@zuplo/cli 7.12.3 → 7.12.4

package/node_modules/fast-uri/test/scheme-validation.test.js

@@ -15,7 +15,15 @@ const malformedSchemes = [
   'foo_bar:value',
   'éxample:value',
   'Kttp://example.com/',
-  'ſcheme:value'
+  'ſcheme:value',
+  // RFC 3986 section 3.1 does not allow percent-encoding in a scheme.
+  '%4Aavascript:alert(1)',
+  '%6aavascript:alert(1)',
+  'foo%2Bbar:value',
+  '%u006Aavascript:1',
+  'ht%74ps://example.com/',
+  'ma%69lto:user@example.org',
+  '%64ata:text/html,x'
 ]
 
 test('parse validates the decoded scheme against RFC 3986', (t) => {
@@ -23,10 +31,7 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
     ['a:value', 'a'],
     ['HTTP://example.com/', 'http'],
     ['a1+.-:value', 'a1+.-'],
-    ['%4Aavascript:alert(1)', 'javascript'],
-    ['foo%2Bbar:value', 'foo+bar'],
-    ['%u006Aavascript:1', 'javascript'],
-    ['ht%74ps://example.com/', 'https']
+    ['foo+bar:value', 'foo+bar']
   ]
 
   for (const [uri, scheme] of validSchemes) {
@@ -42,17 +47,41 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
   t.end()
 })
 
-test('decoded schemes select their scheme handlers', (t) => {
+test('percent-encoded schemes do not select scheme handlers', (t) => {
   t.equal(
     fastURI.normalize('ht%74ps://example.com:443'),
-    'https://example.com/',
-    'HTTP normalization runs after decoding the scheme'
+    'ht%74ps://example.com:443',
+    'HTTP normalization does not run for an encoded scheme'
   )
 
   // 3.x has no mailto scheme handler (added in v4); use the ws handler to
-  // verify that a percent-encoded scheme still selects its scheme handler
-  const ws = fastURI.parse('we%62socket://example.com/')
-  t.equal(ws.scheme, 'websocket', 'ws parsing runs after decoding the scheme')
+  // verify that a percent-encoded scheme does not select its scheme handler
+  const ws = fastURI.parse('w%73://example.com/a?b')
+  t.equal(ws.resourceName, undefined, 'ws parsing does not run for an encoded scheme')
+  t.equal(ws.error, MALFORMED_SCHEME_ERROR)
+  t.end()
+})
+
+test('normalization cannot synthesize a scheme from encoded input', (t) => {
+  const inputs = [
+    '%6Aavascript:alert(1)',
+    '%4A%41%56%41%53%43%52%49%50%54:alert(1)',
+    '%u006Aavascript:alert(1)',
+    'j%61vascript:alert(1)',
+    '%64ata:text/html,<script>alert(1)</script>',
+    'vb%73cript:msgbox(1)'
+  ]
+
+  for (const uri of inputs) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri + ' is malformed')
+    t.notOk(/^(?:javascript|data|vbscript):/i.test(String(parsed.scheme) + ':'), uri + ' parsed scheme is not decoded')
+    t.equal(fastURI.normalize(uri), uri, uri + ' normalizes to itself')
+    t.equal(fastURI.equal(uri, uri), false, uri + ' is not comparable')
+    t.throws(() => fastURI.resolve('https://example.com/app/', uri), /URI scheme is malformed\./, uri + ' is rejected by resolve')
+  }
+
+  t.equal(fastURI.equal('%68ttp://a/', 'http://a/'), false, 'encoded scheme does not alias a plain scheme')
   t.end()
 })
 
@@ -95,11 +124,21 @@ test('resolve rejects malformed decoded schemes in either input', (t) => {
   t.end()
 })
 
-test('serialize validates decoded component schemes', (t) => {
+test('serialize validates component schemes without decoding them', (t) => {
   t.equal(
-    fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    fastURI.serialize({ scheme: 'foo+bar', path: 'value' }),
     'foo+bar:value',
-    'valid decoded scheme is serialized'
+    'valid scheme is serialized'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    /URI scheme is malformed\./,
+    'percent-encoded scheme is rejected'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: '%6Aavascript', path: 'alert(1)' }),
+    /URI scheme is malformed\./,
+    'encoded scheme cannot serialize as javascript:'
   )
   t.throws(
     () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "7.12.3",
+  "version": "7.12.4",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -31,10 +31,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.220.0",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "7.12.3",
+    "@zuplo/core": "7.12.4",
     "@zuplo/editor": "1.0.33162667821",
-    "@zuplo/openapi-tools": "7.12.3",
-    "@zuplo/runtime": "7.12.3",
+    "@zuplo/openapi-tools": "7.12.4",
+    "@zuplo/runtime": "7.12.4",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -65,15 +65,15 @@
     "workerd": "1.20261002.1",
     "yargs": "17.7.2",
     "zod": "4.4.3",
-    "@zuplo/graphql": "7.12.3",
-    "@zuplo/otel": "7.12.3"
+    "@zuplo/graphql": "7.12.4",
+    "@zuplo/otel": "7.12.4"
   },
   "optionalDependencies": {
-    "@zuplo/lint-darwin-arm64": "7.12.3",
-    "@zuplo/lint-darwin-x64": "7.12.3",
-    "@zuplo/lint-linux-x64": "7.12.3",
-    "@zuplo/lint-linux-arm64": "7.12.3",
-    "@zuplo/lint-win32-x64": "7.12.3"
+    "@zuplo/lint-darwin-arm64": "7.12.4",
+    "@zuplo/lint-darwin-x64": "7.12.4",
+    "@zuplo/lint-linux-x64": "7.12.4",
+    "@zuplo/lint-linux-arm64": "7.12.4",
+    "@zuplo/lint-win32-x64": "7.12.4"
   },
   "bundleDependencies": [
     "@inquirer/prompts",