ima2-gen 3.15.1 → 3.16.0

package/node_modules/proxy-addr/README.md

@@ -1,139 +0,0 @@
-# proxy-addr
-
-[![NPM Version][npm-version-image]][npm-url]
-[![NPM Downloads][npm-downloads-image]][npm-url]
-[![Node.js Version][node-image]][node-url]
-[![Build Status][ci-image]][ci-url]
-[![Test Coverage][coveralls-image]][coveralls-url]
-
-Determine address of proxied request
-
-## Install
-
-This is a [Node.js](https://nodejs.org/en/) module available through the
-[npm registry](https://www.npmjs.com/). Installation is done using the
-[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
-
-```sh
-$ npm install proxy-addr
-```
-
-## API
-
-```js
-var proxyaddr = require('proxy-addr')
-```
-
-### proxyaddr(req, trust)
-
-Return the address of the request, using the given `trust` parameter.
-
-The `trust` argument is a function that returns `true` if you trust
-the address, `false` if you don't. The closest untrusted address is
-returned.
-
-```js
-proxyaddr(req, function (addr) { return addr === '127.0.0.1' })
-proxyaddr(req, function (addr, i) { return i < 1 })
-```
-
-The `trust` arugment may also be a single IP address string or an
-array of trusted addresses, as plain IP addresses, CIDR-formatted
-strings, or IP/netmask strings.
-
-```js
-proxyaddr(req, '127.0.0.1')
-proxyaddr(req, ['127.0.0.0/8', '10.0.0.0/8'])
-proxyaddr(req, ['127.0.0.0/255.0.0.0', '192.168.0.0/255.255.0.0'])
-```
-
-This module also supports IPv6. Your IPv6 addresses will be normalized
-automatically (i.e. `fe80::00ed:1` equals `fe80:0:0:0:0:0:ed:1`).
-
-```js
-proxyaddr(req, '::1')
-proxyaddr(req, ['::1/128', 'fe80::/10'])
-```
-
-This module will automatically work with IPv4-mapped IPv6 addresses
-as well to support node.js in IPv6-only mode. This means that you do
-not have to specify both `::ffff:a00:1` and `10.0.0.1`.
-
-As a convenience, this module also takes certain pre-defined names
-in addition to IP addresses, which expand into IP addresses:
-
-```js
-proxyaddr(req, 'loopback')
-proxyaddr(req, ['loopback', 'fc00:ac:1ab5:fff::1/64'])
-```
-
-  * `loopback`: IPv4 and IPv6 loopback addresses (like `::1` and
-    `127.0.0.1`).
-  * `linklocal`: IPv4 and IPv6 link-local addresses (like
-    `fe80::1:1:1:1` and `169.254.0.1`).
-  * `uniquelocal`: IPv4 private addresses and IPv6 unique-local
-    addresses (like `fc00:ac:1ab5:fff::1` and `192.168.0.1`).
-
-When `trust` is specified as a function, it will be called for each
-address to determine if it is a trusted address. The function is
-given two arguments: `addr` and `i`, where `addr` is a string of
-the address to check and `i` is a number that represents the distance
-from the socket address.
-
-### proxyaddr.all(req, [trust])
-
-Return all the addresses of the request, optionally stopping at the
-first untrusted. This array is ordered from closest to furthest
-(i.e. `arr[0] === req.connection.remoteAddress`).
-
-```js
-proxyaddr.all(req)
-```
-
-The optional `trust` argument takes the same arguments as `trust`
-does in `proxyaddr(req, trust)`.
-
-```js
-proxyaddr.all(req, 'loopback')
-```
-
-### proxyaddr.compile(val)
-
-Compiles argument `val` into a `trust` function. This function takes
-the same arguments as `trust` does in `proxyaddr(req, trust)` and
-returns a function suitable for `proxyaddr(req, trust)`.
-
-```js
-var trust = proxyaddr.compile('loopback')
-var addr = proxyaddr(req, trust)
-```
-
-This function is meant to be optimized for use against every request.
-It is recommend to compile a trust function up-front for the trusted
-configuration and pass that to `proxyaddr(req, trust)` for each request.
-
-## Testing
-
-```sh
-$ npm test
-```
-
-## Benchmarks
-
-```sh
-$ npm run-script bench
-```
-
-## License
-
-[MIT](LICENSE)
-
-[ci-image]: https://badgen.net/github/checks/jshttp/proxy-addr/master?label=ci
-[ci-url]: https://github.com/jshttp/proxy-addr/actions?query=workflow%3Aci
-[coveralls-image]: https://badgen.net/coveralls/c/github/jshttp/proxy-addr/master
-[coveralls-url]: https://coveralls.io/r/jshttp/proxy-addr?branch=master
-[node-image]: https://badgen.net/npm/node/proxy-addr
-[node-url]: https://nodejs.org/en/download
-[npm-downloads-image]: https://badgen.net/npm/dm/proxy-addr
-[npm-url]: https://npmjs.org/package/proxy-addr
-[npm-version-image]: https://badgen.net/npm/v/proxy-addr

