configorama 0.4.9 → 0.5.0

package/lib/parsers/yaml.js

@@ -83,28 +83,29 @@ function findOutermostVariables(text) {
 
 
 function matchOutermostBraces(text) {
-    let depth = 0;
-    let startIndex = -1;
-    let results = [];
-
-    for (let i = 0; i < text.length; i++) {
-        if (text[i] === '{') {
-            if (depth === 0) {
-                startIndex = i;
-            }
-            depth++;
-        } else if (text[i] === '}') {
-            depth--;
-            if (depth === 0 && startIndex !== -1) {
-                results.push(text.substring(startIndex, i + 1));
-                startIndex = -1;
-            }
-        }
+  let depth = 0
+  let startIndex = -1
+  let results = []
+
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === '{') {
+      if (depth === 0) {
+        startIndex = i
+      }
+      depth++
+    } else if (text[i] === '}') {
+      depth--
+      if (depth === 0 && startIndex !== -1) {
+        results.push(text.substring(startIndex, i + 1))
+        startIndex = -1
+      }
     }
+  }
 
-    return results;
+  return results
 }
 
+
 // https://regex101.com/r/XIltbc/1
 const KEY_OBJECT = /^[ \t]*[^":\s]*:\s+\{/gm
 
@@ -161,7 +162,18 @@ function preProcess(ymlStr = '') {
         if (hasNestedVars && hasNestedVars.length) {
           let fixedText = txt
           hasNestedVars.forEach((nested) => {
+            const isObject = txt.match(/^\{/) && txt.match(/}$/)
             // console.log('nested', nested)
+
+            if (nested.match(/^\${/) && (nested.match(/"/) || nested.match(/'/)) && !isObject) {
+              return
+            }
+
+            // Fallback comma ${opt:stage, dev}
+            if (nested.match(/^\${/) && nested.match(/,/) && !txt.match(/\n/) ) {
+              return
+            }
+
             if (txt.indexOf(`"${nested}"`) > -1) {
               return
             }

