acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/src/core/utils/accept.test.ts

@@ -0,0 +1,299 @@
+import { parseAccept } from './accept.ts'
+
+describe('parseAccept Comprehensive Tests', () => {
+  describe('Basic Functionality', () => {
+    test('parses simple accept header', () => {
+      const header = 'text/html,application/json;q=0.9'
+      expect(parseAccept(header)).toEqual([
+        { type: 'text/html', params: {}, q: 1 },
+        { type: 'application/json', params: { q: '0.9' }, q: 0.9 },
+      ])
+    })
+
+    test('handles missing header', () => {
+      expect(parseAccept('')).toEqual([])
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect(parseAccept(undefined as any)).toEqual([])
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect(parseAccept(null as any)).toEqual([])
+    })
+
+    test('handles whitespace-only header', () => {
+      expect(parseAccept('   ')).toEqual([])
+      expect(parseAccept(' \t\n ')).toEqual([])
+    })
+  })
+
+  describe('Quality Values', () => {
+    test('handles extreme q values', () => {
+      const header = 'a;q=999999,b;q=-99999,c;q=Infinity,d;q=-Infinity,e;q=NaN'
+      const result = parseAccept(header)
+      // Each side clamps to the bound it is past, so a negative q sorts below a real one
+      // rather than above it -- `-99999` lands where `-Infinity` already did. Asserted as
+      // pairs because the clamp makes the sequence non-monotonic, which sorts the result.
+      expect(result.map((x) => [x.type, x.q])).toEqual([
+        ['a', 1],
+        ['c', 1],
+        ['b', 0],
+        ['d', 0],
+        ['e', 0],
+      ])
+    })
+
+    test('a negative q does not outrank a valid one', () => {
+      const result = parseAccept('application/json;q=0.9,text/html;q=-1')
+      expect(result.map((x) => [x.type, x.q])).toEqual([
+        ['application/json', 0.9],
+        ['text/html', 0],
+      ])
+      // The sort is by descending q, so the refused type must not come first.
+      expect(result[0].type).toBe('application/json')
+    })
+
+    test('handles malformed q values', () => {
+      const header = 'a;q=,b;q=invalid,c;q=1.2.3,d;q=true,e;q="0.5"'
+      const result = parseAccept(header)
+      expect(result.every((x) => x.q >= 0 && x.q <= 1)).toBe(true)
+    })
+
+    test('preserves original q string in params', () => {
+      const header = 'type;q=invalid'
+      const result = parseAccept(header)
+      expect(result[0].params.q).toBe('invalid')
+      expect(result[0].q).toBe(1) // Normalized q value
+    })
+
+    test('treats the q parameter name as case-insensitive', () => {
+      // RFC 9110 §12.4.2: the "q" parameter is case-insensitive.
+      expect(parseAccept('text/html;Q=0.5')).toEqual([
+        { type: 'text/html', params: { Q: '0.5' }, q: 0.5 },
+      ])
+      expect(parseAccept('text/html;Q=0')[0].q).toBe(0)
+    })
+
+    test('sorts by quality when the q parameter is uppercase', () => {
+      const result = parseAccept('text/html;Q=0.5,application/json;q=0.9')
+      expect(result.map((x) => x.type)).toEqual(['application/json', 'text/html'])
+    })
+  })
+
+  describe('Parameter Handling', () => {
+    test('handles complex parameters', () => {
+      const header = 'type;a=1;b="2";c=\'3\';d="semi;colon";e="nested"quoted""'
+      const result = parseAccept(header)
+      expect(result[0].params).toEqual({
+        a: '1',
+        b: '2',
+        c: "'3'",
+        d: 'semi;colon',
+      })
+    })
+
+    test('handles malformed parameters', () => {
+      const header = 'type;=value;;key=;=;====;key====value'
+      const result = parseAccept(header)
+      expect(result[0].type).toBe('type')
+      expect(Object.keys(result[0].params).length).toBe(0)
+    })
+
+    test('handles duplicate parameters', () => {
+      const header = 'type;key=1;key=2;KEY=3'
+      const result = parseAccept(header)
+      expect(result[0].params.key).toBe('2')
+      expect(result[0].params.KEY).toBe('3')
+    })
+
+    test('treats `__proto__` as a normal parameter without changing the prototype', () => {
+      const result = parseAccept('text/html;__proto__=x')
