swagger-typescript-api 13.12.1 → 13.12.2

package/dist/{src-Cs9lMkwK.cjs → src-VxYc58-l.cjs}

@@ -54,6 +54,10 @@ let _apidevtools_swagger_parser = require("@apidevtools/swagger-parser");
 _apidevtools_swagger_parser = __toESM(_apidevtools_swagger_parser, 1);
 let yaml = require("yaml");
 yaml = __toESM(yaml, 1);
+let node_dns_promises = require("node:dns/promises");
+node_dns_promises = __toESM(node_dns_promises, 1);
+let node_net = require("node:net");
+node_net = __toESM(node_net, 1);
 let node_module = require("node:module");
 node_module = __toESM(node_module, 1);
 let node_url = require("node:url");
@@ -208,7 +212,7 @@ var ComponentTypeNameResolver = class extends NameResolver {
 //#endregion
 //#region package.json
 var name = "swagger-typescript-api";
-var version = "13.12.1";
+var version = "13.12.2";
 var description = "Generate the API client for Fetch or Axios from an OpenAPI Specification";
 //#endregion
 //#region src/constants.ts
@@ -276,6 +280,12 @@ const SCHEMA_TYPES$1 = {
 	COMPLEX_UNKNOWN: "__unknown"
 };
 //#endregion
+//#region src/util/escape-js-string-literal.ts
+/** Escapes a value for insertion into a double-quoted JS/TS string literal (without surrounding quotes). */
+function escapeJsStringLiteral(value) {
+	return JSON.stringify(value).slice(1, -1);
+}
+//#endregion
 //#region src/util/object-assign.ts
 const objectAssign = (target, updater) => {
 	if (!updater) return;
@@ -501,7 +511,7 @@ var CodeGenConfig = class {
 		/**
 		* "$A"
 		*/
-		StringValue: (content) => `"${content}"`,
+		StringValue: (content) => `"${escapeJsStringLiteral(String(content))}"`,
 		/**
 		* $A
 		*/
@@ -1881,6 +1891,15 @@ var SchemaParserFabric = class {
 	};
 };
 //#endregion
+//#region src/util/escape-js-template-literal-with-path-params.ts
+/**
+* Escapes `\`, backticks, and `${` for insertion into a JS template literal
+* (without surrounding backticks).
+*/
+function escapeJsTemplateLiteralStatic(value) {
+	return value.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
+}
+//#endregion
 //#region src/util/id.ts
 const generateId = () => node_crypto.randomUUID();
 //#endregion
@@ -2003,10 +2022,11 @@ var SchemaRoutes = class {
 				in: "path"
 			});
 		}
+		const escapedRouteName = escapeJsTemplateLiteralStatic(routeName || "");
 		let fixedRoute = pathParams.reduce((fixedRoute, pathParam, i, arr) => {
 			const insertion = this.config.hooks.onInsertPathParam(pathParam.name, i, arr, fixedRoute) || pathParam.name;
 			return fixedRoute.replace(pathParam.$match, `\${${insertion}}`);
-		}, routeName || "");
+		}, escapedRouteName);
 		const queryParamMatches = fixedRoute.match(/(\{\?.*\})/g);
 		const queryParams = [];
 		if (queryParamMatches?.length) {
@@ -2712,6 +2732,118 @@ function parseSchemaContent(content) {
 	}
 }
 //#endregion
+//#region src/util/remote-schema-fetch.ts
+const MAX_REDIRECTS = 5;
+function isPrivateIpv4(ip) {
+	const match = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (!match) return false;
+	const octets = match.slice(1).map(Number);
+	if (octets.some((octet) => octet > 255)) return false;
+	const [a, b] = octets;
+	return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function isPrivateIpv6(ip) {
+	const normalized = ip.toLowerCase();
+	if (normalized === "::" || normalized === "::1") return true;
+	if (normalized.startsWith("fe80:")) return true;
+	const firstHextet = normalized.split(":")[0] ?? "";
+	if (firstHextet >= "fc00" && firstHextet <= "fdff") return true;
+	const ipv4Mapped = normalized.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+	if (ipv4Mapped?.[1]) return isPrivateIpv4(ipv4Mapped[1]);
+	const ipv4MappedHex = normalized.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+	if (ipv4MappedHex?.[1] && ipv4MappedHex?.[2]) {
+		const h1 = parseInt(ipv4MappedHex[1], 16);
+		const h2 = parseInt(ipv4MappedHex[2], 16);
+		return isPrivateIpv4(`${h1 >> 8 & 255}.${h1 & 255}.${h2 >> 8 & 255}.${h2 & 255}`);
+	}
+	return false;
+}
+function isPrivateIp(ip) {
+	const family = node_net.isIP(ip);
+	if (family === 4) return isPrivateIpv4(ip);
+	if (family === 6) return isPrivateIpv6(ip);
+	return false;
+}
+function isBlockedHostname(hostname) {
+	const normalized = hostname.toLowerCase();
+	return normalized === "localhost" || normalized.endsWith(".localhost");
+}
+async function resolveHostnameAddresses(hostname) {
+	try {
+		return (await node_dns_promises.lookup(hostname, {
+			all: true,
+			verbatim: true
+		})).map((record) => record.address);
+	} catch {
+		return [];
+	}
+}
+async function isPublicRemoteHost(urlString) {
+	let parsed;
+	try {
+		parsed = new URL(urlString);
+	} catch {
+		return false;
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+	const hostname = parsed.hostname.startsWith("[") && parsed.hostname.endsWith("]") ? parsed.hostname.slice(1, -1) : parsed.hostname;
+	if (isBlockedHostname(hostname)) return false;
