projen-pipelines 0.3.21 → 0.3.23

package/node_modules/is-unsafe/src/contexts/svg.js

@@ -0,0 +1,81 @@
+/**
+ * SVG context patterns.
+ *
+ * SVG is XML-based but renders in browsers, giving it a unique attack surface
+ * that combines XML parser behaviour with browser rendering and JavaScript execution.
+ *
+ * Many of these vectors bypass HTML sanitizers that don't understand SVG semantics
+ * (DOMPurify has documented bypass vulnerabilities specifically in SVG/XML context).
+ */
+
+const SVG_PATTERNS = [
+  {
+    id: 'svg-script-element',
+    description: '<script element inside SVG executes JavaScript',
+    pattern: /<script[\s>/]/i,
+  },
+  {
+    id: 'svg-xlink-href-javascript',
+    description: 'xlink:href with javascript: — classic SVG XSS via <a> or <use>',
+    pattern: /xlink\s*:\s*href\s*=\s*["']?\s*javascript\s*:/i,
+  },
+  {
+    id: 'svg-href-javascript',
+    description: 'href= with javascript: in SVG context (<a>, <animate>, etc.)',
+    pattern: /href\s*=\s*["']?\s*javascript\s*:/i,
+  },
+  {
+    id: 'svg-foreignobject',
+    description: '<foreignObject embeds HTML inside SVG — can execute scripts',
+    pattern: /<foreignObject[\s>/]/i,
+  },
+  {
+    id: 'svg-use-external',
+    description: '<use xlink:href or href pointing to external resource (non-fragment URL)',
+    // Match <use with href= where the value starts with a non-# character (external URL)
+    // [\"'][^#] catches quoted values not starting with #; [^\"'#\s>] catches unquoted
+    pattern: /<use[\s\S]{0,60}(?:xlink\s*:\s*)?href\s*=\s*(?:["'][^#]|[^"'#\s>])/i,
+  },
+  {
+    id: 'svg-animate-href',
+    description: '<animate attributeName="href" — can dynamically change href to javascript:',
+    pattern: /<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*href["']/i,
+  },
+  {
+    id: 'svg-animate-xlinkhref',
+    description: '<animate attributeName="xlink:href"',
+    pattern: /<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*xlink\s*:\s*href["']/i,
+  },
+  {
+    id: 'svg-set-javascript',
+    description: '<set to="javascript:..." — sets an attribute to a javascript: URI',
+    pattern: /<set[\s\S]{0,80}to\s*=\s*["']?\s*javascript\s*:/i,
+  },
+  {
+    id: 'svg-event-handler',
+    description: 'SVG-specific event handler attributes: onload=, onerror=, onactivate=, etc.',
+    pattern: /\bon(?:load|error|activate|begin|end|repeat|focus|blur|click|mouse\w{1,20}|key\w{1,20})\s*=/i,
+  },
+  {
+    id: 'svg-handler-generic',
+    description: 'Generic on* handler catch-all for SVG attributes',
+    pattern: /\bon\w{1,30}\s*=/i,
+  },
+  {
+    id: 'svg-filter-feimage',
+    description: '<feImage href= — filter primitive that can load external resources',
+    pattern: /<feImage[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=/i,
+  },
+  {
+    id: 'svg-image-external',
+    description: '<image xlink:href with http/https or javascript protocol',
+    pattern: /<image[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=\s*["']?\s*(?:https?|javascript)\s*:/i,
+  },
+  {
+    id: 'svg-style-javascript',
+    description: 'style= attribute containing javascript: (e.g. background:url(javascript:...))',
+    pattern: /style\s*=[\s\S]{0,60}javascript\s*:/i,
+  },
+];
+
+export default SVG_PATTERNS;

