@pothos/core - npm Package Compare versions

Comparing version 3.35.0 to 3.36.0

CHANGELOG.md

 # Change Log
 
+## 3.36.0
+
+### Minor Changes
+
+- 96ba1822: Improve validation for global IDs
+
 ## 3.35.0
@@ -4,0 +10,0 @@

esm/utils/base64.js

@@ -1,2 +0,3 @@
-/* eslint-disable @typescript-eslint/prefer-ts-expect-error */ /* eslint-disable @typescript-eslint/ban-ts-comment */ /* eslint-disable no-restricted-globals */ /* eslint-disable @typescript-eslint/no-invalid-this */ /* eslint-disable node/no-unsupported-features/es-builtins */ const getGlobalThis = () => {
+/* eslint-disable @typescript-eslint/prefer-ts-expect-error */ /* eslint-disable @typescript-eslint/ban-ts-comment */ /* eslint-disable no-restricted-globals */ /* eslint-disable @typescript-eslint/no-invalid-this */ /* eslint-disable node/no-unsupported-features/es-builtins */ import { PothosValidationError } from '../errors.js';
+const getGlobalThis = () => {
     if (typeof globalThis !== "undefined")
@@ -26,3 +27,7 @@ return globalThis;
 }
+const base64Regex = /^(?:[\d+/A-Za-z]{4})*(?:[\d+/A-Za-z]{2}==|[\d+/A-Za-z]{3}=)?$/;
 export function decodeBase64(value) {
+    if (!base64Regex.test(value)) {
+        throw new PothosValidationError("Invalid base64 string");
+    }
     const globalThis1 = getGlobalThis();
@@ -29,0 +34,0 @@ if (typeof globalThis1.Buffer === "function") {

lib/utils/base64.js

@@ -19,2 +19,3 @@ /* eslint-disable @typescript-eslint/prefer-ts-expect-error */ /* eslint-disable @typescript-eslint/ban-ts-comment */ /* eslint-disable no-restricted-globals */ /* eslint-disable @typescript-eslint/no-invalid-this */ /* eslint-disable node/no-unsupported-features/es-builtins */ "use strict";
 });
+const _errors = require("../errors");
 const getGlobalThis = ()=>{
@@ -40,3 +41,7 @@ if (typeof globalThis !== 'undefined') return globalThis;
 }
+const base64Regex = /^(?:[\d+/A-Za-z]{4})*(?:[\d+/A-Za-z]{2}==|[\d+/A-Za-z]{3}=)?$/;
 function decodeBase64(value) {
+    if (!base64Regex.test(value)) {
+        throw new _errors.PothosValidationError('Invalid base64 string');
+    }
     const globalThis1 = getGlobalThis();
@@ -43,0 +48,0 @@ if (typeof globalThis1.Buffer === 'function') {

package.json

 {
   "name": "@pothos/core",
-  "version": "3.35.0",
+  "version": "3.36.0",
   "description": "Pothos (formerly GiraphQL) is a plugin based schema builder for creating code-first GraphQL schemas in typescript",
@@ -5,0 +5,0 @@ "main": "./lib/index.js",

src/utils/base64.ts

@@ -7,2 +7,4 @@ /* eslint-disable @typescript-eslint/prefer-ts-expect-error */
 
+import { PothosValidationError } from '../errors';
+
 const getGlobalThis = () => {
@@ -33,3 +35,7 @@ if (typeof globalThis !== 'undefined') return globalThis;
 
+const base64Regex = /^(?:[\d+/A-Za-z]{4})*(?:[\d+/A-Za-z]{2}==|[\d+/A-Za-z]{3}=)?$/;
 export function decodeBase64(value: string): string {
+  if (!base64Regex.test(value)) {
+    throw new PothosValidationError('Invalid base64 string');
+  }
   const globalThis = getGlobalThis();
@@ -36,0 +42,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1052249

increased by0.1%

Lines of code

15730

increased by0.1%

No dependency changes