+      expect(Object.getPrototypeOf(result[0].params)).toBeNull()
+      expect(result[0].params['__proto__']).toBe('x')
+    })
+  })
+
+  describe('Media Type Edge Cases', () => {
+    test('handles malformed media types', () => {
+      const headers = [
+        '*/html',
+        'text/*mal/formed',
+        '/partial',
+        'missing/',
+        'inv@lid/type',
+        'text/(html)',
+        'text/html?invalid',
+      ]
+      headers.forEach((header) => {
+        const result = parseAccept(header)
+        expect(result[0].type).toBe(header)
+      })
+    })
+
+    test('handles extremely long types', () => {
+      const longType = 'a'.repeat(10000) + '/' + 'b'.repeat(10000)
+      const result = parseAccept(longType)
+      expect(result[0].type).toBe(longType)
+    })
+  })
+
+  describe('Delimiter Edge Cases', () => {
+    test('handles multiple consecutive delimiters', () => {
+      const header = 'a,,,,b;q=0.9,,,,c;q=0.8,,,,'
+      const result = parseAccept(header)
+      expect(result.map((x) => x.type)).toEqual(['a', 'b', 'c'])
+    })
+
+    test('handles unusual whitespace', () => {
+      const header = '\n\t a \t\n ; \n\t q=0.9 \t\n , \n\t b \t\n'
+      const result = parseAccept(header)
+      expect(result.map((x) => x.type)).toEqual(['b', 'a'])
+    })
+
+    test('handles comma inside quoted parameter value', () => {
+      const header = 'text/plain;meta="a,b";q=0.8,application/json;q=0.7'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        {
+          type: 'text/plain',
+          params: {
+            meta: 'a,b',
+            q: '0.8',
+          },
+          q: 0.8,
+        },
+        {
+          type: 'application/json',
+          params: {
+            q: '0.7',
+          },
+          q: 0.7,
+        },
+      ])
+    })
+
+    test('handles escaped quote and semicolon inside quoted parameter', () => {
+      const header = 'text/plain;meta="a\\\";b";q=0.5'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        {
+          type: 'text/plain',
+          params: {
+            meta: 'a";b',
+            q: '0.5',
+          },
+          q: 0.5,
+        },
+      ])
+    })
+
+    test('handles escaped character inside quoted parameter', () => {
+      const header = 'text/plain;meta="a\\\\z;c";q=0.3'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        {
+          type: 'text/plain',
+          params: {
+            meta: 'a\\z;c',
+            q: '0.3',
+          },
+          q: 0.3,
+        },
+      ])
+    })
+
+    test('skips invalid param without swallowing next media type', () => {
+      const header = 'a;foo, b;q=0.5'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        { type: 'a', params: {}, q: 1 },
+        { type: 'b', params: { q: '0.5' }, q: 0.5 },
+      ])
+    })
+
+    test('skips malformed quoted param tail without creating bogus media type', () => {
+      const header = 'a;foo="x"bar,b'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        { type: 'a', params: {}, q: 1 },
+        { type: 'b', params: {}, q: 1 },
+      ])
+    })
+
+    test('parses params after quoted value with trailing whitespace', () => {
+      const header = 'a;foo="x" ;q=0.5,b;q=0.4'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        { type: 'a', params: { foo: 'x', q: '0.5' }, q: 0.5 },
+        { type: 'b', params: { q: '0.4' }, q: 0.4 },
+      ])
+    })
+
+    test('handles quoted param followed immediately by comma', () => {
+      const header = 'a;foo="x",b'
+      const result = parseAccept(header)
+      expect(result).toEqual([
+        { type: 'a', params: { foo: 'x' }, q: 1 },
+        { type: 'b', params: {}, q: 1 },
+      ])
+    })
+
+    test('skips empty media type that starts with semicolon', () => {
+      const header = ';q=0.5,b;q=0.4'
+      const result = parseAccept(header)
+      expect(result).toEqual([{ type: 'b', params: { q: '0.4' }, q: 0.4 }])
+    })
+  })
+
+  describe('Security Cases', () => {
+    test('handles potential injection patterns', () => {
+      const headers = [
+        'type;q=0.9--',
+        'type;q=0.9;drop table users',
