wsemi 1.9.21 → 1.9.23

package/test/getFileType.test.mjs

@@ -1,29 +1,200 @@
-import assert from 'assert'
-import getFileType from '../src/getFileType.mjs'
-
-
-describe(`getFileType`, function() {
-
-    let o1 = {
-        name: 'html',
-        group: 'docums',
-        acp: 'text/html',
-        exec: 'browser',
-    }
-    it(`should return ${JSON.stringify(o1)} when 'html'`, function() {
-        let r = getFileType('html')
-        assert.strict.deepStrictEqual(r, o1)
-    })
-
-    let o2 = {
-        name: 'zip',
-        group: 'compress',
-        acp: 'application/zip',
-        exec: 'compressor'
-    }
-    it(`should return ${JSON.stringify(o2)} when 'zip'`, function() {
-        let r = getFileType('zip')
-        assert.strict.deepStrictEqual(r, o2)
-    })
-
-})
+import assert from 'assert'
+import getFileType from '../src/getFileType.mjs'
+import base, { applyChanges } from './tools/getFileTypeBase.mjs'
+
+
+//既有項目期望值: 修前基準表 + 規則 5 唯一允許之差異(heic 之 acp)
+let existing = applyChanges(base)
+
+
+describe(`getFileType`, function() {
+
+    let o1 = {
+        name: 'html',
+        group: 'docums',
+        acp: 'text/html',
+        exec: 'browser',
+    }
+    it(`should return ${JSON.stringify(o1)} when 'html'`, function() {
+        let r = getFileType('html')
+        assert.strict.deepStrictEqual(r, o1)
+    })
+
+    let o2 = {
+        name: 'zip',
+        group: 'compress',
+        acp: 'application/zip',
+        exec: 'compressor'
+    }
+    it(`should return ${JSON.stringify(o2)} when 'zip'`, function() {
+        let r = getFileType('zip')
+        assert.strict.deepStrictEqual(r, o2)
+    })
+
+})
+
+
+//R-FILETYPE-01: 新增項目(附於表尾)之預期列, acp 依 IANA 登錄(gpx 無登錄取通行值), group/exec 比照同類既有項目
+let newRows = [
+    { name: 'jpeg', group: 'image', acp: 'image/jpeg', exec: 'imageviwer' },
+    { name: 'jpe', group: 'image', acp: 'image/jpeg', exec: 'imageviwer' },
+    { name: 'jfif', group: 'image', acp: 'image/jpeg', exec: 'imageviwer' },
+    { name: 'tiff', group: 'image', acp: 'image/tiff', exec: 'imageviwer' },
+    { name: 'svg', group: 'image', acp: 'image/svg+xml', exec: 'imageviwer' },
+    { name: 'heif', group: 'image', acp: 'image/heif', exec: 'imageviwer' },
+    { name: 'md', group: 'data', acp: 'text/markdown', exec: 'textviwer' },
+    { name: 'markdown', group: 'data', acp: 'text/markdown', exec: 'textviwer' },
+    { name: 'yaml', group: 'data', acp: 'application/yaml', exec: 'textviwer' },
+    { name: 'yml', group: 'data', acp: 'application/yaml', exec: 'textviwer' },
+    { name: 'log', group: 'data', acp: 'text/plain', exec: 'textviwer' },
+    { name: 'ini', group: 'data', acp: 'text/plain', exec: 'textviwer' },
+    { name: 'tsv', group: 'data', acp: 'text/tab-separated-values', exec: 'excel' },
+    { name: 'kml', group: 'data', acp: 'application/vnd.google-earth.kml+xml', exec: 'textviwer' },
+    { name: 'kmz', group: '', acp: 'application/vnd.google-earth.kmz', exec: '' },
+    { name: 'gpx', group: 'data', acp: 'application/gpx+xml', exec: 'textviwer', msg: 'gpx無IANA登錄，application/gpx+xml為通行用法' },
