@yrest/cli 0.8.0 → 0.8.1

package/README.md

@@ -10,7 +10,7 @@
 [![CI](https://github.com/aggiovato/yRest/actions/workflows/ci.yml/badge.svg)](https://github.com/aggiovato/yRest/actions)
 [![Node](https://img.shields.io/node/v/@yrest/cli)](https://www.npmjs.com/package/@yrest/cli)
 [![TypeScript](https://img.shields.io/badge/TypeScript-ready-blue)](https://www.typescriptlang.org/)
-[![Socket](https://badge.socket.dev/npm/package/@yrest/cli/0.8.0)](https://socket.dev/npm/package/@yrest/cli)
+[![Socket](https://badge.socket.dev/npm/package/@yrest/cli/0.8.1)](https://socket.dev/npm/package/@yrest/cli)
 
 YAML-powered json-server alternative. Zero-config REST API mock server with full CRUD, relations, filters and snapshots from a `db.yml` file.
 

package/dist/cli/index.js

@@ -292,8 +292,11 @@ var METHOD_COLOR = {
   DELETE: "#f85149",
   fn: "#f0883e"
 };
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function badge(label, color, bg) {
-  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${label}</span>`;
+  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${escapeHtml(label)}</span>`;
 }
 function methodBadge(method) {
   const color = METHOD_COLOR[method] ?? "#7d8590";
@@ -303,7 +306,7 @@ function endpointRow(method, path, desc) {
   return `
     <tr>
       <td class="method-cell">${methodBadge(method)}</td>
-      <td class="path-cell"><code>${path}</code></td>
+      <td class="path-cell"><code>${escapeHtml(path)}</code></td>
       <td class="desc-cell">${desc}</td>
     </tr>`;
 }
@@ -337,7 +340,7 @@ function resourceAccordion(name, base, isOpen) {
   return `
   <details class="resource-card" ${isOpen ? "open" : ""}>
     <summary>
-      <span class="resource-name">/${name}</span>
+      <span class="resource-name">/${escapeHtml(name)}</span>
       <span class="route-count">6 routes</span>
     </summary>
     <table>
@@ -421,7 +424,7 @@ curl -X POST ${host}/_snapshot/reset`
   }
   if (firstCustomRoute) {
     const method = firstCustomRoute.method?.toUpperCase() ?? "GET";
-    const fullPath = `${host}${base}${firstCustomRoute.path}`;
+    const fullPath = `${host}${base}${escapeHtml(firstCustomRoute.path ?? "")}`;
     const curlFlag = method === "GET" ? "" : `-X ${method} `;
     examples.push(`# Custom route
 curl ${curlFlag}${fullPath}`);
@@ -506,7 +509,8 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
       desc = `Error injection \u2014 <code>${r.error}</code>`;
     } else if (r.handler) {
       const found = handlers.has(r.handler);
-      desc = found ? `Handler \u2014 <code>${r.handler}()</code>` : `Handler \u2014 <code>${r.handler}()</code> <span style="color:#f85149">(not loaded)</span>`;
+      const handlerName = escapeHtml(r.handler);
+      desc = found ? `Handler \u2014 <code>${handlerName}()</code>` : `Handler \u2014 <code>${handlerName}()</code> <span style="color:#f85149">(not loaded)</span>`;
     } else if (r.scenarios?.length) {
       const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
       desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
@@ -779,6 +783,7 @@ function applyOperator(itemValue, op, filterValue) {
     case "_start":
       return strItem.toLowerCase().startsWith(filterValue.toLowerCase());
     case "_regex": {
+      if (filterValue.length > 200) return false;
       try {
         return new RegExp(filterValue, "i").test(strItem);
       } catch {
@@ -1439,8 +1444,15 @@ function loadConfigFile(configPath) {
 