package/node_modules/proxy-addr/index.js

@@ -1,327 +0,0 @@
-/*!
- * proxy-addr
- * Copyright(c) 2014-2016 Douglas Christopher Wilson
- * MIT Licensed
- */
-
-'use strict'
-
-/**
- * Module exports.
- * @public
- */
-
-module.exports = proxyaddr
-module.exports.all = alladdrs
-module.exports.compile = compile
-
-/**
- * Module dependencies.
- * @private
- */
-
-var forwarded = require('forwarded')
-var ipaddr = require('ipaddr.js')
-
-/**
- * Variables.
- * @private
- */
-
-var DIGIT_REGEXP = /^[0-9]+$/
-var isip = ipaddr.isValid
-var parseip = ipaddr.parse
-
-/**
- * Pre-defined IP ranges.
- * @private
- */
-
-var IP_RANGES = {
-  linklocal: ['169.254.0.0/16', 'fe80::/10'],
-  loopback: ['127.0.0.1/8', '::1/128'],
-  uniquelocal: ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7']
-}
-
-/**
- * Get all addresses in the request, optionally stopping
- * at the first untrusted.
- *
- * @param {Object} request
- * @param {Function|Array|String} [trust]
- * @public
- */
-
-function alladdrs (req, trust) {
-  // get addresses
-  var addrs = forwarded(req)
-
-  if (!trust) {
-    // Return all addresses
-    return addrs
-  }
-
-  if (typeof trust !== 'function') {
-    trust = compile(trust)
-  }
-
-  for (var i = 0; i < addrs.length - 1; i++) {
-    if (trust(addrs[i], i)) continue
-
-    addrs.length = i + 1
-  }
-
-  return addrs
-}
-
-/**
- * Compile argument into trust function.
- *
- * @param {Array|String} val
- * @private
- */
-
-function compile (val) {
-  if (!val) {
-    throw new TypeError('argument is required')
-  }
-
-  var trust
-
-  if (typeof val === 'string') {
-    trust = [val]
-  } else if (Array.isArray(val)) {
-    trust = val.slice()
-  } else {
-    throw new TypeError('unsupported trust argument')
-  }
-
-  for (var i = 0; i < trust.length; i++) {
-    val = trust[i]
-
-    if (!Object.prototype.hasOwnProperty.call(IP_RANGES, val)) {
-      continue
-    }
-
-    // Splice in pre-defined range
-    val = IP_RANGES[val]
-    trust.splice.apply(trust, [i, 1].concat(val))
-    i += val.length - 1
-  }
-
-  return compileTrust(compileRangeSubnets(trust))
-}
-
-/**
- * Compile `arr` elements into range subnets.
- *
- * @param {Array} arr
- * @private
- */
-
-function compileRangeSubnets (arr) {
-  var rangeSubnets = new Array(arr.length)
-
-  for (var i = 0; i < arr.length; i++) {
-    rangeSubnets[i] = parseipNotation(arr[i])
-  }
-
-  return rangeSubnets
-}
-
-/**
- * Compile range subnet array into trust function.
- *
- * @param {Array} rangeSubnets
- * @private
- */
-
-function compileTrust (rangeSubnets) {
-  // Return optimized function based on length
-  var len = rangeSubnets.length
-  return len === 0
-    ? trustNone
-    : len === 1
-      ? trustSingle(rangeSubnets[0])
-      : trustMulti(rangeSubnets)
-}
-
-/**
- * Parse IP notation string into range subnet.
- *
- * @param {String} note
- * @private
- */
-
-function parseipNotation (note) {
-  var pos = note.lastIndexOf('/')
-  var str = pos !== -1
-    ? note.substring(0, pos)
-    : note
-
-  if (!isip(str)) {
-    throw new TypeError('invalid IP address: ' + str)
-  }
-
-  var ip = parseip(str)
-
-  if (pos === -1 && ip.kind() === 'ipv6' && ip.isIPv4MappedAddress()) {