package/node_modules/is-unsafe/src/contexts/xml.js

@@ -0,0 +1,79 @@
+/**
+ * XML context patterns.
+ *
+ * Detects injection vectors that are specifically dangerous when a string
+ * is inserted into an XML document (not HTML rendering context).
+ *
+ * Key distinction from HTML: these patterns target parser-level attacks —
+ * things that can confuse or subvert an XML parser, trigger external entity
+ * resolution, or inject DTD content. HTML rendering concerns (XSS) belong
+ * in the HTML context.
+ */
+
+const XML_PATTERNS = [
+  {
+    id: 'xml-cdata-injection',
+    description: 'CDATA section injection: <![CDATA[ breaks out of text node context',
+    pattern: /<!\[CDATA\[/i,
+  },
+  {
+    id: 'xml-cdata-close',
+    description: 'CDATA close sequence: ]]> can terminate an enclosing CDATA section',
+    pattern: /\]\]>/,
+  },
+  {
+    id: 'xml-processing-instruction',
+    description: 'XML processing instruction: <?xml-stylesheet or <?php etc.',
+    pattern: /<\?(?:xml[\- ]|php|asp)/i,
+  },
+  {
+    id: 'xml-doctype-injection',
+    description: 'DOCTYPE declaration embedded in content — can define entities',
+    // Match <!DOCTYPE followed by end-of-string, whitespace, or [ (internal subset)
+    pattern: /<!DOCTYPE(?:[\s[]|$)/i,
+  },
+  {
+    id: 'xml-entity-system',
+    description: 'SYSTEM keyword — used in external entity declarations (XXE)',
+    pattern: /\bSYSTEM\s+["']/i,
+  },
+  {
+    id: 'xml-entity-public',
+    description: 'PUBLIC keyword — used in external entity declarations (XXE)',
+    pattern: /\bPUBLIC\s+["']/i,
+  },
+  {
+    id: 'xml-entity-declaration',
+    description: '<!ENTITY declaration — defines entities, potential XXE or entity expansion',
+    pattern: /<!ENTITY[\s%]/i,
+  },
+  {
+    id: 'xml-billion-laughs',
+    description: 'Entity reference chaining / billion laughs: repeated &eX; style references',
+    // Heuristic: 3+ consecutive entity refs suggests expansion attack
+    pattern: /(?:&\w{1,20};){3,}/,
+  },
+  {
+    id: 'xml-namespace-confusion',
+    description: 'xmlns: attribute injection — can redefine namespaces to confuse parsers',
+    // pattern: /\bxmlns\s*(?::\w{1,40})?\s*=/i,
+    pattern: /\bxmlns(?::\w{1,40})?\s*=/i,
+  },
+  {
+    id: 'xml-comment-injection',
+    description: '<!-- comment injection — can hide content from some parsers',
+    pattern: /<!--/,
+  },
+  {
+    id: 'xml-comment-close',
+    description: '--> closes an enclosing XML comment',
+    pattern: /-->/,
+  },
+  {
+    id: 'xml-pi-close',
+    description: '?> closes an enclosing processing instruction',
+    pattern: /\?>/,
+  },
+];
+
+export default XML_PATTERNS;

package/node_modules/is-unsafe/src/index.cjs

@@ -0,0 +1,27 @@
+// CommonJS shim — generated from src/index.js
+// For bundlers and Node.js environments that require CJS interop.
+// This file re-exports via dynamic import to bridge ESM → CJS.
+
+let _mod;
+async function _load() {
+  if (!_mod) _mod = await import('./index.js');
+  return _mod;
+}
+
+// Synchronous-style exports via module.exports proxy
+// (Works for environments that await the module, e.g. Jest with transformIgnorePatterns)
+module.exports = new Proxy(
+  {},
+  {
+    get(_, key) {
+      throw new Error(
+        `is-unsafe: CommonJS require() is not fully supported. ` +
+        `Use dynamic import(): const { isUnsafe } = await import('is-unsafe'). ` +
+        `Or set "type": "module" in your package.json.`
+      );
+    },
+  }
+);
+
+// Export the loader for async CJS callers
+module.exports.load = _load;