 // src/utils/handlers.ts
 var import_node_fs5 = require("fs");
+var ALLOWED_EXTENSIONS = [".js", ".mjs", ".cjs"];
 async function loadHandlers(filePath) {
   if (!(0, import_node_fs5.existsSync)(filePath)) return /* @__PURE__ */ new Map();
+  if (!ALLOWED_EXTENSIONS.some((ext) => filePath.endsWith(ext))) {
+    console.error(
+      `  \x1B[31m[handlers] ${filePath} \u2014 only .js, .mjs and .cjs files are allowed\x1B[0m`
+    );
+    return /* @__PURE__ */ new Map();
+  }
   try {
     const mod = await import(filePath);
     const map = /* @__PURE__ */ new Map();

package/dist/cli/index.mjs

@@ -265,8 +265,11 @@ var METHOD_COLOR = {
   DELETE: "#f85149",
   fn: "#f0883e"
 };
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function badge(label, color, bg) {
-  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${label}</span>`;
+  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${escapeHtml(label)}</span>`;
 }
 function methodBadge(method) {
   const color = METHOD_COLOR[method] ?? "#7d8590";
@@ -276,7 +279,7 @@ function endpointRow(method, path, desc) {
   return `
     <tr>
       <td class="method-cell">${methodBadge(method)}</td>
-      <td class="path-cell"><code>${path}</code></td>
+      <td class="path-cell"><code>${escapeHtml(path)}</code></td>
       <td class="desc-cell">${desc}</td>
     </tr>`;
 }
@@ -310,7 +313,7 @@ function resourceAccordion(name, base, isOpen) {
   return `
   <details class="resource-card" ${isOpen ? "open" : ""}>
     <summary>
-      <span class="resource-name">/${name}</span>
+      <span class="resource-name">/${escapeHtml(name)}</span>
       <span class="route-count">6 routes</span>
     </summary>
     <table>
@@ -394,7 +397,7 @@ curl -X POST ${host}/_snapshot/reset`
   }
   if (firstCustomRoute) {
     const method = firstCustomRoute.method?.toUpperCase() ?? "GET";
-    const fullPath = `${host}${base}${firstCustomRoute.path}`;
+    const fullPath = `${host}${base}${escapeHtml(firstCustomRoute.path ?? "")}`;
     const curlFlag = method === "GET" ? "" : `-X ${method} `;
     examples.push(`# Custom route
 curl ${curlFlag}${fullPath}`);
@@ -479,7 +482,8 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
       desc = `Error injection \u2014 <code>${r.error}</code>`;
     } else if (r.handler) {
       const found = handlers.has(r.handler);
-      desc = found ? `Handler \u2014 <code>${r.handler}()</code>` : `Handler \u2014 <code>${r.handler}()</code> <span style="color:#f85149">(not loaded)</span>`;
+      const handlerName = escapeHtml(r.handler);
+      desc = found ? `Handler \u2014 <code>${handlerName}()</code>` : `Handler \u2014 <code>${handlerName}()</code> <span style="color:#f85149">(not loaded)</span>`;
     } else if (r.scenarios?.length) {
       const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
       desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
@@ -752,6 +756,7 @@ function applyOperator(itemValue, op, filterValue) {
     case "_start":
       return strItem.toLowerCase().startsWith(filterValue.toLowerCase());
     case "_regex": {
+      if (filterValue.length > 200) return false;
       try {
         return new RegExp(filterValue, "i").test(strItem);
       } catch {
@@ -1412,8 +1417,15 @@ function loadConfigFile(configPath) {
 
 // src/utils/handlers.ts
 import { existsSync as existsSync3 } from "fs";
+var ALLOWED_EXTENSIONS = [".js", ".mjs", ".cjs"];
 async function loadHandlers(filePath) {
   if (!existsSync3(filePath)) return /* @__PURE__ */ new Map();
+  if (!ALLOWED_EXTENSIONS.some((ext) => filePath.endsWith(ext))) {
+    console.error(
+      `  \x1B[31m[handlers] ${filePath} \u2014 only .js, .mjs and .cjs files are allowed\x1B[0m`
+    );
+    return /* @__PURE__ */ new Map();
+  }
   try {
     const mod = await import(filePath);
     const map = /* @__PURE__ */ new Map();