+    { name: 'dxf', group: 'image', acp: 'image/vnd.dxf', exec: 'imageviwer' },
+    { name: 'las', group: '', acp: 'application/vnd.las', exec: '', msg: 'las亦為井測資料(Log ASCII Standard)副檔名，此處依光達點雲(LASer)' },
+    { name: 'laz', group: '', acp: 'application/vnd.laszip', exec: '' },
+    { name: 'obj', group: '', acp: 'model/obj', exec: '', msg: 'obj亦為編譯目的檔副檔名，此處依3D模型(Wavefront OBJ)' },
+    { name: 'gltf', group: '', acp: 'model/gltf+json', exec: '' },
+]
+
+
+describe(`getFileType 既有項目回傳不變(R-FILETYPE-01)`, function() {
+
+    it(`修前基準表為 174 列`, function() {
+        assert.strict.deepStrictEqual(base.length, 174)
+    })
+
+    it(`全表前 ${base.length} 列與修前逐列相同(順序與內容), 唯一相異列為 heic`, function() {
+        let rs = getFileType().slice(0, base.length)
+        assert.strict.deepStrictEqual(rs, existing)
+        let diff = base.filter((r, i) => JSON.stringify(r) !== JSON.stringify(rs[i])).map((r) => r.name)
+        assert.strict.deepStrictEqual(diff, ['heic'])
+    })
+
+    it(`修前每個鍵以原名查詢, 仍回該列(heic 之 acp 除外)`, function() {
+        for (let row of existing) {
+            assert.strict.deepStrictEqual(getFileType(row.name), row, row.name)
+        }
+    })
+
+    it(`heic 之 acp 為 image/heic(IANA 與 File.type 實際回報), heif 為 image/heif`, function() {
+        assert.strict.deepStrictEqual(getFileType('heic'), { name: 'heic', group: 'image', acp: 'image/heic', exec: 'imageviwer' })
+        assert.strict.deepStrictEqual(getFileType('HEIC').acp, 'image/heic')
+        assert.strict.deepStrictEqual(getFileType('heif'), { name: 'heif', group: 'image', acp: 'image/heif', exec: 'imageviwer' })
+        assert.strict.deepStrictEqual(getFileType('Heif').acp, 'image/heif')
+    })
+
+    it(`修前未收錄且不在新增項目內者仍回 null`, function() {
+        for (let k of ['nonexist', 'jpgg', 'jp', 'xlsm', 'wmv', '.jpg', ' jpg', 'jpg ', 'j p g', '__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+            assert.strict.deepStrictEqual(getFileType(k), null, k)
+        }
+    })
+
+    it(`無參數與空字串回全表(同一份)`, function() {
+        let rs = getFileType()
+        assert.strict.deepStrictEqual(Array.isArray(rs), true)
+        assert.strict.deepStrictEqual(rs.length, base.length + newRows.length)
+        assert.strict.strictEqual(getFileType(''), rs)
+    })
+
+})
+
+
+describe(`getFileType 新增項目(R-FILETYPE-01)`, function() {
+
+    for (let row of newRows) {
+        it(`should return ${row.acp} when '${row.name}'`, function() {
+            let r = getFileType(row.name)
+            assert.strict.deepStrictEqual(r, row)
+        })
+    }
+
+    it(`表尾恰為預期之 ${newRows.length} 項且順序相同(附於既有項目之後; 順序決定 getFileAccept 分組與 accept 字串之成員順序)`, function() {
+        let rs = getFileType()
+        assert.strict.deepStrictEqual(rs.slice(base.length), newRows)
+    })
+
+    it(`group 與 exec 只使用修前表已有之值`, function() {
+        let groups = new Set(base.map((v) => v.group))
+        let execs = new Set(base.map((v) => v.exec))
+        for (let row of getFileType()) {
+            assert.strict.deepStrictEqual(groups.has(row.group), true, `${row.name} group=${row.group}`)
