@graphql-toolkit/graphql-file-loader - npm Package Compare versions

Comparing version 0.6.8-alpha-ffaed82.0 to 0.6.8

dist/commonjs/load-from-gql-file.js

@@ -5,2 +5,5 @@ "use strict";
 const path_1 = require("path");
+const fs_1 = require("fs");
+const isValidPath = require("is-valid-path");
+const graphql_import_1 = require("graphql-import");
 const GQL_EXTENSIONS = ['.gql', '.graphql', '.graphqls'];
@@ -12,13 +15,19 @@ class GraphQLFileLoader {
     async canLoad(pointer, options) {
-        const extension = path_1.extname(pointer).toLowerCase();
-        return GQL_EXTENSIONS.includes(extension);
+        if (isValidPath(pointer)) {
+            const extension = path_1.extname(pointer).toLowerCase();
+            if (GQL_EXTENSIONS.includes(extension)) {
+                const normalizedFilePath = path_1.isAbsolute(pointer) ? pointer : path_1.resolve(options.cwd || process.cwd(), pointer);
+                if (fs_1.existsSync(normalizedFilePath)) {
+                    return true;
+                }
+            }
+        }
+        return false;
     }
     async load(pointer, options) {
-        const { readFileSync } = eval(`require('fs')`);
         const normalizedFilePath = path_1.isAbsolute(pointer) ? pointer : path_1.resolve(options.cwd || process.cwd(), pointer);
-        const content = readFileSync(normalizedFilePath, 'utf-8').trim();
+        const content = fs_1.readFileSync(normalizedFilePath, 'utf-8').trim();
         if (content && content !== '') {
             if (!options.skipGraphQLImport && /^\#.*import /i.test(content.trimLeft())) {
-                const { importSchema } = eval(`require('graphql-import')`);
-                const importedSchema = importSchema(normalizedFilePath);
+                const importedSchema = graphql_import_1.importSchema(normalizedFilePath);
                 return {
@@ -25,0 +34,0 @@ location: pointer,

dist/esnext/load-from-gql-file.js

 import { parse, Source as GraphQLSource } from 'graphql';
 import { extname, isAbsolute, resolve } from 'path';
+import { readFileSync, existsSync } from 'fs';
+import * as isValidPath from 'is-valid-path';
+import { importSchema } from 'graphql-import';
 const GQL_EXTENSIONS = ['.gql', '.graphql', '.graphqls'];
@@ -9,7 +12,14 @@ export class GraphQLFileLoader {
     async canLoad(pointer, options) {
-        const extension = extname(pointer).toLowerCase();
-        return GQL_EXTENSIONS.includes(extension);
+        if (isValidPath(pointer)) {
+            const extension = extname(pointer).toLowerCase();
+            if (GQL_EXTENSIONS.includes(extension)) {
+                const normalizedFilePath = isAbsolute(pointer) ? pointer : resolve(options.cwd || process.cwd(), pointer);
+                if (existsSync(normalizedFilePath)) {
+                    return true;
+                }
+            }
+        }
+        return false;
     }
     async load(pointer, options) {
-        const { readFileSync } = eval(`require('fs')`);
         const normalizedFilePath = isAbsolute(pointer) ? pointer : resolve(options.cwd || process.cwd(), pointer);
@@ -19,3 +29,2 @@ const content = readFileSync(normalizedFilePath, 'utf-8').trim();
             if (!options.skipGraphQLImport && /^\#.*import /i.test(content.trimLeft())) {
-                const { importSchema } = eval(`require('graphql-import')`);
                 const importedSchema = importSchema(normalizedFilePath);
@@ -22,0 +31,0 @@ return {

package.json

 {
   "name": "@graphql-toolkit/graphql-file-loader",
-  "version": "0.6.8-alpha-ffaed82.0+ffaed82",
+  "version": "0.6.8",
   "description": "A set of utils for faster development of GraphQL tools",
@@ -25,7 +25,8 @@ "repository": "[e-mail]:dotansimha/graphql-toolkit.git",
     "graphql": "14.5.8",
-    "typescript": "3.6.4"
+    "typescript": "3.7.2"
   },
   "dependencies": {
-    "@graphql-toolkit/common": "0.6.8-alpha-ffaed82.0+ffaed82",
-    "graphql-import": "0.7.1"
+    "@graphql-toolkit/common": "0.6.8",
+    "graphql-import": "0.7.1",
+    "tslib": "1.10.0"
   },
@@ -35,3 +36,3 @@ "publishConfig": {
   },
-  "gitHead": "ffaed82b6bc78c9abb8a6897f27bc969d929b547"
+  "gitHead": "42f1597a036ccd8a247e633a17e02ad03656aa1d"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

10586

increased by12.26%

Number of downloads

22372

increased by15.02%

Lines of code

116

increased by18.37%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Dependency count

4

increased by33.33%

Number of low supply chain risk alerts

3

increased by200%

Dependency changes

• + Addedtslib@1.10.0

• + Added@graphql-toolkit/common@0.6.8(transitive)

• + Added@kamilkisiela/graphql-tools@4.0.6(transitive)

• + Added@wry/equality@0.1.11(transitive)

• + Addedaggregate-error@3.0.1(transitive)

• + Addedapollo-link@1.2.14(transitive)

• + Addedapollo-utilities@1.3.4(transitive)

• + Addedclean-stack@2.2.0(transitive)

• + Addeddeprecated-decorator@0.1.6(transitive)

• + Addedfast-json-stable-stringify@2.1.0(transitive)

• + Addedindent-string@4.0.0(transitive)

• + Addedlodash@4.17.15(transitive)

• + Addedts-invariant@0.4.4(transitive)

• + Addedtslib@1.10.0(transitive)

• + Addeduuid@3.4.0(transitive)

• + Addedzen-observable@0.8.15(transitive)

• + Addedzen-observable-ts@0.8.21(transitive)

• - Removedlodash@4.17.21(transitive)

• Updated@graphql-toolkit/common@0.6.8