@graphql-toolkit/graphql-file-loader - npm Package Compare versions

Comparing version 0.6.8-alpha-a3fdc9c.4 to 0.6.8-alpha-aa0b7b9.7

dist/commonjs/load-from-gql-file.js

@@ -5,2 +5,5 @@ "use strict";
 const path_1 = require("path");
+const fs_1 = require("fs");
+const isValidPath = require("is-valid-path");
+const graphql_import_1 = require("graphql-import");
 const GQL_EXTENSIONS = ['.gql', '.graphql', '.graphqls'];
@@ -12,13 +15,19 @@ class GraphQLFileLoader {
     async canLoad(pointer, options) {
-        const extension = path_1.extname(pointer).toLowerCase();
-        return GQL_EXTENSIONS.includes(extension);
+        if (isValidPath(pointer)) {
+            const extension = path_1.extname(pointer).toLowerCase();
+            if (GQL_EXTENSIONS.includes(extension)) {
+                const normalizedFilePath = path_1.isAbsolute(pointer) ? pointer : path_1.resolve(options.cwd || process.cwd(), pointer);
+                if (fs_1.existsSync(normalizedFilePath)) {
+                    return true;
+                }
+            }
+        }
+        return false;
     }
     async load(pointer, options) {
-        const { readFileSync } = eval(`require('fs')`);
         const normalizedFilePath = path_1.isAbsolute(pointer) ? pointer : path_1.resolve(options.cwd || process.cwd(), pointer);
-        const content = readFileSync(normalizedFilePath, 'utf-8').trim();
+        const content = fs_1.readFileSync(normalizedFilePath, 'utf-8').trim();
         if (content && content !== '') {
             if (!options.skipGraphQLImport && /^\#.*import /i.test(content.trimLeft())) {
-                const { importSchema } = eval(`require('graphql-import')`);
-                const importedSchema = importSchema(normalizedFilePath);
+                const importedSchema = graphql_import_1.importSchema(normalizedFilePath);
                 return {
@@ -25,0 +34,0 @@ location: pointer,

dist/esnext/load-from-gql-file.js

 import { parse, Source as GraphQLSource } from 'graphql';
 import { extname, isAbsolute, resolve } from 'path';
+import { readFileSync, existsSync } from 'fs';
+import * as isValidPath from 'is-valid-path';
+import { importSchema } from 'graphql-import';
 const GQL_EXTENSIONS = ['.gql', '.graphql', '.graphqls'];
@@ -9,7 +12,14 @@ export class GraphQLFileLoader {
     async canLoad(pointer, options) {
-        const extension = extname(pointer).toLowerCase();
-        return GQL_EXTENSIONS.includes(extension);
+        if (isValidPath(pointer)) {
+            const extension = extname(pointer).toLowerCase();
+            if (GQL_EXTENSIONS.includes(extension)) {
+                const normalizedFilePath = isAbsolute(pointer) ? pointer : resolve(options.cwd || process.cwd(), pointer);
+                if (existsSync(normalizedFilePath)) {
+                    return true;
+                }
+            }
+        }
+        return false;
     }
     async load(pointer, options) {
-        const { readFileSync } = eval(`require('fs')`);
         const normalizedFilePath = isAbsolute(pointer) ? pointer : resolve(options.cwd || process.cwd(), pointer);
@@ -19,3 +29,2 @@ const content = readFileSync(normalizedFilePath, 'utf-8').trim();
             if (!options.skipGraphQLImport && /^\#.*import /i.test(content.trimLeft())) {
-                const { importSchema } = eval(`require('graphql-import')`);
                 const importedSchema = importSchema(normalizedFilePath);
@@ -22,0 +31,0 @@ return {

package.json

 {
   "name": "@graphql-toolkit/graphql-file-loader",
-  "version": "0.6.8-alpha-a3fdc9c.4+a3fdc9c",
+  "version": "0.6.8-alpha-aa0b7b9.7+aa0b7b9",
   "description": "A set of utils for faster development of GraphQL tools",
@@ -28,4 +28,5 @@ "repository": "[e-mail]:dotansimha/graphql-toolkit.git",
   "dependencies": {
-    "@graphql-toolkit/common": "0.6.8-alpha-a3fdc9c.4+a3fdc9c",
-    "graphql-import": "0.7.1"
+    "@graphql-toolkit/common": "0.6.8-alpha-aa0b7b9.7+aa0b7b9",
+    "graphql-import": "0.7.1",
+    "tslib": "1.10.0"
   },
@@ -35,3 +36,3 @@ "publishConfig": {
   },
-  "gitHead": "a3fdc9cd16e3e2d7833d663fbbe3ab860162f668"
+  "gitHead": "aa0b7b913da8b728a64cbd28374276c45df406fc"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Manifest confusion

Supply chain risk

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

10634

increased by12.77%

Lines of code

116

increased by18.37%

Number of medium supply chain risk alerts

1

decreased by-80%

Worsened metrics

Dependency count

4

increased by33.33%

Number of low supply chain risk alerts

3

increased by200%

Dependency changes

• + Addedtslib@1.10.0

• + Addedtslib@1.10.0(transitive)

• Updated@graphql-toolkit/common@0.6.8-alpha-aa0b7b9.7+aa0b7b9