@social-embed/lib - npm Package Compare versions

Comparing version 0.1.0-next.5 to 0.1.0-next.7

CHANGES.md

 ---
 title: Release notes
+description: Latest updates for the @social-embed URL parsing library.
 ---
@@ -9,4 +10,31 @@
 
+## 0.1.0-next.6 (2023-11-25)
+
 ### Breaking changes
 
+- Security: Fixes to mitigate polynomial regex expressions (#17)
+
+  - Add plugins: [eslint-plugin-redos-detector] ([redos-detector])
+
+    [eslint-plugin-redos-detector]: https://github.com/tjenkinson/eslint-plugin-redos-detector
+    [redos-detector]: https://github.com/tjenkinson/redos-detector
+
+  - lib(matcher): Cap length to prevent some ReDoS vectors
+  - Simplify regexes for EdPuzzle, Loom, Spotify, Wistia, YouTube
+  - Remove generic URL regex: This regex is difficult to constrain
+
+    - `isValidUrl()`: in favor of using [`URL()`] constructor directly to
+      test URL validity.
+
+      [`URL()`]: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL
+
+### Deprecation notice
+
+- Regex patterns will be set to be removed in future releases in favor of
+  a typed, URL matching object (interface is to be determined).
+
+## 0.1.0-next.5 (2023-10-15)
+
+### Breaking changes
+
 - Minimum Node.js version to v18+ (#12)
@@ -13,0 +41,0 @@ - Move from [jest] to [vitest]