+            assert.strict.deepStrictEqual(execs.has(row.exec), true, `${row.name} exec=${row.exec}`)
+        }
+    })
+
+    it(`group 為 image 者 acp 皆以 image/ 開頭`, function() {
+        for (let row of getFileType()) {
+            if (row.group === 'image') {
+                assert.strict.deepStrictEqual(row.acp.startsWith('image/'), true, row.name)
+            }
+        }
+    })
+
+    it(`鍵一律小寫(唯一例外 Z), 且小寫後無重複`, function() {
+        let names = getFileType().map((v) => v.name)
+        assert.strict.deepStrictEqual(names.filter((n) => n !== n.toLowerCase()), ['Z'])
+        assert.strict.deepStrictEqual(new Set(names.map((n) => n.toLowerCase())).size, names.length)
+    })
+
+    it(`鍵不得為 __proto__(getFileAccept 以 r[k] = [] 建分組, 會設定原型而非自有鍵)`, function() {
+        let names = getFileType().map((v) => v.name)
+        assert.strict.deepStrictEqual(names.filter((n) => n === '__proto__'), [])
+    })
+
+})
+
+
+describe(`getFileType 不分大小寫(R-FILETYPE-01)`, function() {
+
+    let oZ = {
+        name: 'Z',
+        group: 'compress',
+        acp: 'application/x-compress',
+        exec: 'compressor'
+    }
+    it(`should return ${JSON.stringify(oZ)} when 'z' and 'Z'`, function() {
+        assert.strict.deepStrictEqual(getFileType('z'), oZ)
+        assert.strict.deepStrictEqual(getFileType('Z'), oZ)
+    })
+
+    it(`全表: 每個鍵之全大寫, 全小寫, 首字母大寫變體皆回同一列`, function() {
+        for (let row of getFileType()) {
+            let n = row.name
+            let cap = n.charAt(0).toUpperCase() + n.slice(1).toLowerCase()
+            for (let v of [n.toUpperCase(), n.toLowerCase(), cap]) {
+                assert.strict.strictEqual(getFileType(v), row, `${n} <- ${v}`)
+            }
+        }
+    })
+
+    it(`混合大小寫`, function() {
+        assert.strict.deepStrictEqual(getFileType('JPG').acp, 'image/jpeg')
+        assert.strict.deepStrictEqual(getFileType('jPeG').acp, 'image/jpeg')
+        assert.strict.deepStrictEqual(getFileType('SVG').acp, 'image/svg+xml')
+        assert.strict.deepStrictEqual(getFileType('Mp3').acp, 'audio/mpeg')
+        assert.strict.deepStrictEqual(getFileType('PdF').acp, 'application/pdf')
+        assert.strict.deepStrictEqual(getFileType('HTML').acp, 'text/html')
+        assert.strict.deepStrictEqual(getFileType('Docx').exec, 'word')
+    })
+
+    it(`包裝字串物件(new String)同原始字串`, function() {
+        assert.strict.strictEqual(getFileType(new String('html')), getFileType('html')) // eslint-disable-line no-new-wrappers
+        assert.strict.strictEqual(getFileType(new String('JPG')), getFileType('jpg')) // eslint-disable-line no-new-wrappers
+        assert.strict.deepStrictEqual(getFileType(new String('nonexist')), null) // eslint-disable-line no-new-wrappers
+    })
+
+    it(`回傳列之 name 保持表內原樣`, function() {
+        assert.strict.deepStrictEqual(getFileType('SVG').name, 'svg')
+        assert.strict.deepStrictEqual(getFileType('z').name, 'Z')
+    })
+
+    it(`大小寫變體不影響未命中判定`, function() {
+        for (let k of ['NONEXIST', 'JPGG', '.JPG', ' JPG', 'JPG ', 'Constructor', '__PROTO__']) {
+            assert.strict.deepStrictEqual(getFileType(k), null, k)
+        }
