@webdav-server/javascript - npm Package Compare versions

Comparing version 1.0.1 to 1.1.0

lib/JavascriptFileSystem.js

@@ -17,9 +17,20 @@ "use strict";
 var child_process_1 = require("child_process");
+var JavascriptFileSystemOptionsDefaults = (function () {
+    function JavascriptFileSystemOptionsDefaults() {
+        this.useEval = false;
+        this.disableSourceReading = false;
+    }
+    return JavascriptFileSystemOptionsDefaults;
+}());
 var JavascriptFileSystem = (function (_super) {
     __extends(JavascriptFileSystem, _super);
-    function JavascriptFileSystem(useEval, currentWorkingDirectory) {
-        if (useEval === void 0) { useEval = false; }
+    function JavascriptFileSystem(options) {
         var _this = _super.call(this, new JavascriptSerializer_1.JavascriptSerializer()) || this;
-        _this.useEval = useEval;
-        _this.currentWorkingDirectory = currentWorkingDirectory;
+        _this.options = options;
+        var defaultValues = new JavascriptFileSystemOptionsDefaults();
+        for (var _i = 0, _a = Object.keys(defaultValues); _i < _a.length; _i++) {
+            var name_1 = _a[_i];
+            if (_this.options[name_1] === undefined)
+                _this.options[name_1] = defaultValues[name_1];
+        }
         return _this;
@@ -32,5 +43,5 @@ }
                 return callback(e);
-            if (ctx.targetSource)
+            if (ctx.targetSource && !_this.options.disableSourceReading)
                 return callback(e, rStream);
-            if (_this.useEval) {
+            if (_this.options.useEval) {
                 var data_1 = '';
@@ -69,3 +80,3 @@ rStream.on('data', function (chunk) {
             var p = child_process_1.spawn('node', [], {
-                cwd: _this.currentWorkingDirectory
+                cwd: _this.options.currentWorkingDirectory
             });
@@ -72,0 +83,0 @@ if (!p.pid)

lib/JavascriptSerializer.js

@@ -27,4 +27,3 @@ "use strict";
                 return callback(e);
-            data.currentWorkingDirectory = fs.currentWorkingDirectory;
-            data.useEval = fs.useEval;
+            data.options = fs.options;
             callback(null, data);
@@ -38,3 +37,7 @@ });
                 return callback(e);
-            var ffs = new JavascriptFileSystem_1.JavascriptFileSystem(serializedData.useEval, serializedData.currentWorkingDirectory);
+            var options = serializedData.useEval !== undefined ? {
+                useEval: serializedData.useEval,
+                currentWorkingDirectory: serializedData.currentWorkingDirectory
+            } : serializedData.options;
+            var ffs = new JavascriptFileSystem_1.JavascriptFileSystem(options);
             for (var name_1 in fs)
@@ -41,0 +44,0 @@ ffs[name_1] = fs[name_1];

package.json

@@ -15,3 +15,3 @@ {
   ],
-  "version": "1.0.1",
+  "version": "1.1.0",
   "author": "Adrien Castex <[e-mail]>",
@@ -18,0 +18,0 @@ "license": "Unlicense",

README.md

@@ -19,2 +19,10 @@ # Javascript File System for webdav-server
 
+## Options
+
+Name | Type | Optional | Description
+-|-|-
+useEval | boolean | false | 
+currentWorkingDirectory | string | true | 
+disableSourceReading | boolean | true | 
+
 ## Usage
@@ -41,4 +49,8 @@
 
-const jsFileSystemEval = new js.JavascriptFileSystem(true);
-const jsFileSystemExec = new js.JavascriptFileSystem(false);
+const jsFileSystemEval = new js.JavascriptFileSystem({
+    useEval: true
+});
+const jsFileSystemExec = new js.JavascriptFileSystem({
+    useEval: false
+});
 
@@ -45,0 +57,0 @@ server.setFileSystemSync('/eval', jsFileSystemEval, false);

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

AI-detected potential malware

Supply chain risk

AI has identified this package as malware. This is a strong signal that the package may be malicious.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

10302

8.49%

Lines of code

148

10.45%

Number of lines in readme file

94

14.63%

Number of high supply chain risk alerts

0

-100%

No dependency changes