-    // Store as IPv4
-    ip = ip.toIPv4Address()
-  }
-
-  var max = ip.kind() === 'ipv6'
-    ? 128
-    : 32
-
-  var range = pos !== -1
-    ? note.substring(pos + 1, note.length)
-    : null
-
-  if (range === null) {
-    range = max
-  } else if (DIGIT_REGEXP.test(range)) {
-    range = parseInt(range, 10)
-  } else if (ip.kind() === 'ipv4' && isip(range)) {
-    range = parseNetmask(range)
-  } else {
-    range = null
-  }
-
-  if (range <= 0 || range > max) {
-    throw new TypeError('invalid range on address: ' + note)
-  }
-
-  return [ip, range]
-}
-
-/**
- * Parse netmask string into CIDR range.
- *
- * @param {String} netmask
- * @private
- */
-
-function parseNetmask (netmask) {
-  var ip = parseip(netmask)
-  var kind = ip.kind()
-
-  return kind === 'ipv4'
-    ? ip.prefixLengthFromSubnetMask()
-    : null
-}
-
-/**
- * Determine address of proxied request.
- *
- * @param {Object} request
- * @param {Function|Array|String} trust
- * @public
- */
-
-function proxyaddr (req, trust) {
-  if (!req) {
-    throw new TypeError('req argument is required')
-  }
-
-  if (!trust) {
-    throw new TypeError('trust argument is required')
-  }
-
-  var addrs = alladdrs(req, trust)
-  var addr = addrs[addrs.length - 1]
-
-  return addr
-}
-
-/**
- * Static trust function to trust nothing.
- *
- * @private
- */
-
-function trustNone () {
-  return false
-}
-
-/**
- * Compile trust function for multiple subnets.
- *
- * @param {Array} subnets
- * @private
- */
-
-function trustMulti (subnets) {
-  return function trust (addr) {
-    if (!isip(addr)) return false
-
-    var ip = parseip(addr)
-    var ipconv
-    var kind = ip.kind()
-
-    for (var i = 0; i < subnets.length; i++) {
-      var subnet = subnets[i]
-      var subnetip = subnet[0]
-      var subnetkind = subnetip.kind()
-      var subnetrange = subnet[1]
-      var trusted = ip
-
-      if (kind !== subnetkind) {
-        if (subnetkind === 'ipv4' && !ip.isIPv4MappedAddress()) {
-          // Incompatible IP addresses
-          continue
-        }
-
-        if (!ipconv) {
-          // Convert IP to match subnet IP kind
-          ipconv = subnetkind === 'ipv4'
-            ? ip.toIPv4Address()
-            : ip.toIPv4MappedAddress()
-        }
-
-        trusted = ipconv
-      }
-
-      if (trusted.match(subnetip, subnetrange)) {
-        return true
-      }
-    }
-
-    return false
-  }
-}
-
-/**
- * Compile trust function for single subnet.
- *
- * @param {Object} subnet
- * @private
- */
-
-function trustSingle (subnet) {
-  var subnetip = subnet[0]
-  var subnetkind = subnetip.kind()
-  var subnetisipv4 = subnetkind === 'ipv4'
-  var subnetrange = subnet[1]
-
-  return function trust (addr) {
-    if (!isip(addr)) return false
-
-    var ip = parseip(addr)
-    var kind = ip.kind()
-
-    if (kind !== subnetkind) {
-      if (subnetisipv4 && !ip.isIPv4MappedAddress()) {
-        // Incompatible IP addresses
-        return false
-      }
-
-      // Convert IP to match subnet IP kind
-      ip = subnetisipv4
-        ? ip.toIPv4Address()
-        : ip.toIPv4MappedAddress()
-    }
-
-    return ip.match(subnetip, subnetrange)
-  }
-}

