_media","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n log,\n LOG_STATUS_MESSAGE,\n LOG_VERDACCIO_BYTES,\n LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\n"],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","names":["_match","require","_securityHeaders","_validation","_media","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n log,\n LOG_STATUS_MESSAGE,\n LOG_VERDACCIO_BYTES,\n LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,UAAA,GAAAT,OAAA;AACA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,IAAA,GAAAX,OAAA;AACA,IAAAY,MAAA,GAAAZ,OAAA;AACA,IAAAa,IAAA,GAAAb,OAAA;AAMA,IAAAc,MAAA,GAAAd,OAAA;AAAAe,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA"}
|
|
@@ -1,2 +1,3 @@
|
|
|
1
|
-
|
|
2
|
-
export declare function
|
|
1
|
+
import { NextFunction, Request, Response } from 'express';
|
|
2
|
+
export declare function validateName(_req: Request, _res: Response, next: NextFunction, value: string, name: string): void;
|
|
3
|
+
export declare function validatePackage(_req: Request, _res: any, next: NextFunction, value: string, name: string): void;
|
|
@@ -6,25 +6,18 @@ Object.defineProperty(exports, "__esModule", {
|
|
|
6
6
|
exports.validateName = validateName;
|
|
7
7
|
exports.validatePackage = validatePackage;
|
|
8
8
|
var _core = require("@verdaccio/core");
|
|
9
|
-
var _utils = require("@verdaccio/utils");
|
|
10
9
|
function validateName(_req, _res, next, value, name) {
|
|
11
|
-
if (value
|
|
12
|
-
// special case in couchdb usually
|
|
13
|
-
next('route');
|
|
14
|
-
} else if ((0, _utils.validateName)(value)) {
|
|
10
|
+
if (_core.validationUtils.validateName(value)) {
|
|
15
11
|
next();
|
|
16
12
|
} else {
|
|
17
|
-
next(_core.errorUtils.
|
|
13
|
+
next(_core.errorUtils.getBadRequest('invalid ' + name));
|
|
18
14
|
}
|
|
19
15
|
}
|
|
20
16
|
function validatePackage(_req, _res, next, value, name) {
|
|
21
|
-
if (value
|
|
22
|
-
// special case in couchdb usually
|
|
23
|
-
next('route');
|
|
24
|
-
} else if ((0, _utils.validatePackage)(value)) {
|
|
17
|
+
if (_core.validationUtils.validatePackage(value)) {
|
|
25
18
|
next();
|
|
26
19
|
} else {
|
|
27
|
-
next(_core.errorUtils.
|
|
20
|
+
next(_core.errorUtils.getBadRequest('invalid ' + name));
|
|
28
21
|
}
|
|
29
22
|
}
|
|
30
23
|
//# sourceMappingURL=validation.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validation.js","names":["_core","require","
|
|
1
|
+
{"version":3,"file":"validation.js","names":["_core","require","validateName","_req","_res","next","value","name","validationUtils","errorUtils","getBadRequest","validatePackage"],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n _req: Request,\n _res: Response,\n next: NextFunction,\n value: string,\n name: string\n) {\n if (validationUtils.validateName(value)) {\n next();\n } else {\n next(errorUtils.getBadRequest('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n _req: Request,\n _res,\n next: NextFunction,\n value: string,\n name: string\n) {\n if (validationUtils.validatePackage(value)) {\n next();\n } else {\n next(errorUtils.getBadRequest('invalid ' + name));\n }\n}\n"],"mappings":";;;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAEO,SAASC,YAAYA,CAC1BC,IAAa,EACbC,IAAc,EACdC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACN,YAAY,CAACI,KAAK,CAAC,EAAE;IACvCD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF;AAEO,SAASI,eAAeA,CAC7BR,IAAa,EACbC,IAAI,EACJC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACG,eAAe,CAACL,KAAK,CAAC,EAAE;IAC1CD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF"}
|
|