dist/lib.js

@@ -1,31 +0,31 @@
-var e = /* @__PURE__ */ ((t) => (t.YouTube = "YouTube", t.Spotify = "Spotify", t.Vimeo = "Vimeo", t.DailyMotion = "DailyMotion", t.EdPuzzle = "EdPuzzle", t.Loom = "Loom", t.Wistia = "Wistia", t))(e || {});
-const d = /^(?:(?:https?):)?(?:\/\/)?(?:www\.)?(?:(?:dailymotion\.com(?:\/embed)?\/video)|dai\.ly)\/([a-zA-Z0-9]+)(?:_[\w_-]+)?(?:\?playlist=[a-zA-Z0-9]+)?$/, a = (t) => {
+const S = (t) => {
+  try {
+    return !!new URL(t);
+  } catch {
+    return !1;
+  }
+}, a = /^(?:(?:https?):)?(?:\/\/)?(?:www\.)?(?:youtube(?:-nocookie)?.com|youtu.be)(?:\/watch\?v)?[=/]([a-zA-Z0-9_-]{11})(?:\\?|=|&|$)/, d = (t) => {
   var o;
-  return ((o = t.match(d)) == null ? void 0 : o[1]) ?? "";
-}, u = (t) => `https://www.dailymotion.com/embed/video/${t}`, p = new RegExp(
-  "^(?:(?:https?):)?(?://)?[^/]*edpuzzle.com.*[=/]media/([-\\w]+)"
-), l = (t) => {
+  return t ? ((o = t.match(a)) == null ? void 0 : o[1]) ?? "" : "";
+}, u = (t) => `https://www.youtube.com/embed/${t}`, l = /^(?:(?:https?):)?(?:\/\/)?(?:www\.)?(?:(?:dailymotion\.com(?:\/embed)?\/video)|dai\.ly)\/([a-zA-Z0-9]+)(?:_[\w_-]+)?(?:\?playlist=[a-zA-Z0-9]+)?$/, p = (t) => {
   var o;
-  return t ? ((o = t.match(p)) == null ? void 0 : o[1]) ?? "" : "";
-}, y = (t) => `https://edpuzzle.com/embed/media/${t}`, f = new RegExp(
-  "^(?:(?:https?):)?(?://)?[^/]*loom.com.*[=/]share/([-\\w]+)"
-), s = (t) => {
-  var o;
-  return t ? ((o = t.match(f)) == null ? void 0 : o[1]) ?? "" : "";
-}, g = (t) => `https://www.loom.com/embed/${t}`, b = /(?:(?:https?):)?(?:\/\/)?(?:embed\.|open\.)(?:spotify\.com\/)(?:(album|track|playlist)\/|\?uri=spotify:track:)((\w|-){22})/, h = /spotify:(?:(album|track|playlist):|\?uri=spotify:track:)((\w|-){22})/, w = (t) => {
-  const [, o, r] = t.match(b) || t.match(h) || [];
+  return ((o = t.match(l)) == null ? void 0 : o[1]) ?? "";
+}, y = (t) => `https://www.dailymotion.com/embed/video/${t}`, w = /^(?:(?:https?):)?(?:\/\/)?(?:embed\.|open\.)(?:spotify\.com\/)(?:(album|track|playlist)\/|\?uri=spotify:track:)([-\w]{22})(?:\?si=[_-\w]{22})?$/, f = /spotify:(?:(album|track|playlist):|\?uri=spotify:track:)([-\w]{22})/, b = (t) => {
+  const [, o, r] = t.match(w) || t.match(f) || [];
   return [r, o];
-}, U = (t, o) => `https://open.spotify.com/embed/${o}/${t}`, z = /(?:(?:https?):)?(?:\/\/)?(?:www\.|player\.)?vimeo\.com\/(?:channels\/(?:\w+\/)?|groups\/(?:[^/]*)\/videos\/|video\/|)(\d+)(?:|\/\?)/, E = (t) => {
+}, h = (t, o) => `https://open.spotify.com/embed/${o}/${t}`, U = /(?:(?:https?):)?(?:\/\/)?(?:www\.|player\.)?vimeo\.com\/(?:channels\/(?:\w+\/)?|groups\/(?:[^/]*)\/videos\/|video\/|)(\d+)(?:|\/\?)/, g = (t) => {
   var o;
-  return ((o = t.match(z)) == null ? void 0 : o[1]) ?? "";
-}, I = (t) => `https://player.vimeo.com/video/${t}`, F = new RegExp(
-  "^(?:(?:https?):)?(?://)?[^/]*(?:wistia.com|wi.st).*[=/](?:medias|embed)/([-\\w]+)"
-  // '^(?:(?:https?):)?(?://)?[^/]*wistia.com.*[=/]medias/([-\\w]+)'  // v1 (handcrafted by Tony)
-), c = (t) => {
+  return ((o = t.match(U)) == null ? void 0 : o[1]) ?? "";
+}, z = (t) => `https://player.vimeo.com/video/${t}`, I = /^(?:(?:https?):)?(?:\/\/)?(?:www\.)?edpuzzle.com[=/]media\/([-\w]+)/, F = (t) => {
   var o;
-  return t ? ((o = t.match(F)) == null ? void 0 : o[1]) ?? "" : "";
-}, R = (t) => `https://fast.wistia.net/embed/iframe/${t}`, x = "^(?:(?:https?):)?(?://)?[^/]*(?:youtube(?:-nocookie)?.com|youtu.be).*[=/]([-\\w]{11})(?:\\?|=|&|$)", T = (t) => {
+  return t ? ((o = t.match(I)) == null ? void 0 : o[1]) ?? "" : "";
+}, E = (t) => `https://edpuzzle.com/embed/media/${t}`, v = /^(?:(?:https?):)?(?:\/\/)?(?:www|fast|support\.)?(?:wistia.com|wi.st)[=/](?:medias|embed)\/([-\w]+)/, s = (t) => {
   var o;
-  return t ? ((o = t.match(x)) == null ? void 0 : o[1]) ?? "" : "";
-}, $ = (t) => `https://www.youtube.com/embed/${t}`, M = (t) => {
+  return t ? ((o = t.match(v)) == null ? void 0 : o[1]) ?? "" : "";
+}, T = (t) => `https://fast.wistia.net/embed/iframe/${t}`, $ = /^(?:(?:https?):)?(?:\/\/)?(?:www\.)?loom.com[=/]share\/([-\w]+)/, c = (t) => {
+  var o;
+  return t ? ((o = t.match($)) == null ? void 0 : o[1]) ?? "" : "";
+}, M = (t) => `https://www.loom.com/embed/${t}`;
+var e = /* @__PURE__ */ ((t) => (t.YouTube = "YouTube", t.Spotify = "Spotify", t.Vimeo = "Vimeo", t.DailyMotion = "DailyMotion", t.EdPuzzle = "EdPuzzle", t.Loom = "Loom", t.Wistia = "Wistia", t))(e || {});
+const x = (t) => {
   if (t) {
@@ -42,64 +42,63 @@ if (t.match(/dailymotion/))
       return e.EdPuzzle;
+    if (s(t))
+      return e.Wistia;
     if (c(t))
-      return e.Wistia;
-    if (s(t))
       return e.Loom;
   }
-}, v = {
-  [e.DailyMotion]: a,
-  [e.Spotify]: w,
-  [e.Vimeo]: E,
-  [e.YouTube]: T,
-  [e.EdPuzzle]: l,
-  [e.Loom]: s,
-  [e.Wistia]: c
-}, S = {
-  [e.DailyMotion]: u,
-  [e.Spotify]: U,
-  [e.Vimeo]: I,
-  [e.YouTube]: $,
-  [e.EdPuzzle]: y,
-  [e.Loom]: g,
-  [e.Wistia]: R
-}, Y = (t) => {
-  const o = M(t);
+}, R = {
+  [e.DailyMotion]: p,
+  [e.Spotify]: b,
+  [e.Vimeo]: g,
+  [e.YouTube]: d,
+  [e.EdPuzzle]: F,
+  [e.Loom]: c,
+  [e.Wistia]: s
+}, L = {
+  [e.DailyMotion]: y,
+  [e.Spotify]: h,
+  [e.Vimeo]: z,
+  [e.YouTube]: u,
+  [e.EdPuzzle]: E,
+  [e.Loom]: M,
+  [e.Wistia]: T
+}, V = (t) => {
+  const o = x(t);
   if (!o)
     return "";
-  const r = v[o], n = S[o], i = r(t);
+  const r = R[o], m = L[o], i = r(t);
   if (Array.isArray(i)) {
-    const m = i.shift();
-    return m ? n(m, ...i) : "";
+    const n = i.shift();
+    return n ? m(n, ...i) : "";
   }
-  return n(i);
-}, V = (t) => typeof t == "string", D = (t) => t instanceof RegExp, L = (t) => (o) => V(o) && !D(t) ? o.includes(t) : new RegExp(t).test(o), W = /^[a-z][a-z\d.+-]*:\/*(?:[^:@]+(?::[^@]+)?@)?(?:[^\s:/?#]+|\[[a-f\d:]+])(?::\d+)?(?:\/[^?#]*)?(?:\?[^#]*)?(?:#.*)?$/i, A = L(W);
+  return m(i);
+};
 export {
   e as Provider,
-  v as ProviderIdFunctionMap,
-  S as ProviderIdUrlFunctionMap,
-  Y as convertUrlToEmbedUrl,
-  d as dailyMotionUrlRegex,
-  p as edPuzzleUrlRegex,
-  W as genericUrlRegex,
-  u as getDailyMotionEmbedFromId,
-  a as getDailyMotionIdFromUrl,
-  y as getEdPuzzleEmbedUrlFromId,
-  l as getEdPuzzleIdFromUrl,
-  g as getLoomEmbedUrlFromId,
-  s as getLoomIdFromUrl,
-  M as getProviderFromUrl,
-  U as getSpotifyEmbedUrlFromIdAndType,
-  w as getSpotifyIdAndTypeFromUrl,
-  I as getVimeoEmbedUrlFromId,
-  E as getVimeoIdFromUrl,
-  R as getWistiaEmbedUrlFromId,
-  c as getWistiaIdFromUrl,
-  $ as getYouTubeEmbedUrlFromId,
-  T as getYouTubeIdFromUrl,
-  A as isValidUrl,
-  f as loomUrlRegex,
-  h as spotifySymbolRegex,
-  b as spotifyUrlRegex,
-  z as vimeoUrlRegex,
-  F as wistiaUrlRegex,
-  x as youTubeUrlRegex
+  R as ProviderIdFunctionMap,
+  L as ProviderIdUrlFunctionMap,
+  V as convertUrlToEmbedUrl,
+  l as dailyMotionUrlRegex,
+  I as edPuzzleUrlRegex,
+  y as getDailyMotionEmbedFromId,
+  p as getDailyMotionIdFromUrl,
+  E as getEdPuzzleEmbedUrlFromId,
+  F as getEdPuzzleIdFromUrl,
+  M as getLoomEmbedUrlFromId,
+  c as getLoomIdFromUrl,
+  x as getProviderFromUrl,
+  h as getSpotifyEmbedUrlFromIdAndType,
+  b as getSpotifyIdAndTypeFromUrl,
+  z as getVimeoEmbedUrlFromId,
+  g as getVimeoIdFromUrl,
+  T as getWistiaEmbedUrlFromId,
+  s as getWistiaIdFromUrl,
+  u as getYouTubeEmbedUrlFromId,
+  d as getYouTubeIdFromUrl,
+  S as isValidUrl,
+  $ as loomUrlRegex,
+  f as spotifySymbolRegex,
+  w as spotifyUrlRegex,
+  U as vimeoUrlRegex,
+  v as wistiaUrlRegex,
+  a as youTubeUrlRegex
 };