package/node_modules/proxy-addr/package.json

@@ -1,47 +0,0 @@
-{
-  "name": "proxy-addr",
-  "description": "Determine address of proxied request",
-  "version": "2.0.7",
-  "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
-  "license": "MIT",
-  "keywords": [
-    "ip",
-    "proxy",
-    "x-forwarded-for"
-  ],
-  "repository": "jshttp/proxy-addr",
-  "dependencies": {
-    "forwarded": "0.2.0",
-    "ipaddr.js": "1.9.1"
-  },
-  "devDependencies": {
-    "benchmark": "2.1.4",
-    "beautify-benchmark": "0.2.4",
-    "deep-equal": "1.0.1",
-    "eslint": "7.26.0",
-    "eslint-config-standard": "14.1.1",
-    "eslint-plugin-import": "2.23.4",
-    "eslint-plugin-markdown": "2.2.0",
-    "eslint-plugin-node": "11.1.0",
-    "eslint-plugin-promise": "4.3.1",
-    "eslint-plugin-standard": "4.1.0",
-    "mocha": "8.4.0",
-    "nyc": "15.1.0"
-  },
-  "files": [
-    "LICENSE",
-    "HISTORY.md",
-    "README.md",
-    "index.js"
-  ],
-  "engines": {
-    "node": ">= 0.10"
-  },
-  "scripts": {
-    "bench": "node benchmark/index.js",
-    "lint": "eslint .",
-    "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
-    "test-cov": "nyc --reporter=html --reporter=text npm test"
-  }
-}

package/node_modules/qs/.editorconfig

@@ -1,46 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 4
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true
-max_line_length = 180
-quote_type = single
-
-[test/*]
-max_line_length = off
-
-[LICENSE.md]
-indent_size = off
-
-[*.md]
-max_line_length = off
-
-[*.json]
-max_line_length = off
-
-[Makefile]
-max_line_length = off
-
-[CHANGELOG.md]
-indent_style = space
-indent_size = 2
-
-[LICENSE]
-indent_size = 2
-max_line_length = off
-
-[coverage/**/*]
-indent_size = off
-indent_style = off
-indent = off
-max_line_length = off
-
-[.nycrc]
-indent_style = tab
-
-[tea.yaml]
-indent_size = 2

package/node_modules/qs/.github/FUNDING.yml

@@ -1,12 +0,0 @@
-# These are supported funding model platforms
-
-github: [ljharb]
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: npm/qs
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-otechie: # Replace with a single Otechie username
-custom: # Replace with a single custom sponsorship URL

package/node_modules/qs/.github/SECURITY.md

@@ -1,11 +0,0 @@
-# Security
-
-Please file a private vulnerability report via GitHub, email [@ljharb](https://github.com/ljharb), or see https://tidelift.com/security if you have a potential security vulnerability to report.
-
-## Incident Response Plan
-
-Please see our [Incident Response Plan](https://github.com/ljharb/.github/blob/main/INCIDENT_RESPONSE_PLAN.md).
-
-## Threat Model
-
-Please see [THREAT_MODEL.md](./THREAT_MODEL.md).