package/lib/parsers/yaml.test.js

@@ -0,0 +1,169 @@
+const { test } = require('uvu')
+const assert = require('uvu/assert')
+const { preProcess } = require('./yaml')
+
+test('preProcess - should wrap variables in quotes inside array brackets', () => {
+  const input = `
+
+x: !Not [!Equals [!Join ['', "\${param:githubActionsAllowedAwsActions}"]]]
+
+y: !Not [!Equals [!Join ['', \${param:xyz}]]]
+
+# empty: "\${file(./config.json):na, ''}"
+
+TestThree:
+  foo: 
+    - ['a', 'b', 'c']
+    - ['d', 'e', \${ opt:otherFlag }, \${ opt:chillFlag }]
+    - ['d', 'e', "\${opt:otherFlag}", "\${opt:chillFlag}"]
+    - ['d', 'e', "\${opt:otherFlag}", "\${opt:chillFlag}"]
+
+
+key: ['string1', 'string2', 'string3', 
+  'string4', \${opt:otherFlag}, 
+  'string6'
+]
+
+keyTwo: ['string1', 'long
+  string', 'string3', 'string4', 'string5', 'string6']
+
+myarray: [
+  String1, String2, String3,
+  String4, String5, String5, String7
+]
+
+xx: {
+  cool: \${self:empty, 'no value here'}
+}
+
+myarrayTwo: [
+  String1, \${self:empty, 'no value here'}, String3,
+  String4, String5, String5, String7
+]
+
+normalObject: 
+  cool: \${self:empty, 'no value here'}
+
+# shorthand variable declaration
+domainNameTwo: my-site-two.com
+stage: dev
+domainsTwo:
+  prod:    api.\${domainNameTwo}
+  staging: api-staging.\${domainNameTwo}
+  dev:     api-dev.\${domainNameTwo}
+resolvedDomainNameTwo: \${domainsTwo.\${opt:stage, "prod"}}
+
+`
+  const expected = `
+
+x: !Not [!Equals [!Join ['', "\${param:githubActionsAllowedAwsActions}"]]]
+
+y: !Not [!Equals [!Join ['', "\${param:xyz}"]]]
+
+# empty: "\${file(./config.json):na, ''}"
+
+TestThree:
+  foo: 
+    - ['a', 'b', 'c']
+    - ['d', 'e', "\${ opt:otherFlag }", "\${ opt:chillFlag }"]
+    - ['d', 'e', "\${opt:otherFlag}", "\${opt:chillFlag}"]
+    - ['d', 'e', "\${opt:otherFlag}", "\${opt:chillFlag}"]
+
+
+key: ['string1', 'string2', 'string3', 
+  'string4', "\${opt:otherFlag}", 
+  'string6'
+]
+
+keyTwo: ['string1', 'long
+  string', 'string3', 'string4', 'string5', 'string6']
+
+myarray: [
+  String1, String2, String3,
+  String4, String5, String5, String7
+]
+
+xx: {
+  cool: "\${self:empty, 'no value here'}"
+}
+
+myarrayTwo: [
+  String1, "\${self:empty, 'no value here'}", String3,
+  String4, String5, String5, String7
+]
+
+normalObject: 
+  cool: \${self:empty, 'no value here'}
+
+# shorthand variable declaration
+domainNameTwo: my-site-two.com
+stage: dev
+domainsTwo:
+  prod:    api.\${domainNameTwo}
+  staging: api-staging.\${domainNameTwo}
+  dev:     api-dev.\${domainNameTwo}
+resolvedDomainNameTwo: \${domainsTwo.\${opt:stage, "prod"}}
+
+`
+  const result = preProcess(input)
+  console.log('result', result)
+  assert.equal(result, expected)
+})
+
+test('preProcess - should wrap variables in quotes inside array brackets', () => {
+  const input = `
+service: my-service
+custom:
+  myValue: !Not [!Equals [!Join ['', \${param:xyz}]]]
+`
+  const expected = `
+service: my-service
+custom:
+  myValue: !Not [!Equals [!Join ['', "\${param:xyz}"]]]
+`
+  const result = preProcess(input)
+  assert.equal(result, expected)
+})
+
+test('preProcess - should wrap variables in quotes inside objects', () => {
+  const input = `
+resources:
+  MyResource:
+    Type: AWS::Lambda::Function
+    Properties: {
+      FunctionName: \${env:FUNC_NAME},
+      Handler: index.handler
+    }
+`
+  const expected = `
+resources:
+  MyResource:
+    Type: AWS::Lambda::Function
+    Properties: {
+      FunctionName: "\${env:FUNC_NAME}",
+      Handler: index.handler
+    }
+`
+  const result = preProcess(input)
+  assert.equal(result, expected)
+})
+
+test('preProcess - should not wrap already quoted variables', () => {
+  const input = `
+custom:
+  alreadyQuoted: !Not [!Equals [!Join ['', "\${param:xyz}"]]]
+  objectQuoted:
+    Properties: {
+      Name: "\${env:NAME}"
+    }
+`
+  const result = preProcess(input)
+  assert.equal(result, input)
+})
+
+test('preProcess - should handle empty input', () => {
+  const result = preProcess()
+  assert.equal(result, '')
+})
+
+test.run() 

package/lib/resolvers/valueFromEnv.js

@@ -3,6 +3,16 @@ const envRefSyntax = RegExp(/^env:/g)
 
 function getValueFromEnv(variableString) {
   const requestedEnvVar = variableString.split(':')[1]
+  // console.log('requestedEnvVar', requestedEnvVar)
+  if (requestedEnvVar === '') {
+    throw new Error(`Invalid variable syntax for environment variable reference "${variableString}". 
+
+\${env} variable must have a key path. 
+
+Example: \${env:MY_ENV_VAR}
+`)
+  }
+
   let valueToPopulate
   if (requestedEnvVar !== '' || '' in process.env) {
     valueToPopulate = process.env[requestedEnvVar]

package/lib/resolvers/valueFromGit.js

@@ -1,9 +1,12 @@
 /* from https://github.com/jacob-meacham/serverless-plugin-git-variables/blob/develop/src/index.js */
 const os = require('os')
+const fs = require('fs')
+const path = require('path')
 const childProcess = require('child_process')
 const GitUrlParse = require('git-url-parse')
 const { functionRegex } = require('../utils/regex')
 const formatFunctionArgs = require('../utils/formatFunctionArgs')
+const { findProjectRoot } = require('../utils/find-project-root')
 const GIT_PREFIX = 'git'
 const gitVariableSyntax = RegExp(/^git:/g)
 