+    })
+
+})

package/test/getltdtkeys.test.mjs

@@ -2,6 +2,77 @@ import assert from 'assert'
 import getltdtkeys from '../src/getltdtkeys.mjs'
 
 
+describe(`getltdtkeys 列物件只依自有鍵(R-OBJ-ITER-01 候選11)`, function() {
+
+    it(`should return the own keys of a row that fakes Arguments with a non-writable Symbol.toStringTag`, function() {
+        //lodash keys 對不可寫偽稱 Arguments 之物件走 baseTimes(length), 修前得 ['0','1','a']
+        let row = Object.defineProperty({ a: 1, length: 2 }, Symbol.toStringTag, { value: 'Arguments' })
+        assert.strict.deepStrictEqual(getltdtkeys([row]), ['a', 'length'])
+        assert.strict.deepStrictEqual(getltdtkeys([{ x: 1 }, row, { y: 2 }]), ['x', 'a', 'length', 'y'])
+    })
+
+    it(`should return the own keys of a row that fakes Array or Arguments with a writable tag`, function() {
+        assert.strict.deepStrictEqual(getltdtkeys([{ a: 1, length: 2, [Symbol.toStringTag]: 'Arguments' }]), ['a', 'length'])
+        assert.strict.deepStrictEqual(getltdtkeys([{ a: 1, length: 2, [Symbol.toStringTag]: 'Array' }]), ['a', 'length'])
+    })
+
+    it(`should treat length as an ordinary key of a row (any non-negative integer, small values)`, function() {
+        assert.strict.deepStrictEqual(getltdtkeys([{ length: 2, a: 'x' }]), ['length', 'a'])
+        assert.strict.deepStrictEqual(getltdtkeys([{ length: 0, a: 'x' }, { length: 1000, b: 'y' }]), ['length', 'a', 'b'])
+        assert.strict.deepStrictEqual(getltdtkeys([{ a: 1, length: -0 }]), ['a', 'length'])
+    })
+
+    it(`should keep the behavior for rows that are arrays (including holes), strings, typed arrays, null and primitives`, function() {
+        //列為真陣列者沿用 lodash keys: 含空洞索引(Object.keys 不含)
+        assert.strict.deepStrictEqual(getltdtkeys([[1, 2]]), ['0', '1'])
+        assert.strict.deepStrictEqual(getltdtkeys([[, 1]]), ['0', '1']) // eslint-disable-line no-sparse-arrays
+        assert.strict.deepStrictEqual(getltdtkeys([new Uint8Array(2)]), ['0', '1'])
+        assert.strict.deepStrictEqual(getltdtkeys([null, undefined, 5, true, 'ab', { a: 1 }]), ['0', '1', 'a'])
+        assert.strict.deepStrictEqual(getltdtkeys([new Map([['k', 1]]), new Date(0), /a/, () => 1]), [])
+    })
+
+    it(`should return the own enumerable string keys of class instances, null-prototype rows and rows with inherited keys`, function() {
+        class Foo {
+            constructor() {
+                this.a = 1
+            }
+        }
+        let np = Object.create(null)
+        np.n = 1
+        let inh = Object.create({ p: 1 })
+        inh.q = 2
+        assert.strict.deepStrictEqual(getltdtkeys([new Foo(), np, inh]), ['a', 'n', 'q'])
+    })
+
+    it(`should return the same keys as the lodash keys on 500 random rows without length keys`, function() {
+        let seed = 20261020
+        let rnd = () => {
+            seed = (seed * 1103515245 + 12345) % 2147483648
+            return seed / 2147483648
+        }
+        let names = ['a', 'b', 'c', '0', '1', '10', 'constructor', 'toString', 'x y', '中文']
+        let rows = []
+        for (let i = 0; i < 500; i++) {
