@amritk/resolve-refs - npm Package Compare versions

Comparing version 0.1.1 to 0.1.2

dist/get-by-pointer.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"get-by-pointer.d.ts","sourceRoot":"","sources":["../src/get-by-pointer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,OAAO,WAAW,MAAM,KAAG,OAe7D,CAAA"}
+{"version":3,"file":"get-by-pointer.d.ts","sourceRoot":"","sources":["../src/get-by-pointer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,YAAY,SAAU,OAAO,WAAW,MAAM,KAAG,OAuB7D,CAAA"}

dist/get-by-pointer.js

@@ -13,3 +13,12 @@ /**
         .split('/')
-        .map((segment) => segment.replace(/~1/g, '/').replace(/~0/g, '~'));
+        .map((segment) => {
+        let decoded = segment;
+        try {
+            decoded = decodeURIComponent(segment);
+        }
+        catch {
+            // leave invalid percent-escapes as-is
+        }
+        return decoded.replace(/~1/g, '/').replace(/~0/g, '~');
+    });
     let current = root;
@@ -16,0 +25,0 @@ for (const segment of segments) {

package.json

 {
   "name": "@amritk/resolve-refs",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Resolve and inline JSON Schema / OpenAPI $refs — internal, cross-file, and remote — with session caching and a default-deny SSRF guard.",
@@ -5,0 +5,0 @@ "module": "./dist/index.js",

src/get-by-pointer.test.ts

@@ -31,2 +31,9 @@ import { describe, expect, it } from 'vitest'
 
+  it('percent-decodes URI-encoded segments', () => {
+    const doc = { '{volume_id}': 'found', 'weird/key': true }
+    expect(getByPointer(doc, '/%7Bvolume_id%7D')).toBe('found')
+    // %2F in a segment must not be treated as a path separator
+    expect(getByPointer(doc, '/weird%2Fkey')).toBe(true)
+  })
+
   it('returns undefined when a segment is missing', () => {
@@ -33,0 +40,0 @@ expect(getByPointer(root, '/info/nope')).toBeUndefined()

src/get-by-pointer.ts

@@ -13,3 +13,11 @@ /**
     .split('/')
-    .map((segment) => segment.replace(/~1/g, '/').replace(/~0/g, '~'))
+    .map((segment) => {
+      let decoded = segment
+      try {
+        decoded = decodeURIComponent(segment)
+      } catch {
+        // leave invalid percent-escapes as-is
+      }
+      return decoded.replace(/~1/g, '/').replace(/~0/g, '~')
+    })
 
@@ -16,0 +24,0 @@ let current: unknown = root

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

48327

1.45%

Lines of code

996

2.36%

No dependency changes