package/dist/index.js

@@ -202,8 +202,15 @@ var import_node_path3 = require("path");
 // src/utils/handlers.ts
 init_cjs_shims();
 var import_node_fs = require("fs");
+var ALLOWED_EXTENSIONS = [".js", ".mjs", ".cjs"];
 async function loadHandlers(filePath) {
   if (!(0, import_node_fs.existsSync)(filePath)) return /* @__PURE__ */ new Map();
+  if (!ALLOWED_EXTENSIONS.some((ext) => filePath.endsWith(ext))) {
+    console.error(
+      `  \x1B[31m[handlers] ${filePath} \u2014 only .js, .mjs and .cjs files are allowed\x1B[0m`
+    );
+    return /* @__PURE__ */ new Map();
+  }
   try {
     const mod = await import(filePath);
     const map = /* @__PURE__ */ new Map();
@@ -309,8 +316,11 @@ var METHOD_COLOR = {
   DELETE: "#f85149",
   fn: "#f0883e"
 };
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function badge(label, color, bg) {
-  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${label}</span>`;
+  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${escapeHtml(label)}</span>`;
 }
 function methodBadge(method) {
   const color = METHOD_COLOR[method] ?? "#7d8590";
@@ -320,7 +330,7 @@ function endpointRow(method, path, desc) {
   return `
     <tr>
       <td class="method-cell">${methodBadge(method)}</td>
-      <td class="path-cell"><code>${path}</code></td>
+      <td class="path-cell"><code>${escapeHtml(path)}</code></td>
       <td class="desc-cell">${desc}</td>
     </tr>`;
 }
@@ -354,7 +364,7 @@ function resourceAccordion(name, base, isOpen) {
   return `
   <details class="resource-card" ${isOpen ? "open" : ""}>
     <summary>
-      <span class="resource-name">/${name}</span>
+      <span class="resource-name">/${escapeHtml(name)}</span>
       <span class="route-count">6 routes</span>
     </summary>
     <table>
@@ -438,7 +448,7 @@ curl -X POST ${host}/_snapshot/reset`
   }
   if (firstCustomRoute) {
     const method = firstCustomRoute.method?.toUpperCase() ?? "GET";
-    const fullPath = `${host}${base}${firstCustomRoute.path}`;
+    const fullPath = `${host}${base}${escapeHtml(firstCustomRoute.path ?? "")}`;
     const curlFlag = method === "GET" ? "" : `-X ${method} `;
     examples.push(`# Custom route
 curl ${curlFlag}${fullPath}`);
@@ -523,7 +533,8 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
       desc = `Error injection \u2014 <code>${r.error}</code>`;
     } else if (r.handler) {
       const found = handlers.has(r.handler);
-      desc = found ? `Handler \u2014 <code>${r.handler}()</code>` : `Handler \u2014 <code>${r.handler}()</code> <span style="color:#f85149">(not loaded)</span>`;
+      const handlerName = escapeHtml(r.handler);
+      desc = found ? `Handler \u2014 <code>${handlerName}()</code>` : `Handler \u2014 <code>${handlerName}()</code> <span style="color:#f85149">(not loaded)</span>`;
     } else if (r.scenarios?.length) {
       const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
       desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
@@ -801,6 +812,7 @@ function applyOperator(itemValue, op, filterValue) {
     case "_start":
       return strItem.toLowerCase().startsWith(filterValue.toLowerCase());
     case "_regex": {
+      if (filterValue.length > 200) return false;
       try {
         return new RegExp(filterValue, "i").test(strItem);
       } catch {