@@ -3,6 +3,24 @@
|
|
|
3
3
|
Object.defineProperty(exports, "__esModule", {
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
|
+
Object.defineProperty(exports, "renderWebMiddleware", {
|
|
7
|
+
enumerable: true,
|
|
8
|
+
get: function () {
|
|
9
|
+
return _renderWeb.renderWebMiddleware;
|
|
10
|
+
}
|
|
11
|
+
});
|
|
12
|
+
Object.defineProperty(exports, "setSecurityWebHeaders", {
|
|
13
|
+
enumerable: true,
|
|
14
|
+
get: function () {
|
|
15
|
+
return _security.setSecurityWebHeaders;
|
|
16
|
+
}
|
|
17
|
+
});
|
|
18
|
+
Object.defineProperty(exports, "webAPIMiddleware", {
|
|
19
|
+
enumerable: true,
|
|
20
|
+
get: function () {
|
|
21
|
+
return _webApi.webAPIMiddleware;
|
|
22
|
+
}
|
|
23
|
+
});
|
|
6
24
|
Object.defineProperty(exports, "webMiddleware", {
|
|
7
25
|
enumerable: true,
|
|
8
26
|
get: function () {
|
|
@@ -10,5 +28,8 @@ Object.defineProperty(exports, "webMiddleware", {
|
|
|
10
28
|
}
|
|
11
29
|
});
|
|
12
30
|
var _webMiddleware = _interopRequireDefault(require("./web-middleware"));
|
|
31
|
+
var _webApi = require("./web-api");
|
|
32
|
+
var _security = require("./security");
|
|
33
|
+
var _renderWeb = require("./render-web");
|
|
13
34
|
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
|
|
14
35
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":["_webMiddleware","_interopRequireDefault","require","obj","__esModule","default"],"sources":["../../../src/middlewares/web/index.ts"],"sourcesContent":["export { default as webMiddleware } from './web-middleware';\n"],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","names":["_webMiddleware","_interopRequireDefault","require","_webApi","_security","_renderWeb","obj","__esModule","default"],"sources":["../../../src/middlewares/web/index.ts"],"sourcesContent":["export { default as webMiddleware } from './web-middleware';\nexport { webAPIMiddleware } from './web-api';\nexport { setSecurityWebHeaders } from './security';\nexport { renderWebMiddleware } from './render-web';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,cAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAAmD,SAAAD,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA"}
|
|
@@ -1 +1,2 @@
|
|
|
1
|
-
|
|
1
|
+
import { RequestHandler, Router } from 'express';
|
|
2
|
+
export declare function webAPIMiddleware(tokenMiddleware: RequestHandler, webEndpointsApi: RequestHandler): Router;
|
|
@@ -3,13 +3,13 @@
|
|
|
3
3
|
Object.defineProperty(exports, "__esModule", {
|
|
4
4
|
value: true
|
|
5
5
|
});
|
|
6
|
-
exports.
|
|
6
|
+
exports.webAPIMiddleware = webAPIMiddleware;
|
|
7
7
|
var _express = _interopRequireWildcard(require("express"));
|
|
8
8
|
var _validation = require("../validation");
|
|
9
9
|
var _security = require("./security");
|
|
10
10
|
function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
|
|
11
11
|
function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
|
|
12
|
-
function
|
|
12
|
+
function webAPIMiddleware(tokenMiddleware, webEndpointsApi) {
|
|
13
13
|
// eslint-disable-next-line new-cap
|
|
14
14
|
const route = (0, _express.Router)();
|
|
15
15
|
// validate all of these params as a package name
|
|
@@ -20,11 +20,11 @@ function webMiddleware(tokenMiddleware, webEndpointsApi) {
|
|
|
20
20
|
route.use(_express.default.urlencoded({
|
|
21
21
|
extended: false
|
|
22
22
|
}));
|
|
23
|
+
route.use(_security.setSecurityWebHeaders);
|
|
23
24
|
if (typeof tokenMiddleware === 'function') {
|
|
24
25
|
route.use(tokenMiddleware);
|
|
25
26
|
}
|
|
26
|
-
|
|
27
|
-
if (webEndpointsApi) {
|
|
27
|
+
if (typeof webEndpointsApi === 'function') {