+	if (node_net.isIP(hostname)) return !isPrivateIp(hostname);
+	const addresses = await resolveHostnameAddresses(hostname);
+	if (addresses.length === 0) return false;
+	return addresses.every((address) => !isPrivateIp(address));
+}
+function isSameHttpOrigin(a, b) {
+	if (typeof b !== "string") return false;
+	try {
+		const urlA = new URL(a);
+		const urlB = new URL(b);
+		return urlA.protocol === urlB.protocol && urlA.host === urlB.host;
+	} catch {
+		return false;
+	}
+}
+async function isRemoteSchemaFetchAllowed(urlString, policy) {
+	const { specSourceUrl, allowExplicitSpecUrl = false } = policy;
+	if (allowExplicitSpecUrl && typeof specSourceUrl === "string" && stripUrlHash(urlString) === stripUrlHash(specSourceUrl)) return true;
+	if (typeof specSourceUrl === "string" && isSameHttpOrigin(urlString, specSourceUrl)) return true;
+	return isPublicRemoteHost(urlString);
+}
+function stripUrlHash(urlString) {
+	return urlString.split("#")[0] || urlString;
+}
+function resolveRedirectUrl(location, baseUrl) {
+	try {
+		return new URL(location, baseUrl).toString();
+	} catch {
+		return null;
+	}
+}
+async function fetchRemoteSchemaResponse(urlString, init, policy) {
+	let currentUrl = urlString;
+	let redirectCount = 0;
+	while (true) {
+		if (!await isRemoteSchemaFetchAllowed(currentUrl, {
+			specSourceUrl: policy.specSourceUrl,
+			allowExplicitSpecUrl: policy.allowExplicitSpecUrl && redirectCount === 0
+		})) return null;
+		const response = await fetch(currentUrl, {
+			...init,
+			redirect: "manual"
+		});
+		if (response.status >= 300 && response.status < 400) {
+			const location = response.headers.get("location");
+			if (!location || redirectCount >= MAX_REDIRECTS) return null;
+			const redirectUrl = resolveRedirectUrl(location, currentUrl);
+			if (!redirectUrl) return null;
+			currentUrl = redirectUrl;
+			redirectCount += 1;
+			continue;
+		}
+		return response;
+	}
+}
+//#endregion
 //#region src/resolved-swagger-schema.ts
 var ResolvedSwaggerSchema = class ResolvedSwaggerSchema {
 	config;
@@ -2754,8 +2886,13 @@ var ResolvedSwaggerSchema = class ResolvedSwaggerSchema {
 	isHttpUrl(value) {
 		return /^https?:\/\//i.test(value);
 	}
-	getRemoteRequestHeaders() {
-		return Object.assign({}, this.config.authorizationToken ? { Authorization: this.config.authorizationToken } : {}, this.config.requestOptions?.headers || {});
+	isExplicitSpecUrl(url) {
+		return typeof this.config.url === "string" && this.stripHash(url) === this.stripHash(this.config.url);
+	}
+	getRemoteRequestHeaders(targetUrl) {
+		const headers = {};
+		if (this.config.authorizationToken && targetUrl && typeof this.config.url === "string" && isSameHttpOrigin(targetUrl, this.config.url)) headers.Authorization = this.config.authorizationToken;
+		return Object.assign(headers, this.config.requestOptions?.headers || {});
 	}
 	stripHash(urlOrPath) {
 		return urlOrPath.split("#")[0] || urlOrPath;
@@ -2900,8 +3037,11 @@ var ResolvedSwaggerSchema = class ResolvedSwaggerSchema {
 	}
 	async fetchRemoteSchemaDocument(url) {
 		try {
-			const response = await fetch(url, { headers: this.getRemoteRequestHeaders() });
-			if (!response.ok) return null;
+			const response = await fetchRemoteSchemaResponse(url, { headers: this.getRemoteRequestHeaders(url) }, {
+				specSourceUrl: typeof this.config.url === "string" ? this.config.url : void 0,
+				allowExplicitSpecUrl: this.isExplicitSpecUrl(url)
+			});
+			if (!response?.ok) return null;
 			const content = await response.text();
 			try {
 				const parsed = parseSchemaContent(content);
@@ -2932,7 +3072,7 @@ var ResolvedSwaggerSchema = class ResolvedSwaggerSchema {
 				const [externalPath = ""] = normalizedRef.split("#");
 				if (!externalPath) continue;
 				const absoluteUrl = this.resolveAbsoluteUrl(externalPath, currentUrl);
-				if (absoluteUrl && !visited.has(absoluteUrl)) queue.push(absoluteUrl);
+				if (absoluteUrl && !visited.has(absoluteUrl) && await isRemoteSchemaFetchAllowed(absoluteUrl, { specSourceUrl: this.config.url })) queue.push(absoluteUrl);
 			}
 		}
 	}
@@ -3152,7 +3292,7 @@ var ResolvedSwaggerSchema = class ResolvedSwaggerSchema {
 				external: true,
 				http: {
 					...config.requestOptions,
-					headers: Object.assign({}, config.authorizationToken ? { Authorization: config.authorizationToken } : {}, config.requestOptions?.headers ?? {})
+					headers: config.requestOptions?.headers ?? {}
 				}
 			}
 		};
@@ -3941,7 +4081,7 @@ var CodeGenProcess = class {
 				description: ""
 			}, externalDocs || {}),
 			tags: (0, es_toolkit.compact)(tags || []),
-			baseUrl: serverUrl,
+			baseUrl: escapeJsStringLiteral(serverUrl ?? ""),
 			title,
 			version
 		};
@@ -4183,4 +4323,4 @@ Object.defineProperty(exports, "version", {
 	}
 });
 
-//# sourceMappingURL=src-Cs9lMkwK.cjs.map
+//# sourceMappingURL=src-VxYc58-l.cjs.map