timonel 3.0.0-beta.1 → 3.0.0

package/dist/lib/utils/helmYamlSerializer.js

@@ -1,4 +1,5 @@
 import { Document, Scalar, isMap, isScalar, visit, Pair } from 'yaml';
+import { SecurityUtils } from '../security.js';
 import { isHelmConstruct, isHelmExpression, createHelmExpression, } from './helmControlStructures.js';
 import { isHelmValue, isHelmFieldConditional, isHelmRange, isHelmWith, } from './valuesRef.js';
 const FIELD_CONDITIONAL = '__FIELD_CONDITIONAL__:';
@@ -542,7 +543,8 @@ export function dumpHelmAwareYaml(obj, options = {}) {
         const contentLines = content.split('\n');
         const firstContentLine = contentLines[0]?.trim() || '';
         if (firstContentLine.startsWith(`${fieldKey}:`)) {
-            contentLines[0] = contentLines[0].replace(new RegExp(`^\\s*${fieldKey}:\\s*`), '');
+            const escapedFieldKey = fieldKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            contentLines[0] = contentLines[0].replace(new RegExp(`^\\s*${escapedFieldKey}:\\s*`), '');
             content = contentLines.join('\n');
         }
         const contentFormatted = content
@@ -640,7 +642,7 @@ export function postProcessFieldConditionals(yaml) {
             .join('\n');
         result = result.substring(0, secondLastNewline + 1) + processed + result.substring(markerEnd);
     }
-    result = result.replace(/:\s*\|[-+]?\s*\n(\s*\{\{)/g, ':\n$1');
+    result = result.replace(/:\s*\|[-+]?\s*\n([ \t]*\{\{)/g, ':\n$1');
     result = result.replace(/"(\{\{[\s\S]*?\}\})"/g, '$1');
     return result;
 }
@@ -718,13 +720,14 @@ export function parseHelmExpressions(content) {
             let match;
             regex.lastIndex = 0;
             while ((match = regex.exec(line)) !== null) {
+                const sanitizedExpression = SecurityUtils.sanitizeLogMessage(match[0] || '');
                 expressions.push({
                     type,
-                    expression: match[0],
+                    expression: sanitizedExpression,
                     startLine: i + 1,
                     startCol: match.index + 1,
                     endLine: i + 1,
-                    endCol: match.index + match[0].length + 1,
+                    endCol: match.index + (match[0]?.length || 0) + 1,
                 });
                 if (match.index === regex.lastIndex)
                     regex.lastIndex++;
@@ -780,14 +783,19 @@ function validateFunctionCalls(_content) {
 function checkCommonIssues(yaml, warnings) {
     const deprecatedFunctions = ['template'];
     for (const func of deprecatedFunctions) {
-        const pattern = new RegExp(`\\{\\{[^}]*\\b${func}\\b[^}]*\\}\\}`, 'g');
+        if (!/^[a-zA-Z0-9_]+$/.test(func)) {
+            continue;
+        }
+        const escapedFunc = func.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const pattern = new RegExp(`\\{\\{[^}]*\\b${escapedFunc}\\b[^}]*\\}\\}`, 'g');
         let match;
         while ((match = pattern.exec(yaml)) !== null) {
+            const sanitizedFunc = SecurityUtils.sanitizeLogMessage(func);
             warnings.push({
                 type: 'semantic',
-                message: `Function '${func}' is deprecated`,
+                message: `Function '${sanitizedFunc}' is deprecated`,
                 expression: match[0],
-                suggestion: `Consider avoiding deprecated function '${func}'`,
+                suggestion: `Consider avoiding deprecated function '${sanitizedFunc}'`,
             });
         }
     }
@@ -798,11 +806,13 @@ function checkQuotedExpressions(yaml, warnings) {
         let match;
         pattern.lastIndex = 0;
         while ((match = pattern.exec(yaml)) !== null) {
+            const sanitizedMatch = SecurityUtils.sanitizeLogMessage(match[1] || '');
+            const sanitizedExpression = SecurityUtils.sanitizeLogMessage(match[0] || '');
             warnings.push({
                 type: 'semantic',
                 message: 'Helm expression should not be quoted',
-                expression: match[0],
-                suggestion: `Remove quotes around: ${match[1]}`,
+                expression: sanitizedExpression,
+                suggestion: `Remove quotes around: ${sanitizedMatch}`,
             });
         }
     }