|
|
28
28
|
route.use(webEndpointsApi);
|
|
29
29
|
}
|
|
30
30
|
return route;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"web-api.js","names":["_express","_interopRequireWildcard","require","_validation","_security","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","
|
|
1
|
+
{"version":3,"file":"web-api.js","names":["_express","_interopRequireWildcard","require","_validation","_security","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set","webAPIMiddleware","tokenMiddleware","webEndpointsApi","route","Router","param","validatePackage","validateName","use","express","urlencoded","extended","setSecurityWebHeaders"],"sources":["../../../src/middlewares/web/web-api.ts"],"sourcesContent":["import express from 'express';\nimport { RequestHandler, Router } from 'express';\n\nimport { validateName, validatePackage } from '../validation';\nimport { setSecurityWebHeaders } from './security';\n\nexport function webAPIMiddleware(\n tokenMiddleware: RequestHandler,\n webEndpointsApi: RequestHandler\n): Router {\n // eslint-disable-next-line new-cap\n const route = Router();\n // validate all of these params as a package name\n // this might be too harsh, so ask if it causes trouble=\n route.param('package', validatePackage);\n route.param('filename', validateName);\n route.param('version', validateName);\n route.use(express.urlencoded({ extended: false }));\n route.use(setSecurityWebHeaders);\n\n if (typeof tokenMiddleware === 'function') {\n route.use(tokenMiddleware);\n }\n\n if (typeof webEndpointsApi === 'function') {\n route.use(webEndpointsApi);\n }\n\n return route;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,uBAAA,CAAAC,OAAA;AAGA,IAAAC,WAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAAmD,SAAAG,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAL,wBAAAS,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA;AAE5C,SAASW,gBAAgBA,CAC9BC,eAA+B,EAC/BC,eAA+B,EACvB;EACR;EACA,MAAMC,KAAK,GAAG,IAAAC,eAAM,EAAC,CAAC;EACtB;EACA;EACAD,KAAK,CAACE,KAAK,CAAC,SAAS,EAAEC,2BAAe,CAAC;EACvCH,KAAK,CAACE,KAAK,CAAC,UAAU,EAAEE,wBAAY,CAAC;EACrCJ,KAAK,CAACE,KAAK,CAAC,SAAS,EAAEE,wBAAY,CAAC;EACpCJ,KAAK,CAACK,GAAG,CAACC,gBAAO,CAACC,UAAU,CAAC;IAAEC,QAAQ,EAAE;EAAM,CAAC,CAAC,CAAC;EAClDR,KAAK,CAACK,GAAG,CAACI,+BAAqB,CAAC;EAEhC,IAAI,OAAOX,eAAe,KAAK,UAAU,EAAE;IACzCE,KAAK,CAACK,GAAG,CAACP,eAAe,CAAC;EAC5B;EAEA,IAAI,OAAOC,eAAe,KAAK,UAAU,EAAE;IACzCC,KAAK,CAACK,GAAG,CAACN,eAAe,CAAC;EAC5B;EAEA,OAAOC,KAAK;AACd"}
|
|
@@ -18,7 +18,7 @@ var _default = (config, middlewares, pluginOptions) => {
|
|
|
18
18
|
// render web
|
|
19
19
|
router.use('/', (0, _renderWeb.renderWebMiddleware)(config, tokenMiddleware, pluginOptions));
|
|
20
20
|
// web endpoints, search, packages, etc
|
|
21
|
-
router.use('/-/verdaccio/', (0, _webApi.
|
|
21
|
+
router.use('/-/verdaccio/', (0, _webApi.webAPIMiddleware)(tokenMiddleware, webEndpointsApi));
|
|
22
22
|
return router;
|
|
23
23
|
};
|
|
24
24
|
exports.default = _default;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"web-middleware.js","names":["_express","_interopRequireDefault","require","_renderWeb","_webApi","obj","__esModule","default","_default","config","middlewares","pluginOptions","router","express","Router","tokenMiddleware","webEndpointsApi","use","renderWebMiddleware","
|
|
1
|
+