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -1,78 +0,0 @@
-## Threat Model for qs (querystring parsing library)
-
-### 1. Library Overview
-
-- **Library Name:** qs
-- **Brief Description:** A JavaScript library for parsing and stringifying URL query strings, supporting nested objects and arrays. It is widely used in Node.js and web applications for processing query parameters[2][6][8].
-- **Key Public APIs/Functions:** `qs.parse()`, `qs.stringify()`
-
-### 2. Define Scope
-
-This threat model focuses on the core parsing and stringifying functionality, specifically the handling of nested objects and arrays, option validation, and cycle management in stringification.
-
-### 3. Conceptual System Diagram
-
-```
-Caller Application → qs.parse(input, options) → Parsing Engine → Output Object
-                           │
-                           └→ Options Handling
-
-Caller Application → qs.stringify(obj, options) → Stringifying Engine → Output String
-                           │
-                           └→ Options Handling
-                           └→ Cycle Tracking
-```
-
-**Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
-- **Input object (stringify):** May contain cycles, which can lead to infinite loops during stringification
-- **Options:** Provided by the caller
-- **Cycle Tracking:** Used only during stringification to detect and handle circular references
-
-### 4. Identify Assets
-
-- **Integrity of parsed output:** Prevent malicious manipulation of the output object structure, especially ensuring builtins/globals are not modified as a result of parse[3][4][8].
-- **Confidentiality of processed data:** Avoid leaking sensitive information through errors or output.
-- **Availability/performance for host application:** Prevent crashes or resource exhaustion in the consuming application.
-- **Security of host application:** Prevent the library from being a vector for attacks (e.g., prototype pollution, DoS).
-- **Reputation of library:** Maintain trust by avoiding supply chain attacks and vulnerabilities[1].
-
-### 5. Identify Threats
-
-| Component / API / Interaction         | S  | T  | R  | I  | D  | E  |
-|---------------------------------------|----|----|----|----|----|----|
-| Public API Call (`parse`)             | –  | ✓  | –  | ✓  | ✓  | ✓  |
-| Public API Call (`stringify`)         | –  | ✓  | –  | ✓  | ✓  | –  |
-| Options Handling                      | ✓  | ✓  | –  | ✓  | –  | ✓  |
-| Dependency Interaction                | –  | –  | –  | –  | ✓  | –  |
-
-**Key Threats:**
-- **Tampering:** Malicious input can, if not prevented, alter parsed output (e.g., prototype pollution via `__proto__`, modification of builtins/globals)[3][4][8].
-- **Information Disclosure:** Error messages may expose internal details or sensitive data.
-- **Denial of Service:** Large or malformed input can exhaust memory or CPU.
-- **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
-
-### 6. Mitigation/Countermeasures
-
-| Threat Identified                                 | Proposed Mitigation |
-|---------------------------------------------------|---------------------|
-| Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
-| Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | Enforce `arrayLimit` and `parameterLimit` with safe defaults; enable `throwOnLimitExceeded`; limit nesting depth[7]. |
-| Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
-
-### 7. Risk Ranking
-
-- **High:** Denial of Service via array parsing or malformed input (historical vulnerability)
-- **Medium:** Prototype pollution via options or input (if `allowPrototypes` enabled)
-- **Low:** Information disclosure in errors
-
-### 8. Next Steps & Review
-
-1. **Audit option validation logic.**
-2. **Add depth limiting to nested parsing and stringification.**
-3. **Implement fuzz testing for parser and stringifier edge cases.**
-4. **Regularly review dependencies for vulnerabilities.**
-5. **Keep documentation and threat model up to date.**
-6. **Ensure builtins/globals are never modified as a result of parse.**
-7. **Support round-trip consistency between parse and stringify as a non-security goal, with the right options[5][9].**

package/node_modules/qs/.nycrc

@@ -1,13 +0,0 @@
-{
-	"all": true,
-	"check-coverage": false,
-	"reporter": ["text-summary", "text", "html", "json"],
-	"lines": 86,
-	"statements": 85.93,
-	"functions": 82.43,
-	"branches": 76.06,
-	"exclude": [
-		"coverage",
-		"dist"
-	]
-}