@@ -32,6 +35,17 @@ function createResolver(cwd) {
 
     const verifyMsg = `Verify the cwd has a .git directory\n`
     const normalizedVar = (variable || '').toLowerCase()
+    // console.log('normalizedVar', normalizedVar)
+
+    const argsMatch = (variable || '').match(/(.*)\((.*)\)/)
+    // console.log('argsMatch', argsMatch)
+    if (argsMatch) {
+      const funcName = argsMatch[1]
+      const args = argsMatch[2]
+      if (funcName === 'timestamp' && args) {
+        value = await getGitTimestamp(args, cwd)
+      }
+    }
 
     switch (normalizedVar) {
       // Repo owner/name
@@ -61,6 +75,7 @@ function createResolver(cwd) {
         break;
       // Repo name
       case 'dir':
+      case 'directory':
       case 'dirpath': // dirPath
       case 'dir-path':
       case 'dir_path':
@@ -152,13 +167,92 @@ function createResolver(cwd) {
         value = `${changes.length > 0}`
         break
       default:
-        throw new Error(`Git variable ${variable} is unknown. Candidates are 'describe', 'describeLight', 'sha1', 'commit', 'branch', 'message', 'repository'`)
+        if (!value) {
+          throw new Error(`Git variable ${variable} is unknown. Candidates are 'describe', 'describeLight', 'sha1', 'commit', 'branch', 'message', 'repository'`)
+        }
     }
     return value
   }
   return _getValueFromGit
 }
 
+const cache = new Map()
+
+/**
+ * Gets the last Git commit timestamp for a file
+ * @param {string} file - Path to the file to check
+ * @returns {Promise<Date|undefined>} The commit timestamp or undefined if not in Git
+ */
+async function getGitTimestamp(_file, cwd, throwOnMissing = true) {
+  // Validate file path to prevent command injection
+  if (typeof _file !== 'string') {
+    throw new Error('File path must be a string')
+  }
+
+  // Check for suspicious characters and patterns that could be used for command injection or path traversal
+  const dangerousPatterns = [
+    /[;&|`$]/,  // Command injection chars
+    // /\.\.\//,   // Directory traversal
+    // /\.\./,     // Directory traversal
+    // /^[\/\\]/,  // Absolute paths
+    /[\x00-\x1f\x7f-\x9f]/  // Control characters
+  ]
+
+  if (dangerousPatterns.some(pattern => pattern.test(_file))) {
+    throw new Error('Invalid characters or pattern in file path')
+  }
+
+  // Only allow alphanumeric chars, dashes, underscores, forward slashes, and dots
+  if (!/^[a-zA-Z0-9-_./\\'"]+$/.test(_file)) {
+    throw new Error('File path contains invalid characters')
+  }
+
+  // Normalize path and remove leading slash
+  const file = _file
+    .replace(/^\//, '')
+
+  const cachedTimestamp = cache.get(file)
+  if (cachedTimestamp) return cachedTimestamp
+
+  if (!fs.existsSync(cwd)) {
+    if (throwOnMissing) {
+      throw new Error(`Directory ${cwd} does not exist`)
+    }
+    return undefined
+  }
+
+  try {
+    const cmd = `git log -1 --pretty="%ai" ${file}`
+    // console.log('cmd', cmd)
+    // console.log('cwd', cwd)
+    const output = await _exec(cmd, { cwd })
+    const date = new Date(output)
+    cache.set(file, date)
+    return date.toISOString()
+  } catch (err) {
+    const projectRoot = findProjectRoot(cwd)
+    if (!projectRoot) {
+      if (throwOnMissing) {
+        throw new Error(`No Git repository found in ${cwd}`)
+      }
+      return undefined
+    }
+
+    try {
+      const backupFile = path.join(projectRoot, _file)
+      const output = await _exec(`git log -1 --pretty="%ai" ${backupFile}`, { cwd: projectRoot })
+      const date = new Date(output)
+      cache.set(file, date)
+      return date.toISOString()
+    } catch (err) {
+      if (throwOnMissing) {
+        throw new Error(`File ${file} does not exist in Git`)
+      }
+      return undefined
+    }
+  }
+}
+
 async function getGitRemote(name = 'origin') {
   const remoteValues = await _exec('git remote -v')
   const remotes = remoteValues.toString().split(os.EOL)

package/lib/resolvers/valueFromNumber.js

@@ -1,8 +1,8 @@
-const _ = require('lodash')
+const isNumber = require('lodash.isnumber')
 
 function isNumberVariable(variableString) {
   const num = Number(variableString)
-  return !isNaN(num) && _.isNumber(num)
+  return !isNaN(num) && isNumber(num)
 }
 
 function getValueFromNumber(variableString) {

package/lib/utils/PromiseTracker.js

@@ -1,4 +1,4 @@
-const _ = require('lodash')
+const { trim } = require('./lodash')
 
