@jupyterlab/services - npm Package Compare versions

Comparing version 7.0.10 to 7.0.11

lib/session/restapi.js

@@ -38,3 +38,8 @@ "use strict";
 function getSessionUrl(baseUrl, id) {
-    return coreutils_1.URLExt.join(baseUrl, exports.SESSION_SERVICE_URL, id);
+    const servicesBase = coreutils_1.URLExt.join(baseUrl, exports.SESSION_SERVICE_URL);
+    const result = coreutils_1.URLExt.join(servicesBase, id);
+    if (!result.startsWith(servicesBase)) {
+        throw new Error('Can only be used for services requests');
+    }
+    return result;
 }
@@ -41,0 +46,0 @@ exports.getSessionUrl = getSessionUrl;

lib/setting/index.js

@@ -114,3 +114,8 @@ "use strict";
             : '';
-        return `${coreutils_1.URLExt.join(base, SERVICE_SETTINGS_URL, id)}${idsOnlyParam}`;
+        const settingsBase = coreutils_1.URLExt.join(base, SERVICE_SETTINGS_URL);
+        const result = coreutils_1.URLExt.join(settingsBase, id);
+        if (!result.startsWith(settingsBase)) {
+            throw new Error('Can only be used for workspaces requests');
+        }
+        return `${result}${idsOnlyParam}`;
     }
@@ -117,0 +122,0 @@ Private.url = url;

lib/terminal/restapi.js

@@ -83,3 +83,7 @@ "use strict";
     Private.errorIfNotAvailable();
-    const url = coreutils_1.URLExt.join(settings.baseUrl, exports.TERMINAL_SERVICE_URL, name);
+    const workspacesBase = coreutils_1.URLExt.join(settings.baseUrl, exports.TERMINAL_SERVICE_URL);
+    const url = coreutils_1.URLExt.join(workspacesBase, name);
+    if (!url.startsWith(workspacesBase)) {
+        throw new Error('Can only be used for terminal requests');
+    }
     const init = { method: 'DELETE' };
@@ -86,0 +90,0 @@ const response = await serverconnection_1.ServerConnection.makeRequest(url, init, settings);

lib/workspace/index.js

@@ -118,3 +118,8 @@ "use strict";
     function url(base, id) {
-        return coreutils_1.URLExt.join(base, SERVICE_WORKSPACES_URL, id);
+        const workspacesBase = coreutils_1.URLExt.join(base, SERVICE_WORKSPACES_URL);
+        const result = coreutils_1.URLExt.join(workspacesBase, id);
+        if (!result.startsWith(workspacesBase)) {
+            throw new Error('Can only be used for workspaces requests');
+        }
+        return result;
     }
@@ -121,0 +126,0 @@ Private.url = url;

package.json

 {
   "name": "@jupyterlab/services",
-  "version": "7.0.10",
+  "version": "7.0.11",
   "description": "Client APIs for the Jupyter services REST APIs",
@@ -50,6 +50,6 @@ "keywords": [
     "@jupyter/ydoc": "^1.1.1",
-    "@jupyterlab/coreutils": "^6.0.10",
-    "@jupyterlab/nbformat": "^4.0.10",
-    "@jupyterlab/settingregistry": "^4.0.10",
-    "@jupyterlab/statedb": "^4.0.10",
+    "@jupyterlab/coreutils": "^6.0.11",
+    "@jupyterlab/nbformat": "^4.0.11",
+    "@jupyterlab/settingregistry": "^4.0.11",
+    "@jupyterlab/statedb": "^4.0.11",
     "@lumino/coreutils": "^2.1.2",
@@ -63,3 +63,3 @@ "@lumino/disposable": "^2.1.2",
   "devDependencies": {
-    "@jupyterlab/testing": "^4.0.10",
+    "@jupyterlab/testing": "^4.0.11",
     "@types/jest": "^29.2.0",
@@ -66,0 +66,0 @@ "@types/ws": "^8.5.3",

src/session/restapi.ts

@@ -45,3 +45,8 @@ // Copyright (c) Jupyter Development Team.
 export function getSessionUrl(baseUrl: string, id: string): string {
-  return URLExt.join(baseUrl, SESSION_SERVICE_URL, id);
+  const servicesBase = URLExt.join(baseUrl, SESSION_SERVICE_URL);
+  const result = URLExt.join(servicesBase, id);
+  if (!result.startsWith(servicesBase)) {
+    throw new Error('Can only be used for services requests');
+  }
+  return result;
 }
@@ -48,0 +53,0 @@

src/setting/index.ts

@@ -164,4 +164,9 @@ // Copyright (c) Jupyter Development Team.
       : '';
-    return `${URLExt.join(base, SERVICE_SETTINGS_URL, id)}${idsOnlyParam}`;
+    const settingsBase = URLExt.join(base, SERVICE_SETTINGS_URL);
+    const result = URLExt.join(settingsBase, id);
+    if (!result.startsWith(settingsBase)) {
+      throw new Error('Can only be used for workspaces requests');
+    }
+    return `${result}${idsOnlyParam}`;
   }
 }

src/terminal/restapi.ts

@@ -104,3 +104,7 @@ // Copyright (c) Jupyter Development Team.
   Private.errorIfNotAvailable();
-  const url = URLExt.join(settings.baseUrl, TERMINAL_SERVICE_URL, name);
+  const workspacesBase = URLExt.join(settings.baseUrl, TERMINAL_SERVICE_URL);
+  const url = URLExt.join(workspacesBase, name);
+  if (!url.startsWith(workspacesBase)) {
+    throw new Error('Can only be used for terminal requests');
+  }
   const init = { method: 'DELETE' };
@@ -107,0 +111,0 @@ const response = await ServerConnection.makeRequest(url, init, settings);

src/workspace/index.ts

@@ -181,4 +181,9 @@ // Copyright (c) Jupyter Development Team.
   export function url(base: string, id: string): string {
-    return URLExt.join(base, SERVICE_WORKSPACES_URL, id);
+    const workspacesBase = URLExt.join(base, SERVICE_WORKSPACES_URL);
+    const result = URLExt.join(workspacesBase, id);
+    if (!result.startsWith(workspacesBase)) {
+      throw new Error('Can only be used for workspaces requests');
+    }
+    return result;
   }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1199898

increased by0.23%

Lines of code

26943

increased by0.14%

Dependency changes

• Updated@jupyterlab/coreutils@^6.0.11

• Updated@jupyterlab/nbformat@^4.0.11

• Updated@jupyterlab/settingregistry@^4.0.11

• Updated@jupyterlab/statedb@^4.0.11