livelocale 0.12.0 → 0.12.1

package/dist/codemod/index.js

@@ -1,8 +1,13 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -383,7 +388,8 @@ function createStudioServer(options) {
       res.end("Bad Request");
       return;
     }
-    if (filePath !== studioDir && !filePath.startsWith(studioDir + path2.sep)) {
+    const relativePath = path2.relative(studioDir, filePath);
+    if (relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
       res.statusCode = 403;
       res.end("Forbidden");
       return;
@@ -1555,7 +1561,7 @@ function parseIcu(message) {
   parseMessage(0);
   return { args, error };
 }
-var I18NEXT_RE = /\{\{\s*([^{}]*?)\s*\}\}/g;
+var I18NEXT_RE = /\{\{([^{}]*)\}\}/g;
 var NESTING_RE = /\$t\([^)]*\)/g;
 var PRINTF_RE = /%(?:\d+\$)?[-+ 0#]*\d*(?:\.\d+)?[sdifgxXoc]/g;
 var TAG_RE = /<\/?([A-Za-z][\w-]*|\d+)\b[^<>]*>/g;
@@ -3019,7 +3025,12 @@ function escapeAttribute(value) {
 }
 function injectFlagScript(html, src) {
   const tag = `<script src="${escapeAttribute(src)}"></script>`;
-  const cleaned = html.replace(EXISTING_FLAG_TAG, "");
+  let cleaned = html;
+  let previous;
+  do {
+    previous = cleaned;
+    cleaned = cleaned.replace(EXISTING_FLAG_TAG, "");
+  } while (cleaned !== previous);
   for (const pattern of [HEAD_OPEN2, HTML_OPEN2, DOCTYPE2]) {
     const match = pattern.exec(cleaned);
     if (match) {
@@ -3035,8 +3046,8 @@ var NO_REPO_WARNING = "exposeRepo is on but no GitHub repository was found; the
 function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function toPosix(relative10) {
-  return relative10.split(path11.sep).join("/") || ".";
+function toPosix(relative11) {
+  return relative11.split(path11.sep).join("/") || ".";
 }
 function isInside(parent, child) {
   const rel = path11.relative(parent, child);
@@ -3533,11 +3544,14 @@ function setNestedProperty(obj, keyPath, value) {
   let current = obj;
   for (let i = 0; i < keys.length; i++) {
     const key = keys[i];
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      throw new Error(`[livelocale] Forbidden key segment in path: "${keyPath}".`);
+    }
     if (i === keys.length - 1) {
       current[key] = value;
       return;
     }
-    if (!(key in current) || current[key] === null || typeof current[key] !== "object" || Array.isArray(current[key])) {
+    if (!Object.prototype.hasOwnProperty.call(current, key) || current[key] === null || typeof current[key] !== "object" || Array.isArray(current[key])) {
       current[key] = {};
     }
     current = current[key];
@@ -3810,6 +3824,13 @@ var nodeInflate = async (bytes, maxOutputLength) => {
   return result.buffer;
 };
 
+// src/core/strings.ts
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47) end -= 1;
+  return value.slice(0, end);
+}
+
 // src/server/github-rest.ts
 var GitHubApiError = class extends Error {
   constructor(message, status) {
@@ -3842,7 +3863,7 @@ function encodeRefPath(ref) {
 }
 function createGitHubRest(config) {
   const repo = config.repo;
-  const apiBase = (config.apiBase ?? "https://api.github.com").replace(/\/+$/, "");
+  const apiBase = trimTrailingSlashes(config.apiBase ?? "https://api.github.com");
   const fetchImpl = config.fetchImpl ?? globalThis.fetch;
   const owner = repo.split("/")[0] ?? "";
   if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
@@ -4271,6 +4292,7 @@ var BIDI_CONTROL_RE = /[\u202a-\u202e\u2066-\u2069]/g;
 var NEWLINE_RE = /\r\n|\r|\n/g;
 var SPAN_CONTROL_RE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
 var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/g;
+var BACKSLASH_BEFORE_PIPE_RE = /\\(?=\|)/g;
 function cut(text, max) {
   if (text.length <= max) return text;
   let out = text.slice(0, max);
@@ -4300,7 +4322,7 @@ function codePointLabel(ch) {
 }
 function codeSpan(text, maxLength = DEFAULT_SPAN_LENGTH) {
   const truncated = text.length > maxLength ? `${cut(text, maxLength)}\u2026` : text;
-  const content = truncated.replace(NEWLINE_RE, "\u23CE").replace(BIDI_CONTROL_RE, codePointLabel).replace(SPAN_CONTROL_RE, codePointLabel).replace(/\|/g, "\\|");
+  const content = truncated.replace(NEWLINE_RE, "\u23CE").replace(BIDI_CONTROL_RE, codePointLabel).replace(SPAN_CONTROL_RE, codePointLabel).replace(BACKSLASH_BEFORE_PIPE_RE, codePointLabel).replace(/\|/g, "\\|");
   if (content === "") return "` `";
   const fence = "`".repeat(longestBacktickRun(content) + 1);
   const pad = /^[` ]|[` ]$/.test(content) ? " " : "";
@@ -5940,8 +5962,8 @@ function planGitignore(projectDir) {
   if (parseGitignore(current).ignores("public/livelocale", true)) {
     return { path: ".gitignore", action: "unchanged" };
   }
-  const sep10 = current === "" || current.endsWith("\n") ? "" : "\n";
-  return { path: ".gitignore", action: "update", content: `${current}${sep10}${SHARE_GITIGNORE}
+  const sep9 = current === "" || current.endsWith("\n") ? "" : "\n";
+  return { path: ".gitignore", action: "update", content: `${current}${sep9}${SHARE_GITIGNORE}
 ` };
 }
 function planBuild(c) {