package/node_modules/is-unsafe/src/index.d.ts

@@ -0,0 +1,95 @@
+/**
+ * is-unsafe v2 — TypeScript declarations
+ *
+ * Each context is a tree-shakeable named export. Import only what you need.
+ */
+
+/** A single detection rule: a pattern plus metadata. */
+export interface Rule {
+  id: string;
+  description: string;
+  pattern: RegExp;
+}
+
+/**
+ * An ordered list of Rules for a given injection context.
+ *
+ * Built-in contexts (HTML, XML, etc.) have `label` pre-set by the library.
+ * Custom lists default to `'CUSTOM'` in MatchResult unless you set `label`:
+ *
+ * ```js
+ * const MY_RULES = [{ id: 'my-rule', description: '...', pattern: /danger/ }];
+ * MY_RULES.label = 'MY_CONTEXT';
+ * whyUnsafe('danger', MY_RULES); // → { context: 'MY_CONTEXT', ... }
+ * ```
+ */
+export type PatternList = Rule[] & { label?: string };
+
+/**
+ * Valid context argument:
+ *   - A single PatternList (e.g. `HTML`)
+ *   - An array of PatternLists (e.g. `[HTML, XML]`) — unsafe if matches ANY
+ *   - A custom RegExp
+ */
+export type ContextArg = PatternList | PatternList[] | RegExp;
+
+/** Describes which rule matched and why. */
+export interface MatchResult {
+  /** Context label ('HTML', 'XML', 'CUSTOM', etc.) */
+  context: string;
+  id: string;
+  description: string;
+  pattern: RegExp;
+}
+
+// ─── Named context exports (tree-shakeable) ────────────────────────────────
+
+export const HTML:       PatternList;
+export const XML:        PatternList;
+export const SVG:        PatternList;
+export const SQL:        PatternList;
+export const SQL_STRICT: PatternList;
+export const SHELL:      PatternList;
+export const REDOS:      PatternList;
+export const NOSQL:      PatternList;
+export const LOG:        PatternList;
+
+// ─── VALID_CONTEXTS (convenience — pulls in all contexts) ──────────────────
+
+export const VALID_CONTEXTS: {
+  readonly HTML:         PatternList;
+  readonly XML:          PatternList;
+  readonly SVG:          PatternList;
+  readonly SQL:          PatternList;
+  readonly 'SQL-STRICT': PatternList;
+  readonly SHELL:        PatternList;
+  readonly REDOS:        PatternList;
+  readonly NOSQL:        PatternList;
+  readonly LOG:          PatternList;
+};
+
+// ─── Core functions ────────────────────────────────────────────────────────
+
+/**
+ * Returns `true` if `value` is unsafe in the given context(s).
+ *
+ * @example
+ * import { isUnsafe, HTML, XML } from 'is-unsafe';
+ * isUnsafe('<script>alert(1)</script>', HTML)   // true
+ * isUnsafe('hello', [HTML, XML])                // false
+ * isUnsafe('hello', /danger/)                   // false
+ */
+export function isUnsafe(value: string, context: ContextArg): boolean;
+
+/**
+ * Returns the first `MatchResult` explaining why `value` is unsafe, or `null` if safe.
+ */
+export function whyUnsafe(value: string, context: ContextArg): MatchResult | null;
+
+/**
+ * Returns all matching rules across the given context(s), or `[]` if safe.
+ */
+export function allUnsafe(value: string, context: ContextArg): MatchResult[];
+
+declare const isUnsafeDefault: typeof isUnsafe;
+export default isUnsafeDefault;