{"version":3,"file":"web-middleware.js","names":["_express","_interopRequireDefault","require","_renderWeb","_webApi","obj","__esModule","default","_default","config","middlewares","pluginOptions","router","express","Router","tokenMiddleware","webEndpointsApi","use","renderWebMiddleware","webAPIMiddleware","exports"],"sources":["../../../src/middlewares/web/web-middleware.ts"],"sourcesContent":["import express from 'express';\n\nimport { renderWebMiddleware } from './render-web';\nimport { webAPIMiddleware } from './web-api';\n\nexport default (config, middlewares, pluginOptions): any => {\n // eslint-disable-next-line new-cap\n const router = express.Router();\n const { tokenMiddleware, webEndpointsApi } = middlewares;\n // render web\n router.use('/', renderWebMiddleware(config, tokenMiddleware, pluginOptions));\n // web endpoints, search, packages, etc\n router.use('/-/verdaccio/', webAPIMiddleware(tokenMiddleware, webEndpointsApi));\n return router;\n};\n"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAAA,IAAAG,QAAA,GAE9BA,CAACC,MAAM,EAAEC,WAAW,EAAEC,aAAa,KAAU;EAC1D;EACA,MAAMC,MAAM,GAAGC,gBAAO,CAACC,MAAM,CAAC,CAAC;EAC/B,MAAM;IAAEC,eAAe;IAAEC;EAAgB,CAAC,GAAGN,WAAW;EACxD;EACAE,MAAM,CAACK,GAAG,CAAC,GAAG,EAAE,IAAAC,8BAAmB,EAACT,MAAM,EAAEM,eAAe,EAAEJ,aAAa,CAAC,CAAC;EAC5E;EACAC,MAAM,CAACK,GAAG,CAAC,eAAe,EAAE,IAAAE,wBAAgB,EAACJ,eAAe,EAAEC,eAAe,CAAC,CAAC;EAC/E,OAAOJ,MAAM;AACf,CAAC;AAAAQ,OAAA,CAAAb,OAAA,GAAAC,QAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/middleware",
|
|
3
|
-
"version": "6.0.0-6-next.
|
|
3
|
+
"version": "6.0.0-6-next.53",
|
|
4
4
|
"description": "express middleware utils",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -29,10 +29,10 @@
|
|
|
29
29
|
"node": ">=12"
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
|
-
"@verdaccio/core": "6.0.0-6-next.
|
|
33
|
-
"@verdaccio/utils": "6.0.0-6-next.
|
|
34
|
-
"@verdaccio/config": "6.0.0-6-next.
|
|
35
|
-
"@verdaccio/url": "11.0.0-6-next.
|
|
32
|
+
"@verdaccio/core": "6.0.0-6-next.74",
|
|
33
|
+
"@verdaccio/utils": "6.0.0-6-next.42",
|
|
34
|
+
"@verdaccio/config": "6.0.0-6-next.74",
|
|
35
|
+
"@verdaccio/url": "11.0.0-6-next.40",
|
|
36
36
|
"debug": "4.3.4",
|
|
37
37
|
"lru-cache": "7.18.3",
|
|
38
38
|
"express": "4.18.2",
|
|
@@ -45,7 +45,7 @@
|
|
|
45
45
|
"url": "https://opencollective.com/verdaccio"
|
|
46
46
|
},
|
|
47
47
|
"devDependencies": {
|
|
48
|
-
"@verdaccio/logger": "6.0.0-6-next.
|
|
48
|
+
"@verdaccio/logger": "6.0.0-6-next.42",
|
|
49
49
|
"body-parser": "1.20.2",
|
|
50
50
|
"supertest": "6.3.3"
|
|
51
51
|
},
|
package/src/index.ts
CHANGED
|
@@ -9,7 +9,7 @@ export { final } from './middlewares/final';
|
|
|
9
9
|
export { allow } from './middlewares/allow';
|
|
10
10
|
export { rateLimit } from './middlewares/rate-limit';
|
|
11
11
|
export { userAgent } from './middlewares/user-agent';
|
|
12
|
-
export { webMiddleware } from './middlewares/web';
|
|
12
|
+
export { webMiddleware, renderWebMiddleware } from './middlewares/web';
|
|
13
13
|
export { errorReportingMiddleware, handleError } from './middlewares/error';
|
|
14
14
|
export {
|
|
15
15
|
log,
|
|
@@ -1,27 +1,31 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import {
|
|
3
|
-
validateName as utilValidateName,
|
|
4
|
-
validatePackage as utilValidatePackage,
|
|
5
|
-
} from '@verdaccio/utils';
|
|
1
|
+
import { NextFunction, Request, Response } from 'express';
|
|
6
2
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
3
|
+
import { errorUtils, validationUtils } from '@verdaccio/core';
|
|
4
|
+
|
|
5
|
+
export function validateName(
|
|
6
|
+
_req: Request,
|
|
7
|
+
_res: Response,
|
|
8
|
+
next: NextFunction,
|
|
9
|
+
value: string,
|
|
10
|
+
name: string
|
|
11
|
+
) {
|
|
12
|
+
if (validationUtils.validateName(value)) {
|
|
12
13
|
next();
|
|
13
14
|
} else {
|
|
14
|
-
next(errorUtils.
