@ai-sdk/google
Advanced tools
+2
-2
| { | ||
| "name": "@ai-sdk/google", | ||
| "version": "4.0.0-canary.80", | ||
| "version": "4.0.0-canary.81", | ||
| "type": "module", | ||
@@ -39,3 +39,3 @@ "license": "Apache-2.0", | ||
| "@ai-sdk/provider": "4.0.0-canary.18", | ||
| "@ai-sdk/provider-utils": "5.0.0-canary.47" | ||
| "@ai-sdk/provider-utils": "5.0.0-canary.48" | ||
| }, | ||
@@ -42,0 +42,0 @@ "devDependencies": { |
@@ -279,3 +279,32 @@ export type PartialArg = { | ||
| const hasOwn = Object.prototype.hasOwnProperty; | ||
| /** | ||
| * Checks only direct properties so path traversal never follows the prototype chain. | ||
| */ | ||
| function hasOwnProperty( | ||
| obj: Record<string | number, unknown>, | ||
| key: string | number, | ||
| ): boolean { | ||
| return hasOwn.call(obj, key); | ||
| } | ||
| /** | ||
| * Defines path values as own data properties so special keys like `__proto__` | ||
| * cannot invoke prototype setters while accumulating streamed arguments. | ||
| */ | ||
| function defineOwnProperty( | ||
| obj: Record<string | number, unknown>, | ||
| key: string | number, | ||
| value: unknown, | ||
| ): void { | ||
| Object.defineProperty(obj, key, { | ||
| value, | ||
| enumerable: true, | ||
| configurable: true, | ||
| writable: true, | ||
| }); | ||
| } | ||
| /** | ||
| * Traverses a nested object along the given path segments and returns the leaf value. | ||
@@ -293,3 +322,5 @@ * | ||
| if (current == null || typeof current !== 'object') return undefined; | ||
| current = (current as Record<string | number, unknown>)[pathSegment]; | ||
| const currentRecord = current as Record<string | number, unknown>; | ||
| if (!hasOwnProperty(currentRecord, pathSegment)) return undefined; | ||
| current = currentRecord[pathSegment]; | ||
| } | ||
@@ -314,8 +345,12 @@ return current; | ||
| const nextSeg = segments[i + 1]; | ||
| if (current[pathSegment] == null) { | ||
| current[pathSegment] = typeof nextSeg === 'number' ? [] : {}; | ||
| if (!hasOwnProperty(current, pathSegment) || current[pathSegment] == null) { | ||
| defineOwnProperty( | ||
| current, | ||
| pathSegment, | ||
| typeof nextSeg === 'number' ? [] : {}, | ||
| ); | ||
| } | ||
| current = current[pathSegment] as Record<string | number, unknown>; | ||
| } | ||
| current[segments[segments.length - 1]] = value; | ||
| defineOwnProperty(current, segments[segments.length - 1], value); | ||
| } | ||
@@ -322,0 +357,0 @@ |
@@ -12,2 +12,3 @@ import { | ||
| getFromApi, | ||
| isSameOrigin, | ||
| parseProviderOptions, | ||
@@ -267,6 +268,9 @@ postJsonToApi, | ||
| if (generatedSample.video?.uri) { | ||
| // Append API key to URL for authentication during download | ||
| const urlWithAuth = apiKey | ||
| ? `${generatedSample.video.uri}${generatedSample.video.uri.includes('?') ? '&' : '?'}key=${apiKey}` | ||
| : generatedSample.video.uri; | ||
| // Append the API key to the download URL for authentication, but only | ||
| // when the response-supplied URI stays on the provider's own origin — | ||
| // otherwise the key would leak to whatever host the response names. | ||
| const urlWithAuth = | ||
| apiKey && isSameOrigin(generatedSample.video.uri, this.config.baseURL) | ||
| ? `${generatedSample.video.uri}${generatedSample.video.uri.includes('?') ? '&' : '?'}key=${apiKey}` | ||
| : generatedSample.video.uri; | ||
@@ -273,0 +277,0 @@ videos.push({ |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is not supported yet
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
1614574
0.4%21634
0.34%+ Added
- Removed