 // Track promise resolution
 class PromiseTracker {
@@ -18,7 +18,7 @@ class PromiseTracker {
   report() {
     const delta = Date.now() - this.startTime
     const pending = this.getPending()
-    const dots = dotdotdot(this.cursor++, 100, '...')
+    const dots = dotDotDot(this.cursor++, 100, '...')
     console.log([
       `Fetching Async values${dots}`,
     ].concat(
@@ -41,8 +41,7 @@ class PromiseTracker {
     clearInterval(this.interval)
     this.reset()
   }
-  add(variable, prms, specifier, hasFilter) {
-    const promise = prms
+  add(variable, promise, specifier, hasFilter, promiseKey) {
     // Refactor promise tracker to account for multiple instances of a given variable
 
     // console.log(`${specifier} hasFilter`, hasFilter)
@@ -51,13 +50,16 @@ class PromiseTracker {
     let uniqueId = ''
     if (hasFilter) {
       uniqueId = hasFilter.reduce((acc, currentFilter, i) => {
-        acc += `|${_.trim(currentFilter)}`
+        acc += `|${trim(currentFilter)}`
         return acc
       }, '')
     }
 
-    const nameSpacedVariable = `${variable}${uniqueId}`
-    // console.log('nameSpacedVariable', nameSpacedVariable)
+    let nameSpacedVariable = `${variable}${uniqueId}`
+    if (promiseKey) {
+      nameSpacedVariable = promiseKey
+    }
+    // console.log('SET PROMISE', nameSpacedVariable)
 
     promise.waitList = `${variable} waited on by: ${specifier} ${nameSpacedVariable}`
     promise.state = 'pending'
@@ -89,7 +91,7 @@ class PromiseTracker {
   }
 }
 
-function dotdotdot(cursor, times, string) {
+function dotDotDot(cursor, times, string) {
   return Array(times - Math.abs(cursor % (times * 2) - times) + 1).join(string)
 }
 

package/lib/utils/arrayToJsonPath.js

@@ -0,0 +1,11 @@
+/**
+ * Convert array of paths to JSON path string
+ */
+function arrayToJsonPath(paths) {
+  return paths.reduce((result, path, index) => {
+    if (index === 0) return path.toString()
+    return typeof path === 'string' ? `${result}.${path}` : `${result}[${path}]`
+  }, '')
+}
+
+module.exports = { arrayToJsonPath } 

package/lib/utils/cloudformationSchema.js

@@ -1,5 +1,9 @@
 const YAML = require('js-yaml');
-const _ = require('lodash');
+const includes = require('lodash.includes');
+const isString = require('lodash.isstring');
+const split = require('lodash.split');
+const flatten = require('lodash.flatten');
+const map = require('lodash.map');
 
 const functionNames = [
   'And',
@@ -22,13 +26,13 @@ const functionNames = [
 ];
 
 const yamlType = (name, kind) => {
-  const functionName = _.includes(['Ref', 'Condition'], name) ? name : `Fn::${name}`;
+  const functionName = includes(['Ref', 'Condition'], name) ? name : `Fn::${name}`;
   return new YAML.Type(`!${name}`, {
     kind,
     construct: data => {
       if (name === 'GetAtt') {
         // special GetAtt dot syntax
-        return { [functionName]: _.isString(data) ? _.split(data, '.', 2) : data };
+        return { [functionName]: isString(data) ? split(data, '.', 2) : data };
       }
       return { [functionName]: data };
     },
@@ -36,9 +40,9 @@ const yamlType = (name, kind) => {
 };
 
 const createSchema = () => {
-  const types = _.flatten(
-    _.map(functionNames, functionName =>
-      _.map(['mapping', 'scalar', 'sequence'], kind => yamlType(functionName, kind))
+  const types = flatten(
+    map(functionNames, functionName =>
+      map(['mapping', 'scalar', 'sequence'], kind => yamlType(functionName, kind))
     )
   );
   return YAML.Schema.create(types);