|
|
15
|
+
next(errorUtils.getBadRequest('invalid ' + name));
|
|
15
16
|
}
|
|
16
17
|
}
|
|
17
18
|
|
|
18
|
-
export function validatePackage(
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
19
|
+
export function validatePackage(
|
|
20
|
+
_req: Request,
|
|
21
|
+
_res,
|
|
22
|
+
next: NextFunction,
|
|
23
|
+
value: string,
|
|
24
|
+
name: string
|
|
25
|
+
) {
|
|
26
|
+
if (validationUtils.validatePackage(value)) {
|
|
23
27
|
next();
|
|
24
28
|
} else {
|
|
25
|
-
next(errorUtils.
|
|
29
|
+
next(errorUtils.getBadRequest('invalid ' + name));
|
|
26
30
|
}
|
|
27
31
|
}
|
|
@@ -1,10 +1,13 @@
|
|
|
1
1
|
import express from 'express';
|
|
2
|
-
import { Router } from 'express';
|
|
2
|
+
import { RequestHandler, Router } from 'express';
|
|
3
3
|
|
|
4
4
|
import { validateName, validatePackage } from '../validation';
|
|
5
5
|
import { setSecurityWebHeaders } from './security';
|
|
6
6
|
|
|
7
|
-
export function
|
|
7
|
+
export function webAPIMiddleware(
|
|
8
|
+
tokenMiddleware: RequestHandler,
|
|
9
|
+
webEndpointsApi: RequestHandler
|
|
10
|
+
): Router {
|
|
8
11
|
// eslint-disable-next-line new-cap
|
|
9
12
|
const route = Router();
|
|
10
13
|
// validate all of these params as a package name
|
|
@@ -13,15 +16,15 @@ export function webMiddleware(tokenMiddleware, webEndpointsApi) {
|
|
|
13
16
|
route.param('filename', validateName);
|
|
14
17
|
route.param('version', validateName);
|
|
15
18
|
route.use(express.urlencoded({ extended: false }));
|
|
19
|
+
route.use(setSecurityWebHeaders);
|
|
16
20
|
|
|
17
21
|
if (typeof tokenMiddleware === 'function') {
|
|
18
22
|
route.use(tokenMiddleware);
|
|
19
23
|
}
|
|
20
24
|
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
if (webEndpointsApi) {
|
|
25
|
+
if (typeof webEndpointsApi === 'function') {
|
|
24
26
|
route.use(webEndpointsApi);
|
|
25
27
|
}
|
|
28
|
+
|
|
26
29
|
return route;
|
|
27
30
|
}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import express from 'express';
|
|
2
2
|
|
|
3
3
|
import { renderWebMiddleware } from './render-web';
|
|
4
|
-
import {
|
|
4
|
+
import { webAPIMiddleware } from './web-api';
|
|
5
5
|
|
|
6
6
|
export default (config, middlewares, pluginOptions): any => {
|
|
7
7
|
// eslint-disable-next-line new-cap
|
|
@@ -10,6 +10,6 @@ export default (config, middlewares, pluginOptions): any => {
|
|
|
10
10
|
// render web
|
|
11
11
|
router.use('/', renderWebMiddleware(config, tokenMiddleware, pluginOptions));
|
|
12
12
|
// web endpoints, search, packages, etc
|
|
13
|
-
router.use('/-/verdaccio/',
|
|
13
|
+
router.use('/-/verdaccio/', webAPIMiddleware(tokenMiddleware, webEndpointsApi));
|
|
14
14
|
return router;
|
|
15
15
|
};
|
package/test/final.spec.ts
CHANGED
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import bodyParser from 'body-parser';
|
|
2
1
|
import express from 'express';
|
|
3
2
|
import request from 'supertest';
|
|
4
3
|
|
|
@@ -6,6 +5,8 @@ import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
|
|
|
6
5
|
|
|
7
6
|
import { final } from '../src';
|
|
8
7
|
|
|
8
|
+
const bodyParser = express;
|
|
9
|
+
|
|
9
10
|
test('handle error as object', async () => {
|
|
10
11
|
const app = express();
|
|
11
12
|