package/node_modules/is-unsafe/src/index.js

@@ -0,0 +1,265 @@
+/**
+ * is-unsafe v2
+ *
+ * Zero-dependency, DOM-free, pure predicate for detecting unsafe strings
+ * across HTML, XML, SVG, SQL, SQL-STRICT, SHELL, REDOS, NOSQL, and LOG contexts.
+ *
+ * v2 change: contexts are imported as named pattern arrays rather than resolved
+ * via a string-keyed registry. This makes each context independently
+ * tree-shakeable — bundlers can drop any context you never import.
+ *
+ * @module is-unsafe
+ */
+
+// ─── Context pattern arrays (named exports) ────────────────────────────────
+// Import only the ones you need. Each is independently tree-shakeable.
+
+export { default as HTML } from './contexts/html.js';
+export { default as XML  } from './contexts/xml.js';
+export { default as SVG  } from './contexts/svg.js';
+export { default as SQL  } from './contexts/sql.js';
+export { default as SHELL   } from './contexts/shell.js';
+export { default as REDOS   } from './contexts/redos.js';
+export { default as NOSQL   } from './contexts/nosql.js';
+export { default as LOG     } from './contexts/log.js';
+
+// SQL-STRICT needs a quoted identifier because of the hyphen
+import SQL_STRICT from './contexts/sql-strict.js';
+export { SQL_STRICT };
+
+// ─── VALID_CONTEXTS convenience re-export ─────────────────────────────────
+// Importing this pulls in ALL contexts. Use it only when you need all of them
+// (e.g. for validation UI, tooling, or exhaustive audits).
+// If you only need a subset, import the named contexts directly instead.
+
+import HTML    from './contexts/html.js';
+import XML     from './contexts/xml.js';
+import SVG     from './contexts/svg.js';
+import SQL     from './contexts/sql.js';
+import SHELL   from './contexts/shell.js';
+import REDOS   from './contexts/redos.js';
+import NOSQL   from './contexts/nosql.js';
+import LOG     from './contexts/log.js';
+
+// ─── Attach labels to named contexts ──────────────────────────────────────
+// Each built-in PatternList carries its canonical name so matchList can read
+// list.label directly — no registry lookup needed at match time.
+// Custom PatternLists default to 'CUSTOM' unless the caller sets list.label.
+
+HTML.label       = 'HTML';
+XML.label        = 'XML';
+SVG.label        = 'SVG';
+SQL.label        = 'SQL';
+SQL_STRICT.label = 'SQL-STRICT';
+SHELL.label      = 'SHELL';
+REDOS.label      = 'REDOS';
+NOSQL.label      = 'NOSQL';
+LOG.label        = 'LOG';
+
+export const VALID_CONTEXTS = Object.freeze({
+  HTML,
+  XML,
+  SVG,
+  SQL,
+  'SQL-STRICT': SQL_STRICT,
+  SHELL,
+  REDOS,
+  NOSQL,
+  LOG,
+});
+
+// ─── Types ────────────────────────────────────────────────────────────────
+
+/**
+ * @typedef {{ id: string, description: string, pattern: RegExp }} Rule
+ */
+
+/**
+ * @typedef {Rule[]} PatternList
+ */
+
+/**
+ * @typedef {Object} MatchResult
+ * @property {string} context     - Label identifying which context matched ('HTML', 'CUSTOM', etc.)
+ * @property {string} id          - Rule identifier
+ * @property {string} description - Human-readable description of what was matched
+ * @property {RegExp} pattern     - The pattern that matched
+ */
+
+// ─── Internal helpers ──────────────────────────────────────────────────────
+
+/**
+ * @param {unknown} value
+ */
+function assertString(value) {
+  if (typeof value !== 'string') {
+    throw new TypeError(
+      `is-unsafe: first argument must be a string, got ${typeof value}`
+    );
+  }
+}
+
+/**
+ * @param {unknown} context
+ */
+function assertContext(context) {
+  if (context instanceof RegExp) return;
+
+  if (Array.isArray(context)) {
+    if (context.length === 0) {
+      throw new TypeError('is-unsafe: context must not be an empty array');
+    }
+    // Detect array-of-arrays vs flat pattern list
+    if (Array.isArray(context[0])) {
+      // Array of PatternLists
+      for (const list of context) {
+        if (!Array.isArray(list) || list.length === 0) {
+          throw new TypeError(
+            'is-unsafe: each context in the array must be a non-empty pattern array (PatternList)'
+          );
+        }
+      }
+    }
+    // else: flat PatternList — trust it, no deep validation needed
+    return;
+  }
+