+        'type;__|;q=0.9',
+        'text/html"><script>alert(1)</script>',
+        'application/json${process.env}',
+      ]
+      headers.forEach((header) => {
+        expect(() => parseAccept(header)).not.toThrow()
+      })
+    })
+
+    test('handles many semicolons with an unbalanced quote', () => {
+      const header = `text/plain;${'a;'.repeat(8000)}"`
+      const result = parseAccept(header)
+      expect(result[0].type).toBe('text/plain')
+    })
+
+    test('handles extremely large input', () => {
+      const header = 'a;q=0.9,'.repeat(100000)
+      expect(() => parseAccept(header)).not.toThrow()
+    })
+  })
+
+  describe('Unicode and Special Characters', () => {
+    test('handles unicode in types and parameters', () => {
+      const header = '🌐/😊;param=🔥;q=0.9'
+      const result = parseAccept(header)
+      expect(result[0].type).toBe('🌐/😊')
+      expect(result[0].params.param).toBe('🔥')
+    })
+
+    test('handles special characters', () => {
+      const header = 'type;param=\x00\x01\x02\x03'
+      const result = parseAccept(header)
+      expect(result[0].params.param).toBe('\x00\x01\x02\x03')
+    })
+  })
+
+  describe('Sort Stability', () => {
+    test('maintains stable sort for equal q values', () => {
+      const header = 'a;q=0.9,b;q=0.9,c;q=0.9,d;q=0.9'
+      const result = parseAccept(header)
+      expect(result.map((x) => x.type)).toEqual(['a', 'b', 'c', 'd'])
+    })
+
+    test('handles mixed priorities correctly', () => {
+      const header = 'd;q=0.8,b;q=0.9,c;q=0.8,a;q=0.9'
+      const result = parseAccept(header)
+      expect(result.map((x) => x.type)).toEqual(['b', 'a', 'd', 'c'])
+    })
+  })
+})

package/plugins/acryl-router/src/core/utils/accept.ts

@@ -0,0 +1,268 @@
+export interface Accept {
+  type: string
+  params: Record<string, string>
+  q: number
+}
+
+const isWhitespace = (char: number): boolean =>
+  char === 32 || char === 9 || char === 10 || char === 13
+
+const consumeWhitespace = (acceptHeader: string, startIndex: number): number => {
+  while (startIndex < acceptHeader.length) {
+    if (!isWhitespace(acceptHeader.charCodeAt(startIndex))) {
+      break
+    }
+    startIndex++
+  }
+  return startIndex
+}
+
+const ignoreTrailingWhitespace = (acceptHeader: string, startIndex: number): number => {
+  while (startIndex > 0) {
+    if (!isWhitespace(acceptHeader.charCodeAt(startIndex - 1))) {
+      break
+    }
+    startIndex--
+  }
+  return startIndex
+}
+
+const skipInvalidParam = (acceptHeader: string, startIndex: number): [number, boolean] => {
+  while (startIndex < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(startIndex)
+    if (char === 59) {
+      // ';' => next param
+      return [startIndex + 1, true]
+    }
+    if (char === 44) {
+      // ',' => next accept value
+      return [startIndex + 1, false]
+    }
+    startIndex++
+  }
+  return [startIndex, false]
+}
+
+const skipInvalidAcceptValue = (acceptHeader: string, startIndex: number): number => {
+  let i = startIndex
+  let inQuotes = false
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i)
+    if (inQuotes && char === 92) {
+      // '\' => escape
+      i++
+    } else if (char === 34) {
+      // '"' => toggle quotes
+      inQuotes = !inQuotes
+    } else if (!inQuotes && char === 44) {
+      // ',' => next accept value
+      return i + 1
+    }
+    i++
+  }
+  return i
+}
+
+const getNextParam = (
+  acceptHeader: string,
+  startIndex: number
+): [number, string | undefined, string | undefined, boolean] => {
+  startIndex = consumeWhitespace(acceptHeader, startIndex)
+  let i = startIndex
+  let key: string | undefined
+  let value: string | undefined
+  let hasNext = false
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i)
+    if (char === 61) {
+      // '=' => end of key
+      key = acceptHeader.slice(startIndex, ignoreTrailingWhitespace(acceptHeader, i))
+      i++
+      break
+    }
+    if (char === 59) {
+      // ';' => invalid empty param, continue parsing params
+      return [i + 1, undefined, undefined, true]
+    }
+    if (char === 44) {