app.use(bodyParser.json({ strict: false, limit: '10mb' }));
|
package/test/json.spec.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import
|
|
1
|
+
import express from 'express';
|
|
2
2
|
import request from 'supertest';
|
|
3
3
|
|
|
4
4
|
import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
|
|
@@ -8,7 +8,7 @@ import { getApp } from './helper';
|
|
|
8
8
|
|
|
9
9
|
test('body is json', async () => {
|
|
10
10
|
const app = getApp([]);
|
|
11
|
-
app.use(
|
|
11
|
+
app.use(express.json({ strict: false, limit: '10mb' }));
|
|
12
12
|
// @ts-ignore
|
|
13
13
|
app.put('/json', expectJson, (req, res) => {
|
|
14
14
|
res.status(HTTP_STATUS.OK).json({});
|
package/test/params.spec.ts
CHANGED
|
@@ -2,55 +2,9 @@ import request from 'supertest';
|
|
|
2
2
|
|
|
3
3
|
import { HTTP_STATUS } from '@verdaccio/core';
|
|
4
4
|
|
|
5
|
-
import { match
|
|
5
|
+
import { match } from '../src';
|
|
6
6
|
import { getApp } from './helper';
|
|
7
7
|
|
|
8
|
-
describe('validate params', () => {
|
|
9
|
-
test('should validate package name', async () => {
|
|
10
|
-
const app = getApp([]);
|
|
11
|
-
// @ts-ignore
|
|
12
|
-
app.param('package', validatePackage);
|
|
13
|
-
app.get('/pkg/:package', (req, res) => {
|
|
14
|
-
res.status(HTTP_STATUS.OK).json({});
|
|
15
|
-
});
|
|
16
|
-
|
|
17
|
-
return request(app).get('/pkg/react').expect(HTTP_STATUS.OK);
|
|
18
|
-
});
|
|
19
|
-
|
|
20
|
-
test('should fails validate package name', async () => {
|
|
21
|
-
const app = getApp([]);
|
|
22
|
-
// @ts-ignore
|
|
23
|
-
app.param('package', validatePackage);
|
|
24
|
-
app.get('/pkg/:package', (req, res) => {
|
|
25
|
-
res.status(HTTP_STATUS.OK).json({});
|
|
26
|
-
});
|
|
27
|
-
|
|
28
|
-
return request(app).get('/pkg/node_modules').expect(HTTP_STATUS.FORBIDDEN);
|
|
29
|
-
});
|
|
30
|
-
|
|
31
|
-
test('should fails file name package name', async () => {
|
|
32
|
-
const app = getApp([]);
|
|
33
|
-
// @ts-ignore
|
|
34
|
-
app.param('filename', validateName);
|
|
35
|
-
app.get('/file/:filename', (req, res) => {
|
|
36
|
-
res.status(HTTP_STATUS.OK).json({});
|
|
37
|
-
});
|
|
38
|
-
|
|
39
|
-
return request(app).get('/file/__proto__').expect(HTTP_STATUS.FORBIDDEN);
|
|
40
|
-
});
|
|
41
|
-
|
|
42
|
-
test('should validate file name package name', async () => {
|
|
43
|
-
const app = getApp([]);
|
|
44
|
-
// @ts-ignore
|
|
45
|
-
app.param('filename', validateName);
|
|
46
|
-
app.get('/file/:filename', (req, res) => {
|
|
47
|
-
res.status(HTTP_STATUS.OK).json({});
|
|
48
|
-
});
|
|
49
|
-
|
|
50
|
-
return request(app).get('/file/react.tar.gz').expect(HTTP_STATUS.OK);
|
|
51
|
-
});
|
|
52
|
-
});
|
|
53
|
-
|
|
54
8
|
describe('match', () => {
|
|
55
9
|
test('should not match middleware', async () => {
|
|
56
10
|
const app = getApp([]);
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
import request from 'supertest';
|
|
2
|
+
|
|
3
|
+
import { HTTP_STATUS } from '@verdaccio/core';
|
|
4
|
+
|
|
5
|
+
import { validateName, validatePackage } from '../src';
|
|
6
|
+
import { getApp } from './helper';
|
|
7
|
+
|
|
8
|
+
describe('validate package name middleware', () => {
|
|
9
|
+
test.each(['jquery', '-'])('%s should be valid package name', (pkg) => {
|
|
10
|
+
const app = getApp([]);