dist/providers/generic.d.ts

@@ -1,3 +0,2 @@
-export declare const genericUrlRegex: RegExp;
-export declare const isValidUrl: (value: string) => boolean;
+export declare const isValidUrl: (url: string) => boolean;
 //# sourceMappingURL=generic.d.ts.map

dist/providers/youtube.d.ts

 /**
  * Regex matcher for YouTube URLs
  */
-export declare const youTubeUrlRegex = "^(?:(?:https?):)?(?://)?[^/]*(?:youtube(?:-nocookie)?.com|youtu.be).*[=/]([-\\w]{11})(?:\\?|=|&|$)";
+export declare const youTubeUrlRegex: RegExp;
 export declare const getYouTubeIdFromUrl: (url: string | undefined) => string;
 export declare const getYouTubeEmbedUrlFromId: (id: string | undefined) => string;
 //# sourceMappingURL=youtube.d.ts.map

package.json

 {
   "name": "@social-embed/lib",
-  "description": "Regexes, ID extraction, for embed providers (YouTube, other OEmbed compatible providers),",
-  "version": "0.1.0-next.5",
+  "description": "URL detection and parsing for embed providers (YouTube, other OEmbed compatible providers),",
+  "version": "0.1.0-next.7",
   "main": "dist/lib.umd.cjs",
@@ -54,5 +54,6 @@ "module": "dist/lib.js",
   "devDependencies": {
-    "typescript": "^5.2.2",
-    "vite": "^4.4.11",
-    "vite-plugin-dts": "^3.6.0",
+    "eslint-plugin-redos-detector": "^2.4.0",
+    "typescript": "^5.3.2",
+    "vite": "^5.0.2",
+    "vite-plugin-dts": "^3.6.3",
     "vitest": "^0.34.6"
@@ -59,0 +60,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

22358

increased by1.95%

Worsened metrics

Dev dependency count

5

increased by25%

Lines of code

259

decreased by-0.38%

No dependency changes