+      // ',' => invalid empty param, move to next accept value
+      return [i + 1, undefined, undefined, false]
+    }
+    i++
+  }
+  if (key === undefined) {
+    return [i, undefined, undefined, false]
+  }
+
+  i = consumeWhitespace(acceptHeader, i)
+  if (acceptHeader.charCodeAt(i) === 61) {
+    // '=' is invalid as a value, so return undefined
+    const skipResult = skipInvalidParam(acceptHeader, i + 1)
+    return [skipResult[0], key, undefined, skipResult[1]]
+  }
+
+  let inQuotes = false
+  const paramStartIndex = i
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i)
+
+    if (inQuotes && char === 92) {
+      // '\' => escape
+      i++
+    } else if (char === 34) {
+      // '"' => start of quotes
+      if (inQuotes) {
+        let nextIndex = consumeWhitespace(acceptHeader, i + 1)
+        const nextChar = acceptHeader.charCodeAt(nextIndex)
+        if (nextIndex < acceptHeader.length && !(nextChar === 59 || nextChar === 44)) {
+          // not ';' or ',' => invalid trailing chars
+          const skipResult = skipInvalidParam(acceptHeader, nextIndex)
+          return [skipResult[0], key, undefined, skipResult[1]]
+        }
+        value = acceptHeader.slice(paramStartIndex + 1, i)
+        if (value.includes('\\')) {
+          value = value.replace(/\\(.)/g, '$1')
+        }
+        if (nextChar === 44) {
+          // ',' => end of accept value
+          return [nextIndex + 1, key, value, false]
+        }
+        if (nextChar === 59) {
+          // ';' => has next param
+          hasNext = true
+          nextIndex++
+        }
+        i = nextIndex
+        break
+      }
+      inQuotes = true
+    } else if (!inQuotes && (char === 59 || char === 44)) {
+      // ';' or ',' => end of value
+      value = acceptHeader.slice(paramStartIndex, ignoreTrailingWhitespace(acceptHeader, i))
+      if (char === 59) {
+        // ';' => has next param
+        hasNext = true
+      }
+      i++
+      break
+    }
+    i++
+  }
+  return [
+    i,
+    key,
+    value ?? acceptHeader.slice(paramStartIndex, ignoreTrailingWhitespace(acceptHeader, i)),
+    hasNext,
+  ]
+}
+
+const getNextAcceptValue = (
+  acceptHeader: string,
+  startIndex: number
+): [number, Accept | undefined] => {
+  const accept: Accept = {
+    type: '',
+    params: Object.create(null),
+    q: 1,
+  }
+  startIndex = consumeWhitespace(acceptHeader, startIndex)
+  let i = startIndex
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i)
+    if (char === 59 || char === 44) {
+      // ';' or ',' => end of type
+      accept.type = acceptHeader.slice(startIndex, ignoreTrailingWhitespace(acceptHeader, i))
+      i++
+      if (char === 44) {
+        // ',' => end of value
+        return [i, accept.type ? accept : undefined]
+      }
+      if (!accept.type) {
+        return [skipInvalidAcceptValue(acceptHeader, i), undefined]
+      }
+      break // parse params
+    }
+    i++
+  }
+  if (!accept.type) {
+    accept.type = acceptHeader.slice(
+      startIndex,
+      ignoreTrailingWhitespace(acceptHeader, acceptHeader.length)
+    )
+    return [acceptHeader.length, accept.type ? accept : undefined]
+  }
+
+  let param: string | undefined
+  let value: string | undefined
+  let hasNext: boolean
+  while (i < acceptHeader.length) {
+    ;[i, param, value, hasNext] = getNextParam(acceptHeader, i)
+    if (param && value) {
+      accept.params[param] = value
+    }
+    if (!hasNext) {
+      break
+    }
+  }
+
+  return [i, accept] as [number, Accept]
+}
+
+export const parseAccept = (acceptHeader: string): Accept[] => {
+  if (!acceptHeader) {
+    return []
+  }
+
+  const values: Accept[] = []
+  let i = 0
+  let accept: Accept | undefined
+  let requiresSort = false // in many cases, accept values are already sorted by quality (e.g. "text/html, application/json;q=0.9, */*;q=0.8")
+  let lastAccept: Accept | undefined
+  while (i < acceptHeader.length) {
+    ;[i, accept] = getNextAcceptValue(acceptHeader, i)
+    if (accept) {
+      // The "q" parameter is case-insensitive (RFC 9110 §12.4.2). `params` keeps
+      // the name as it was sent, so both spellings are checked here.