|
|
11
|
+
app.param('pkg', validatePackage);
|
|
12
|
+
app.get('/:pkg', (_req, res) => {
|
|
13
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
14
|
+
});
|
|
15
|
+
|
|
16
|
+
return request(app).get(`/${pkg}`).expect(HTTP_STATUS.OK);
|
|
17
|
+
});
|
|
18
|
+
|
|
19
|
+
test.each(['node_modules', '%'])('%s should be invalid package name', (pkg) => {
|
|
20
|
+
const app = getApp([]);
|
|
21
|
+
app.param('pkg', validatePackage);
|
|
22
|
+
app.get('/:pkg', (_req, res) => {
|
|
23
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
24
|
+
});
|
|
25
|
+
|
|
26
|
+
return request(app).get(`/${pkg}`).expect(HTTP_STATUS.BAD_REQUEST);
|
|
27
|
+
});
|
|
28
|
+
|
|
29
|
+
test('should validate package name double level', async () => {
|
|
30
|
+
const app = getApp([]);
|
|
31
|
+
// @ts-ignore
|
|
32
|
+
app.param('package', validatePackage);
|
|
33
|
+
app.get('/pkg/:package', (req, res) => {
|
|
34
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
35
|
+
});
|
|
36
|
+
|
|
37
|
+
return request(app).get('/pkg/react').expect(HTTP_STATUS.OK);
|
|
38
|
+
});
|
|
39
|
+
|
|
40
|
+
test('should fails validate package name double level', async () => {
|
|
41
|
+
const app = getApp([]);
|
|
42
|
+
// @ts-ignore
|
|
43
|
+
app.param('package', validatePackage);
|
|
44
|
+
app.get('/pkg/:package', (req, res) => {
|
|
45
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
46
|
+
});
|
|
47
|
+
|
|
48
|
+
return request(app).get('/pkg/node_modules').expect(HTTP_STATUS.BAD_REQUEST);
|
|
49
|
+
});
|
|
50
|
+
});
|
|
51
|
+
|
|
52
|
+
describe('validate file name name middleware', () => {
|
|
53
|
+
test.each(['old-package@0.1.2.tgz', '--0.0.1.tgz'])('%s should be valid file name', (pkg) => {
|
|
54
|
+
const app = getApp([]);
|
|
55
|
+
app.param('pkg', validateName);
|
|
56
|
+
app.get('/:pkg', (_req, res) => {
|
|
57
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
58
|
+
});
|
|
59
|
+
|
|
60
|
+
return request(app).get(`/${pkg}`).expect(HTTP_STATUS.OK);
|
|
61
|
+
});
|
|
62
|
+
|
|
63
|
+
test.each(['some%2Fthing', '.bin'])('%s should be invalid package name', (pkg) => {
|
|
64
|
+
const app = getApp([]);
|
|
65
|
+
app.param('pkg', validateName);
|
|
66
|
+
app.get('/:pkg', (_req, res) => {
|
|
67
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
68
|
+
});
|
|
69
|
+
|
|
70
|
+
return request(app).get(`/${pkg}`).expect(HTTP_STATUS.BAD_REQUEST);
|
|
71
|
+
});
|
|
72
|
+
|
|
73
|
+
test('should fails file name package name', async () => {
|
|
74
|
+
const app = getApp([]);
|
|
75
|
+
app.param('filename', validateName);
|
|
76
|
+
app.get('/file/:filename', (req, res) => {
|
|
77
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
78
|
+
});
|
|
79
|
+
|
|
80
|
+
return request(app).get('/file/__proto__').expect(HTTP_STATUS.BAD_REQUEST);
|
|
81
|
+
});
|
|
82
|
+
|
|
83
|
+
test('should validate file name package name', async () => {
|
|
84
|
+
const app = getApp([]);
|
|
85
|
+
app.param('filename', validateName);
|
|
86
|
+
app.get('/file/:filename', (req, res) => {
|
|
87
|
+
res.status(HTTP_STATUS.OK).json({});
|
|
88
|
+
});
|
|
89
|
+
|
|
90
|
+
return request(app).get('/file/react.tar.gz').expect(HTTP_STATUS.OK);
|
|
91
|
+
});
|
|
92
|
+
});
|