+  throw new TypeError(
+    `is-unsafe: second argument must be a PatternList (e.g. HTML), ` +
+    `an array of PatternLists (e.g. [HTML, XML]), or a RegExp. Got: ${typeof context}`
+  );
+}
+
+/**
+ * Normalise any valid context arg into an array of PatternLists.
+ *
+ * @param {Rule[]|Rule[][]|RegExp} context
+ * @returns {{ lists: Rule[][]|null, regex: RegExp|null }}
+ */
+function normalise(context) {
+  if (context instanceof RegExp) return { lists: null, regex: context };
+  // Distinguish PatternList (array of rule objects) from array of PatternLists
+  if (Array.isArray(context[0])) return { lists: context, regex: null };
+  return { lists: [context], regex: null };
+}
+
+/**
+ * Test value against a single PatternList. Returns the first MatchResult or null.
+ *
+ * @param {string} value
+ * @param {Rule[]} list
+ * @returns {MatchResult|null}
+ */
+function matchList(value, list) {
+  const label = list.label ?? 'CUSTOM';
+  for (const rule of list) {
+    if (rule.pattern.test(value)) {
+      return { context: label, id: rule.id, description: rule.description, pattern: rule.pattern };
+    }
+  }
+  return null;
+}
+
+// ─── Public API ───────────────────────────────────────────────────────────
+
+/**
+ * Returns `true` if `value` is unsafe in the given context(s), `false` otherwise.
+ *
+ * @param {string} value - The string to test
+ * @param {PatternList | PatternList[] | RegExp} context
+ *   - A PatternList imported from is-unsafe (e.g. `HTML`, `XML`)
+ *   - An array of PatternLists — returns true if unsafe in **any** of them
+ *   - A custom RegExp — returns true if the pattern matches
+ * @returns {boolean}
+ *
+ * @example
+ * import { isUnsafe, HTML, SQL } from 'is-unsafe';
+ *
+ * isUnsafe('<script>alert(1)</script>', HTML)       // true
+ * isUnsafe('hello world', HTML)                     // false
+ * isUnsafe('value', [HTML, SQL])                    // false
+ * isUnsafe('value', /my-pattern/i)                  // false
+ */
+function isUnsafe(value, context) {
+  assertString(value);
+  assertContext(context);
+
+  const { lists, regex } = normalise(context);
+
+  if (regex) return regex.test(value);
+
+  for (const list of lists) {
+    if (matchList(value, list) !== null) return true;
+  }
+  return false;
+}
+
+/**
+ * Like `isUnsafe`, but returns the first `MatchResult` describing **why**
+ * the value was flagged, or `null` if it is safe.
+ *
+ * @param {string} value
+ * @param {PatternList | PatternList[] | RegExp} context
+ * @returns {MatchResult|null}
+ *
+ * @example
+ * import { whyUnsafe, HTML } from 'is-unsafe';
+ *
+ * whyUnsafe('<script>alert(1)</script>', HTML)
+ * // { context: 'HTML', id: 'html-script-open', description: '...', pattern: /.../ }
+ */
+function whyUnsafe(value, context) {
+  assertString(value);
+  assertContext(context);
+
+  const { lists, regex } = normalise(context);
+
+  if (regex) {
+    return regex.test(value)
+      ? { context: 'CUSTOM', id: 'custom-regex', description: 'Matched caller-supplied pattern', pattern: regex }
+      : null;
+  }
+
+  for (const list of lists) {
+    const result = matchList(value, list);
+    if (result !== null) return result;
+  }
+  return null;
+}
+
+/**
+ * Returns **all** matching rules across the given context(s), or an empty
+ * array if the value is safe. Useful for comprehensive auditing.
+ *
+ * @param {string} value
+ * @param {PatternList | PatternList[] | RegExp} context
+ * @returns {MatchResult[]}
+ */
+function allUnsafe(value, context) {
+  assertString(value);
+  assertContext(context);
+
+  const { lists, regex } = normalise(context);
+  const results = [];
+
+  if (regex) {
+    if (regex.test(value)) {
+      results.push({ context: 'CUSTOM', id: 'custom-regex', description: 'Matched caller-supplied pattern', pattern: regex });
+    }
+    return results;
+  }
+
+  for (const list of lists) {
+    const label = list.label ?? 'CUSTOM';
+    for (const rule of list) {
+      if (rule.pattern.test(value)) {
+        results.push({ context: label, id: rule.id, description: rule.description, pattern: rule.pattern });
+      }
+    }
+  }
+
+  return results;
+}
+
+export { isUnsafe, whyUnsafe, allUnsafe };
+export default isUnsafe;