package/dist/lib/utils/logger.js

@@ -180,19 +180,24 @@ export class TimonelLogger {
         }
     }
     requestSerializer(req) {
-        if (!req || typeof req !== 'object')
+        try {
+            if (!req || typeof req !== 'object')
+                return {};
+            const request = req;
+            return {
+                method: request.method,
+                url: SecurityUtils.sanitizeLogMessage(request.url || ''),
+                headers: {
+                    'user-agent': request.headers?.['user-agent'],
+                    'content-type': request.headers?.['content-type'],
+                },
+                remoteAddress: request.remoteAddress,
+                remotePort: request.remotePort,
+            };
+        }
+        catch {
             return {};
-        const request = req;
-        return {
-            method: request.method,
-            url: SecurityUtils.sanitizeLogMessage(request.url || ''),
-            headers: {
-                'user-agent': request.headers?.['user-agent'],
-                'content-type': request.headers?.['content-type'],
-            },
-            remoteAddress: request.remoteAddress,
-            remotePort: request.remotePort,
-        };
+        }
     }
     responseSerializer(res) {
         if (!res || typeof res !== 'object')
@@ -256,40 +261,50 @@ export class TimonelLogger {
         }
     }
     sanitizeContext(context) {
-        const sanitized = {};
-        for (const [key, value] of Object.entries(context)) {
-            if (TimonelLogger.SENSITIVE_FIELDS.has(key.toLowerCase())) {
-                sanitized[key] = '[REDACTED]';
-            }
-            else if (typeof value === 'string') {
-                sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
-            }
-            else if (value && typeof value === 'object') {
-                sanitized[key] = this.sanitizeNestedObject(value, 2);
-            }
-            else {
-                sanitized[key] = value;
+        try {
+            const sanitized = {};
+            for (const [key, value] of Object.entries(context)) {
+                if (TimonelLogger.SENSITIVE_FIELDS.has(key.toLowerCase())) {
+                    sanitized[key] = '[REDACTED]';
+                }
+                else if (typeof value === 'string') {
+                    sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+                }
+                else if (value && typeof value === 'object') {
+                    sanitized[key] = this.sanitizeNestedObject(value, 2);
+                }
+                else {
+                    sanitized[key] = value;
+                }
             }
+            return sanitized;
+        }
+        catch {
+            return {};
         }
-        return sanitized;
     }
     sanitizeNestedObject(obj, depth) {
-        if (depth <= 0 || !obj || typeof obj !== 'object') {
-            return obj;
-        }
-        const sanitized = {};
-        for (const [key, value] of Object.entries(obj)) {
-            if (typeof value === 'string') {
-                sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+        try {
+            if (depth <= 0 || !obj || typeof obj !== 'object') {
+                return obj;
             }
-            else if (value && typeof value === 'object') {
-                sanitized[key] = this.sanitizeNestedObject(value, depth - 1);
-            }
-            else {
-                sanitized[key] = value;
+            const sanitized = {};
+            for (const [key, value] of Object.entries(obj)) {
+                if (typeof value === 'string') {
+                    sanitized[key] = SecurityUtils.sanitizeLogMessage(value);
+                }
+                else if (value && typeof value === 'object') {
+                    sanitized[key] = this.sanitizeNestedObject(value, depth - 1);
+                }
+                else {
+                    sanitized[key] = value;
+                }
             }
+            return sanitized;
+        }
+        catch {
+            return obj;
         }
-        return sanitized;
     }
     child(context) {
         const sanitizedContext = this.sanitizeContext(context);

package/dist/lib/utils/valuesRef.js

@@ -10,6 +10,9 @@ function serializeValue(value) {
     return String(value);
 }
 function createCondition(condition) {
+    if (!condition || typeof condition !== 'string') {
+        throw new Error('Condition must be a non-empty string');
+    }
     return {
         [HELM_VALUE_SYMBOL]: true,
         __condition: condition,
@@ -17,9 +20,15 @@ function createCondition(condition) {
             return createCondition(`not (${this.__condition})`);
         },
         and(other) {
+            if (!other || typeof other.__condition !== 'string') {
+                throw new Error('Invalid HelmCondition provided to and()');
+            }
             return createCondition(`and (${this.__condition}) (${other.__condition})`);
         },
         or(other) {
+            if (!other || typeof other.__condition !== 'string') {
+                throw new Error('Invalid HelmCondition provided to or()');
+            }
             return createCondition(`or (${this.__condition}) (${other.__condition})`);
         },
         toString() {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "timonel",
   "type": "module",
-  "version": "3.0.0-beta.1",
+  "version": "3.0.0",
   "description": "Timonel: programmatic Helm chart generator using cdk8s (TypeScript)",
   "bin": {
     "timonel": "dist/cli.js",