package/lib/utils/find-project-root.js

@@ -0,0 +1,25 @@
+const fs = require('fs')
+const path = require('path')
+
+function findProjectRoot(startDir = process.cwd(), maxLookup = 7) {
+  // Start from the current directory or a specified directory
+  let currentDir = startDir
+  let lookupCount = 0
+  
+  // Keep looking up until we find .git, hit the root, or reach max lookup
+  while (currentDir !== path.parse(currentDir).root && lookupCount < maxLookup) {
+    if (fs.existsSync(path.join(currentDir, '.git'))) {
+      return currentDir
+    }
+    // Move up one directory
+    currentDir = path.dirname(currentDir)
+    lookupCount++
+  }
+  
+  // If we reach here, we couldn't find a .git directory within the limit
+  return null
+}
+
+module.exports = {
+  findProjectRoot
+}

package/lib/utils/formatFunctionArgs.js

@@ -1,7 +1,7 @@
-const _ = require('lodash')
+const { trim } = require('./lodash')
 
 function formatArg(arg) {
-  const cleanArg = _.trim(arg).replace(/^('|")/, '').replace(/('|")$/, '')
+  const cleanArg = trim(arg).replace(/^('|")/, '').replace(/('|")$/, '')
   if (cleanArg.match(/^{([^}]+)}$/)) {
     return JSON.parse(cleanArg)
   }

package/lib/utils/handleSignalEvents.js

@@ -1,6 +1,7 @@
 const readline = require('readline')
 
 function handleSignalEvents() {
+  if (global.signalEventHandling) return   // Only set up handlers once
   // NOTE: instantiating this global variable here to keep track of the state
   // usually global variables should be "considered harmful" but are a good fit in this case
   global.signalEventHandling = {
@@ -8,7 +9,7 @@ function handleSignalEvents() {
     shouldExitGracefully: false
   }
 
-  let msg = `
+  const msg = `
 ───────────────────────────────────────────────────────────
 Exit received. Waiting for current operation to finish...
 ───────────────────────────────────────────────────────────
@@ -20,23 +21,25 @@ Exit received. Waiting for current operation to finish...
       output: process.stdout
     })
 
-    rl.on('SIGINT', () => {
-      process.emit('SIGINT')
-    })
-    rl.on('SIGTERM', () => {
-      process.emit('SIGTERM')
-    })
-    rl.on('SIGBREAK', () => {
-      process.emit('SIGBREAK')
-    })
+    // Clean up readline interface when done
+    process.once('exit', () => rl.close())
+    
+    // Use once() instead of on()
+    rl.once('SIGINT', () => process.emit('SIGINT'))
+    rl.once('SIGTERM', () => process.emit('SIGTERM'))
+    rl.once('SIGBREAK', () => process.emit('SIGBREAK'))
   }
 
+  // Remove any existing listeners before adding new ones
+  process.removeAllListeners('SIGINT')
+  process.removeAllListeners('SIGTERM') 
+  process.removeAllListeners('SIGBREAK')
+
   process.on('SIGINT', () => {
     global.signalEventHandling.SIGINTCount += 1
     global.signalEventHandling.shouldExitGracefully = true
     if (global.signalEventHandling.SIGINTCount < 2) {
-      msg = `${msg} Press CTRL + C again to force an exit\nNOTE: Doing so might corrupt the applications state information!`
-      console.log(msg) // eslint-disable-line no-console
+      console.log(`${msg} Press CTRL + C again to force an exit\nNOTE: Doing so might corrupt the applications state information!`)
     } else {
       process.exit(1)
     }
@@ -44,12 +47,12 @@ Exit received. Waiting for current operation to finish...
 
   process.on('SIGTERM', () => {
     global.signalEventHandling.shouldExitGracefully = true
-    console.log(msg) // eslint-disable-line no-console
+    console.log(msg)
   })
 
   process.on('SIGBREAK', () => {
     global.signalEventHandling.shouldExitGracefully = true
-    console.log(msg) // eslint-disable-line no-console
+    console.log(msg)
   })
 }
 

package/lib/utils/isValidValue.js

@@ -1,8 +1,8 @@
-const _ = require('lodash')
+const isEmpty = require('lodash.isempty')
 
 module.exports = function isValidValue(val) {
   if (typeof val === 'object' && val.hasOwnProperty('__internal_only_flag')) {
     return false
   }
-  return val !== null && typeof val !== 'undefined' && !(typeof val === 'object' && _.isEmpty(val))
+  return val !== null && typeof val !== 'undefined' && !(typeof val === 'object' && isEmpty(val))
 }