@nestjs/microservices - npm Package Compare versions

Comparing version 11.1.14 to 11.1.15

package.json

 {
   "name": "@nestjs/microservices",
-  "version": "11.1.14",
+  "version": "11.1.15",
   "description": "Nest - modern, fast, powerful node.js web framework (@microservices)",
@@ -25,4 +25,4 @@ "author": "Kamil Mysliwiec",
   "devDependencies": {
-    "@nestjs/common": "11.1.14",
-    "@nestjs/core": "11.1.14"
+    "@nestjs/common": "11.1.15",
+    "@nestjs/core": "11.1.15"
   },
@@ -73,3 +73,3 @@ "peerDependencies": {
   },
-  "gitHead": "5d31df7eb62d89952d827eadc19123fb441f541e"
+  "gitHead": "cb68ac211dc7df39a8bac01cae043c50634ca303"
 }

server/server-grpc.js

@@ -328,3 +328,3 @@ "use strict";
                         .indexOf('cancelled');
-                    if (isCancelledError) {
+                    if (isCancelledError !== -1) {
                         call.end();
@@ -331,0 +331,0 @@ return;

server/server-rmq.d.ts

@@ -44,5 +44,5 @@ import { RmqContext } from '../ctx-host';
     private parseMessageContent;
-    private initializeWildcardHandlersIfExist;
+    protected initializeWildcardHandlersIfExist(): void;
     private matchRmqPattern;
 }
 export {};

utils/transform-pattern.utils.d.ts

 import { MsPattern } from '../interfaces';
 /**
- * Transforms the Pattern to Route.
- * 1. If Pattern is a `string`, it will be returned as it is.
- * 2. If Pattern is a `number`, it will be converted to `string`.
- * 3. If Pattern is a `JSON` object, it will be transformed to Route. For that end,
- * the function will sort properties of `JSON` Object and creates `route` string
- * according to the following template:
- * <key1>:<value1>/<key2>:<value2>/.../<keyN>:<valueN>
+ * Transforms the Pattern to Route safely.
  *
- * @param  {MsPattern} pattern - client pattern
+ * @param pattern - client pattern
+ * @param depth - current recursion depth
+ * @param maxDepth - maximum allowed recursion depth
+ * @param maxKeys - maximum allowed keys per object
  * @returns string
  */
-export declare function transformPatternToRoute(pattern: MsPattern): string;
+export declare function transformPatternToRoute(pattern: MsPattern, depth?: number, maxDepth?: number, maxKeys?: number): string;

utils/transform-pattern.utils.js

@@ -5,15 +5,14 @@ "use strict";
 const shared_utils_1 = require("@nestjs/common/utils/shared.utils");
+const DEFAULT_MAX_DEPTH = 5;
+const DEFAULT_MAX_KEYS = 20;
 /**
- * Transforms the Pattern to Route.
- * 1. If Pattern is a `string`, it will be returned as it is.
- * 2. If Pattern is a `number`, it will be converted to `string`.
- * 3. If Pattern is a `JSON` object, it will be transformed to Route. For that end,
- * the function will sort properties of `JSON` Object and creates `route` string
- * according to the following template:
- * <key1>:<value1>/<key2>:<value2>/.../<keyN>:<valueN>
+ * Transforms the Pattern to Route safely.
  *
- * @param  {MsPattern} pattern - client pattern
+ * @param pattern - client pattern
+ * @param depth - current recursion depth
+ * @param maxDepth - maximum allowed recursion depth
+ * @param maxKeys - maximum allowed keys per object
  * @returns string
  */
-function transformPatternToRoute(pattern) {
+function transformPatternToRoute(pattern, depth = 0, maxDepth = DEFAULT_MAX_DEPTH, maxKeys = DEFAULT_MAX_KEYS) {
     if ((0, shared_utils_1.isString)(pattern) || (0, shared_utils_1.isNumber)(pattern)) {
@@ -23,15 +22,26 @@ return `${pattern}`;
     if (!(0, shared_utils_1.isObject)(pattern)) {
+        // For non-string, non-number, non-object values
         return pattern;
     }
-    const sortedKeys = Object.keys(pattern).sort((a, b) => ('' + a).localeCompare(b));
-    // Creates the array of Pattern params from sorted keys and their corresponding values
-    const sortedPatternParams = sortedKeys.map(key => {
+    if (depth > maxDepth) {
+        return '[MAX_DEPTH_REACHED]';
+    }
+    const keys = Object.keys(pattern);
+    if (keys.length > maxKeys) {
+        return '[TOO_MANY_KEYS]';
+    }
+    const sortedKeys = keys.sort((a, b) => ('' + a).localeCompare(b));
+    const parts = sortedKeys.map(key => {
+        const value = pattern[key];
         let partialRoute = `"${key}":`;
-        partialRoute += (0, shared_utils_1.isString)(pattern[key])
-            ? `"${transformPatternToRoute(pattern[key])}"`
-            : transformPatternToRoute(pattern[key]);
+        // Only quote strings, numbers and objects are handled recursively
+        if ((0, shared_utils_1.isString)(value)) {
+            partialRoute += `"${transformPatternToRoute(value, depth + 1, maxDepth, maxKeys)}"`;
+        }
+        else {
+            partialRoute += transformPatternToRoute(value, depth + 1, maxDepth, maxKeys);
+        }
         return partialRoute;
     });
-    const route = sortedPatternParams.join(',');
-    return `{${route}}`;
+    return `{${parts.join(',')}}`;
 }

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 3 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 3 instances in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Lines of code

11142

0.06%

Worsened metrics

Total package byte prevSize

462334

0

No dependency changes