massimo 1.5.0 → 1.5.2

package/index.d.ts

@@ -84,10 +84,10 @@ export module errors {
   export const OptionsUrlRequiredError: () => FastifyError
   export const FormDataRequiredError: (value: string) => FastifyError
   export const MissingParamsRequiredError: (value: string) => FastifyError
+  export const InvalidPathParameterError: (value: string) => FastifyError
   export const WrongOptsTypeError: () => FastifyError
   export const InvalidResponseSchemaError: (value: string) => FastifyError
   export const InvalidContentTypeError: (value: string) => FastifyError
   export const InvalidResponseFormatError: () => FastifyError
   export const UnexpectedCallFailureError: (value: string) => FastifyError
 }
-

package/index.js

@@ -39,6 +39,14 @@ function computeURLWithoutPath (url) {
   return url.toString()
 }
 
+function encodePathParameter (value, name) {
+  const encoded = encodeURIComponent(value)
+  if (encoded === '.' || encoded === '..') {
+    throw new errors.InvalidPathParameterError(name)
+  }
+  return encoded
+}
+
 async function buildCallFunction (
   spec,
   baseUrl,
@@ -87,7 +95,7 @@ async function buildCallFunction (
         if (args?.path[param.name] === undefined) {
           throw new errors.MissingParamsRequiredError(param.name)
         }
-        pathToCall = pathToCall.replace(`{${param.name}}`, args.path[param.name])
+        pathToCall = pathToCall.replace(`{${param.name}}`, encodePathParameter(args.path[param.name], param.name))
       }
 
       for (const param of queryParams) {
@@ -105,7 +113,7 @@ async function buildCallFunction (
         if (body[param.name] === undefined) {
           throw new errors.MissingParamsRequiredError(param.name)
         }
-        pathToCall = pathToCall.replace(`{${param.name}}`, body[param.name])
+        pathToCall = pathToCall.replace(`{${param.name}}`, encodePathParameter(body[param.name], param.name))
         body[param.name] = undefined
       }
 

package/lib/errors.js

@@ -11,6 +11,10 @@ export const MissingParamsRequiredError = createError(
   `${ERROR_PREFIX}_MISSING_PARAMS_REQUIRED`,
   "Param %s is missing, and it's required"
 )
+export const InvalidPathParameterError = createError(
+  `${ERROR_PREFIX}_INVALID_PATH_PARAMETER`,
+  'Path parameter %s cannot be "." or ".."'
+)
 export const WrongOptsTypeError = createError(
   `${ERROR_PREFIX}_WRONG_OPTS_TYPE`,
   'opts.type must be either "openapi" or "graphql"'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "massimo",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "A client for HTTP services.",
   "main": "index.js",
   "type": "module",
@@ -40,9 +40,9 @@
   "devDependencies": {
     "@fastify/multipart": "^10.0.0",
     "@platformatic/db": "3.67.0",
-    "@platformatic/foundation": "3.67.0",
+    "@platformatic/foundation": "3.68.0",
     "@platformatic/service": "3.67.0",
-    "@platformatic/telemetry": "3.67.0",
+    "@platformatic/telemetry": "3.68.0",
     "c8": "^10.0.0",
     "cleaner-spec-reporter": "^0.5.0",
     "eslint": "9",