+      accept.q = parseQuality(accept.params.q ?? accept.params.Q)
+      values.push(accept)
+      if (lastAccept && lastAccept.q < accept.q) {
+        // find higher quality accept value, so we need to sort
+        requiresSort = true
+      }
+      lastAccept = accept
+    }
+  }
+  if (requiresSort) {
+    values.sort((a, b) => b.q - a.q)
+  }
+
+  return values
+}
+
+const parseQuality = (qVal?: string): number => {
+  if (qVal === undefined) {
+    return 1
+  }
+  if (qVal === '') {
+    return 1
+  }
+  if (qVal === 'NaN') {
+    return 0
+  }
+
+  const num = Number(qVal)
+  if (Number.isNaN(num)) {
+    return 1
+  }
+  // A qvalue is 0-1 (RFC 9110 12.4.2). Clamp rather than reject, but clamp each side to the
+  // bound it is past: sending a negative q below every real one instead of above them, which
+  // is what `-Infinity` already did.
+  if (num < 0) {
+    return 0
+  }
+  if (num > 1) {
+    return 1
+  }
+
+  return num
+}

package/plugins/acryl-router/src/core/utils/basic-auth.test.ts

@@ -0,0 +1,56 @@
+import { auth } from './basic-auth.ts'
+
+describe('auth', () => {
+  it('auth() - not include Authorization Header', () => {
+    const res = auth(new Request('http://localhost/auth'))
+    expect(res).toBeUndefined()
+  })
+
+  it('auth() - invalid Authorization Header format', () => {
+    const res = auth(
+      new Request('http://localhost/auth', {
+        headers: { Authorization: 'InvalidAuthHeader' },
+      })
+    )
+    expect(res).toBeUndefined()
+  })
+
+  it('auth() - invalid Base64 string in Authorization Header', () => {
+    const res = auth(
+      new Request('http://localhost/auth', {
+        headers: { Authorization: 'Basic InvalidBase64' },
+      })
+    )
+    expect(res).toBeUndefined()
+  })
+
+  it('auth() - valid Authorization Header', () => {
+    const validBase64 = btoa('username:password')
+    const res = auth(
+      new Request('http://localhost/auth', {
+        headers: { Authorization: `Basic ${validBase64}` },
+      })
+    )
+    expect(res).toEqual({ username: 'username', password: 'password' })
+  })
+
+  it('auth() - empty username', () => {
+    const validBase64 = btoa(':password')
+    const res = auth(
+      new Request('http://localhost/auth', {
+        headers: { Authorization: `Basic ${validBase64}` },
+      })
+    )
+    expect(res).toEqual({ username: '', password: 'password' })
+  })
+
+  it('auth() - empty password', () => {
+    const validBase64 = btoa('username:')
+    const res = auth(
+      new Request('http://localhost/auth', {
+        headers: { Authorization: `Basic ${validBase64}` },
+      })
+    )
+    expect(res).toEqual({ username: 'username', password: '' })
+  })
+})

package/plugins/acryl-router/src/core/utils/basic-auth.ts

@@ -0,0 +1,26 @@
+import { decodeBase64 } from './encode.ts'
+
+const CREDENTIALS_REGEXP = /^ *(?:[Bb][Aa][Ss][Ii][Cc]) +([A-Za-z0-9._~+/-]+=*) *$/
+const USER_PASS_REGEXP = /^([^:]*):(.*)$/
+const utf8Decoder = new TextDecoder()
+
+export type Auth = (req: Request) => { username: string; password: string } | undefined
+
+export const auth: Auth = (req: Request) => {
+  const match = CREDENTIALS_REGEXP.exec(req.headers.get('Authorization') || '')
+  if (!match) {
+    return undefined
+  }
+
+  let userPass = undefined
+  // If an invalid string is passed to atob(), it throws a `DOMException`.
+  try {
+    userPass = USER_PASS_REGEXP.exec(utf8Decoder.decode(decodeBase64(match[1])))
+  } catch {} // Do nothing
+
+  if (!userPass) {
+    return undefined
+  }
+
+  return { username: userPass[1], password: userPass[2] }
+}