+            let o = {}
+            let n = Math.floor(rnd() * 5)
+            for (let j = 0; j < n; j++) {
+                o[names[Math.floor(rnd() * names.length)]] = j
+            }
+            rows.push(o)
+        }
+        let expected = []
+        for (let o of rows) {
+            for (let k of Object.keys(o)) {
+                if (!expected.includes(k)) {
+                    expected.push(k)
+                }
+            }
+        }
+        assert.strict.deepStrictEqual(getltdtkeys(rows), expected)
+    })
+
+})
+
 describe(`getltdtkeys`, function() {
     let k
     let o = {}

package/test/tools/clearXssWalkRunner.mjs

@@ -0,0 +1,202 @@
+//clearXssWalkRunner.mjs: 於限額子行程執行 clearXSS 之走訪案例(R-XSS-WALK-01): 極深巢狀、大型共用結構(DAG)、大型循環
+//  修前之實作對深巢狀同步拋 RangeError(未捕捉, 離開碼非 0)、對 DAG 依路徑數指數重走(2^n, 逾時被終止)
+//  約定同runChildCase: node [--max-old-space-size=N] clearXssWalkRunner.mjs <caseName>, 結果以一行'@@R@@'開頭之JSON輸出至stdout
+//  caseName:
+//    'deep:<obj|arr|mixed|map|set>:<層數>': 迭代建構之深巢狀(葉為字串)
+//    'dag:<obj|arr|map|set|mixed>:<層數>': 每層兩個參照指向同一子結構, 葉為字串; 計 filterXSS 呼叫數
+//    'cycle:<長度>': 長度為n之物件環(最後一個指回第一個), 每個節點帶一個字串
+import clearXSS from '../../src/clearXSS.mjs'
+import fxss from '../../src/_filterXSS.mjs'
+
+
+let x = '<script>alert(1)</script>'
+let fx = '&lt;script>alert(1)&lt;/script>'
+
+//計 filterXSS 呼叫數(fxss為可變單例, clearXSS每次呼叫經fxss.getFilterXSS取得)
+let calls = 0
+let origGet = fxss.getFilterXSS
+fxss.getFilterXSS = () => {
+    let f = origGet()
+    let w = (c, o) => {
+        calls++
+        return f(c, o)
+    }
+    w.escapeAttrValue = f.escapeAttrValue
+    return w
+}
+
+let caseName = process.argv[2] || ''
+let [kind, sub, sn] = caseName.split(':')
+let n = Number(kind === 'cycle' ? sub : sn)
+
+//wrap, 依種類包一層
+let wrap = (kind2, i, cur) => {
+    if (kind2 === 'obj') {
+        return { a: cur }
+    }
+    if (kind2 === 'arr') {
+        return [cur]
+    }
+    if (kind2 === 'map') {
+        return new Map([['k', cur]])
+    }
+    if (kind2 === 'set') {
+        return new Set([cur])
+    }
+    return (i % 2 === 0) ? { a: cur } : [cur] //mixed
+}
+
+//child, 取子節點(迭代取葉用)
+let child = (v) => {
+    if (Array.isArray(v)) {
+        return v[0]
+    }
+    if (v instanceof Map) {
+        return v.get('k')
+    }
+    if (v instanceof Set) {
+        return [...v][0]
+    }
+    return v.a
+}
+
+//leaf, 迭代取葉並回傳深度
+let leafOf = (v) => {
+    let d = 0
+    while (typeof v === 'object' && v !== null) {
+        v = child(v)
+        d++
+    }
+    return { v, d }
+}
+
+let out = { kind, sub, n }
+clearXSS({ b: x }) //先載入js-xss
+if (global.gc) {
+    global.gc()
+}
+
+if (kind === 'deep') {
+    let inp = x
+    for (let i = 0; i < n; i++) {
+        inp = wrap(sub, i, inp)
+    }
+    let h0 = process.memoryUsage().heapUsed
+    calls = 0
+    let t0 = process.hrtime.bigint()
+    let r = clearXSS(inp)
+    out.ms = Number(process.hrtime.bigint() - t0) / 1e6
+    out.heapMB = (process.memoryUsage().heapUsed - h0) / 1048576
+    let lo = leafOf(r)
+    let li = leafOf(inp)
+    out.leafCleaned = lo.v === fx
+    out.inputIntact = li.v === x