package/dist/index.mjs

@@ -168,8 +168,15 @@ import { resolve as resolve2 } from "path";
 // src/utils/handlers.ts
 init_esm_shims();
 import { existsSync } from "fs";
+var ALLOWED_EXTENSIONS = [".js", ".mjs", ".cjs"];
 async function loadHandlers(filePath) {
   if (!existsSync(filePath)) return /* @__PURE__ */ new Map();
+  if (!ALLOWED_EXTENSIONS.some((ext) => filePath.endsWith(ext))) {
+    console.error(
+      `  \x1B[31m[handlers] ${filePath} \u2014 only .js, .mjs and .cjs files are allowed\x1B[0m`
+    );
+    return /* @__PURE__ */ new Map();
+  }
   try {
     const mod = await import(filePath);
     const map = /* @__PURE__ */ new Map();
@@ -275,8 +282,11 @@ var METHOD_COLOR = {
   DELETE: "#f85149",
   fn: "#f0883e"
 };
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
 function badge(label, color, bg) {
-  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${label}</span>`;
+  return `<span class="badge" style="background:${bg};color:${color};border:1px solid ${color}40">${escapeHtml(label)}</span>`;
 }
 function methodBadge(method) {
   const color = METHOD_COLOR[method] ?? "#7d8590";
@@ -286,7 +296,7 @@ function endpointRow(method, path2, desc) {
   return `
     <tr>
       <td class="method-cell">${methodBadge(method)}</td>
-      <td class="path-cell"><code>${path2}</code></td>
+      <td class="path-cell"><code>${escapeHtml(path2)}</code></td>
       <td class="desc-cell">${desc}</td>
     </tr>`;
 }
@@ -320,7 +330,7 @@ function resourceAccordion(name, base, isOpen) {
   return `
   <details class="resource-card" ${isOpen ? "open" : ""}>
     <summary>
-      <span class="resource-name">/${name}</span>
+      <span class="resource-name">/${escapeHtml(name)}</span>
       <span class="route-count">6 routes</span>
     </summary>
     <table>
@@ -404,7 +414,7 @@ curl -X POST ${host}/_snapshot/reset`
   }
   if (firstCustomRoute) {
     const method = firstCustomRoute.method?.toUpperCase() ?? "GET";
-    const fullPath = `${host}${base}${firstCustomRoute.path}`;
+    const fullPath = `${host}${base}${escapeHtml(firstCustomRoute.path ?? "")}`;
     const curlFlag = method === "GET" ? "" : `-X ${method} `;
     examples.push(`# Custom route
 curl ${curlFlag}${fullPath}`);
@@ -489,7 +499,8 @@ function generateAboutHtml(storage, options, handlers = /* @__PURE__ */ new Map(
       desc = `Error injection \u2014 <code>${r.error}</code>`;
     } else if (r.handler) {
       const found = handlers.has(r.handler);
-      desc = found ? `Handler \u2014 <code>${r.handler}()</code>` : `Handler \u2014 <code>${r.handler}()</code> <span style="color:#f85149">(not loaded)</span>`;
+      const handlerName = escapeHtml(r.handler);
+      desc = found ? `Handler \u2014 <code>${handlerName}()</code>` : `Handler \u2014 <code>${handlerName}()</code> <span style="color:#f85149">(not loaded)</span>`;
     } else if (r.scenarios?.length) {
       const hasTemplateInScenarios = r.scenarios.some((s) => s.response.body != null && hasTemplates(s.response.body)) || r.otherwise?.body != null && hasTemplates(r.otherwise.body);
       desc = hasTemplateInScenarios ? `Scenarios \u2014 <code>{{\u2026}}</code>` : `Scenarios`;
@@ -767,6 +778,7 @@ function applyOperator(itemValue, op, filterValue) {
     case "_start":
       return strItem.toLowerCase().startsWith(filterValue.toLowerCase());
     case "_regex": {
+      if (filterValue.length > 200) return false;
       try {
         return new RegExp(filterValue, "i").test(strItem);
       } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yrest/cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "YAML-powered json-server alternative. Zero-config REST API mock server with full CRUD, relations, filters and snapshots from a db.yml file.",
   "keywords": [
     "yrest",
@@ -77,7 +77,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^22.19.20",
+    "@types/node": "^22.19.21",
     "eslint": "^10.4.1",
     "eslint-config-prettier": "^10.1.8",
     "prettier": "^3.8.3",
@@ -91,7 +91,8 @@
   },
   "socket": {
     "allow": {
-      "filesystem": true
+      "filesystem": true,
+      "dynamic-require": true
     }
   }
 }