ansi-regex 6.0.1 → 6.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/index.d.ts CHANGED
@@ -1,11 +1,11 @@
1
- export interface Options {
1
+ export type Options = {
2
2
  /**
3
3
  Match only the first ANSI escape.
4
4
 
5
5
  @default false
6
6
  */
7
7
  readonly onlyFirst: boolean;
8
- }
8
+ };
9
9
 
10
10
  /**
11
11
  Regular expression for matching ANSI escape codes.
package/index.js CHANGED
@@ -1,8 +1,14 @@
1
1
  export default function ansiRegex({onlyFirst = false} = {}) {
2
- const pattern = [
3
- '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
4
- '(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
5
- ].join('|');
2
+ // Valid string terminator sequences are BEL, ESC\, and 0x9c
3
+ const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
4
+
5
+ // OSC sequences only: ESC ] ... ST (non-greedy until the first ST)
6
+ const osc = `(?:\\u001B\\][\\s\\S]*?${ST})`;
7
+
8
+ // CSI and related: ESC/C1, optional intermediates, optional params (supports ; and :) then final byte
9
+ const csi = '[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]';
10
+
11
+ const pattern = `${osc}|${csi}`;
6
12
 
7
13
  return new RegExp(pattern, onlyFirst ? undefined : 'g');
8
14
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "ansi-regex",
3
- "version": "6.0.1",
3
+ "version": "6.2.0",
4
4
  "description": "Regular expression for matching ANSI escape codes",
5
5
  "license": "MIT",
6
6
  "repository": "chalk/ansi-regex",
@@ -12,6 +12,8 @@
12
12
  },
13
13
  "type": "module",
14
14
  "exports": "./index.js",
15
+ "types": "./index.d.ts",
16
+ "sideEffects": false,
15
17
  "engines": {
16
18
  "node": ">=12"
17
19
  },
@@ -51,8 +53,9 @@
51
53
  "pattern"
52
54
  ],
53
55
  "devDependencies": {
56
+ "ansi-escapes": "^5.0.0",
54
57
  "ava": "^3.15.0",
55
- "tsd": "^0.14.0",
56
- "xo": "^0.38.2"
58
+ "tsd": "^0.21.0",
59
+ "xo": "^0.54.2"
57
60
  }
58
61
  }
package/readme.md CHANGED
@@ -4,8 +4,8 @@
4
4
 
5
5
  ## Install
6
6
 
7
- ```
8
- $ npm install ansi-regex
7
+ ```sh
8
+ npm install ansi-regex
9
9
  ```
10
10
 
11
11
  ## Usage
@@ -46,6 +46,12 @@ Default: `false` *(Matches any ANSI escape codes in a string)*
46
46
 
47
47
  Match only the first ANSI escape.
48
48
 
49
+ ## Important
50
+
51
+ If you run the regex against untrusted user input in a server context, you should [give it a timeout](https://github.com/sindresorhus/super-regex).
52
+
53
+ **I do not consider [ReDoS](https://blog.yossarian.net/2022/12/28/ReDoS-vulnerabilities-and-misaligned-incentives) a valid vulnerability for this package.**
54
+
49
55
  ## FAQ
50
56
 
51
57
  ### Why do you test for codes not in the ECMA 48 standard?
@@ -58,15 +64,3 @@ On the historical side, those ECMA standards were established in the early 90's
58
64
 
59
65
  - [Sindre Sorhus](https://github.com/sindresorhus)
60
66
  - [Josh Junon](https://github.com/qix-)
61
-
62
- ---
63
-
64
- <div align="center">
65
- <b>
66
- <a href="https://tidelift.com/subscription/pkg/npm-ansi-regex?utm_source=npm-ansi-regex&utm_medium=referral&utm_campaign=readme">Get professional support for this package with a Tidelift subscription</a>
67
- </b>
68
- <br>
69
- <sub>
70
- Tidelift helps make open source sustainable for maintainers while giving companies<br>assurances about security, maintenance, and licensing for their dependencies.
71
- </sub>
72
- </div>