+    out.depthOut = lo.d
+    out.depthIn = li.d
+    out.notSame = r !== inp
+    out.calls = calls
+}
+else if (kind === 'dag') {
+    let cur = sub === 'map' ? new Map([['v', x]]) : sub === 'set' ? new Set([x]) : sub === 'arr' ? [x] : { v: x } //mixed之葉同obj
+    for (let i = 0; i < n; i++) {
+        if (sub === 'obj') {
+            cur = { l: cur, r: cur }
+        }
+        else if (sub === 'arr') {
+            cur = [cur, cur]
+        }
+        else if (sub === 'map') {
+            cur = new Map([['l', cur], ['r', cur]])
+        }
+        else if (sub === 'set') {
+            cur = new Set([{ p: cur }, { q: cur }]) //Set元素不可重複, 兩個包裝物件各引用同一子Set
+        }
+        else {
+            cur = (i % 2 === 0) ? { l: cur, r: cur } : [cur, cur]
+        }
+    }
+    calls = 0
+    let t0 = process.hrtime.bigint()
+    let r = clearXSS(cur)
+    out.ms = Number(process.hrtime.bigint() - t0) / 1e6
+    out.calls = calls
+    //共用: 沿 l 與 r 兩側各走到底, 每層兩側須為同一輸出物件
+    let shared = true
+    let v = r
+    let steps = 0
+    while (typeof v === 'object' && v !== null && steps < n + 5) {
+        if (sub === 'obj') {
+            if (v.l === undefined) {
+                break
+            }
+            shared = shared && v.l === v.r
+            v = v.l
+        }
+        else if (sub === 'arr') {
+            if (v.length !== 2) {
+                break
+            }
+            shared = shared && v[0] === v[1]
+            v = v[0]
+        }
+        else if (sub === 'map') {
+            if (!v.has('l')) {
+                break
+            }
+            shared = shared && v.get('l') === v.get('r')
+            v = v.get('l')
+        }
+        else if (sub === 'set') {
+            let es = [...v]
+            if (typeof es[0] !== 'object' || es[0] === null || es[0].p === undefined) {
+                break
+            }
+            shared = shared && es[0].p === es[1].q
+            v = es[0].p
+        }
+        else {
+            if (Array.isArray(v)) {
+                shared = shared && v[0] === v[1]
+                v = v[0]
+            }
+            else {
+                if (v.l === undefined) {
+                    break
+                }
+                shared = shared && v.l === v.r
+                v = v.l
+            }
+        }
+        steps++
+    }
+    out.shared = shared
+    out.steps = steps
+}
+else if (kind === 'cycle') {
+    let head = { i: 0, s: x }
+    let cur = head
+    for (let i = 1; i < n; i++) {
+        let nx = { i, s: x }
+        cur.next = nx
+        cur = nx
+    }
+    cur.next = head
+    let t0 = process.hrtime.bigint()
+    let r = clearXSS(head)
+    out.ms = Number(process.hrtime.bigint() - t0) / 1e6
+    //走一圈: 每個節點字串已清除, 第n步回到起點
+    let v = r
+    let ok = true
+    for (let i = 0; i < n; i++) {
+        ok = ok && v.i === i && v.s === fx
+        v = v.next
+    }
+    out.cleaned = ok
+    out.closed = v === r
+    out.inputIntact = head.s === x && cur.next === head
+}
+else {
+    throw new Error('unknown case: ' + caseName)
+}
+
+console.log('@@R@@' + JSON.stringify(out))