bson - npm Package Compare versions

Comparing version 4.4.1 to 4.5.0

bower.json

@@ -25,3 +25,3 @@ {
   ],
-  "version": "4.4.1"
+  "version": "4.5.0"
 }

bson.d.ts

@@ -791,3 +791,3 @@ import { Buffer } from 'buffer';
 /** @public */
-export declare type LongWithoutOverrides = new (low: number | Long, high?: number, unsigned?: boolean) => {
+export declare type LongWithoutOverrides = new (low: unknown, high?: number, unsigned?: boolean) => {
     [P in Exclude<keyof Long, TimestampOverrides>]: Long[P];
@@ -954,8 +954,15 @@ };
      */
-    constructor(low: Long);
+    constructor(long: Long);
     /**
+     * @param value - A pair of two values indicating timestamp and increment.
+     */
+    constructor(value: {
+        t: number;
+        i: number;
+    });
+    /**
      * @param low - the low (signed) 32 bits of the Timestamp.
      * @param high - the high (signed) 32 bits of the Timestamp.
+     * @deprecated Please use `Timestamp({ t: high, i: low })` or `Timestamp(Long(low, high))` instead.
      */
-    constructor(low: Long);
     constructor(low: number, high: number);
@@ -962,0 +969,0 @@ toJSON(): {

lib/bson.js

@@ -158,3 +158,3 @@ "use strict";
     if (options === void 0) { options = {}; }
-    return deserializer_1.deserialize(ensure_buffer_1.ensureBuffer(buffer), options);
+    return deserializer_1.deserialize(buffer instanceof buffer_1.Buffer ? buffer : ensure_buffer_1.ensureBuffer(buffer), options);
 }
@@ -161,0 +161,0 @@ exports.deserialize = deserialize;

lib/decimal128.js

@@ -15,55 +15,10 @@ "use strict";
 var NAN_BUFFER = [
-    0x7c,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00
+    0x7c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
 // Infinity value bits 32 bit values (due to lack of longs)
 var INF_NEGATIVE_BUFFER = [
-    0xf8,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00
+    0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
 var INF_POSITIVE_BUFFER = [
-    0x78,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00,
-    0x00
+    0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
@@ -70,0 +25,0 @@ var EXPONENT_REGEX = /^([-+])?(\d+)?$/;

lib/map.js

@@ -6,20 +6,8 @@ "use strict";
 exports.Map = void 0;
+var global_1 = require("./utils/global");
 /** @public */
 var bsonMap;
 exports.Map = bsonMap;
-var check = function (potentialGlobal) {
-    // eslint-disable-next-line eqeqeq
-    return potentialGlobal && potentialGlobal.Math == Math && potentialGlobal;
-};
-// https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
-function getGlobal() {
-    // eslint-disable-next-line no-undef
-    return (check(typeof globalThis === 'object' && globalThis) ||
-        check(typeof window === 'object' && window) ||
-        check(typeof self === 'object' && self) ||
-        check(typeof global === 'object' && global) ||
-        Function('return this')());
-}
-var bsonGlobal = getGlobal();
-if (Object.prototype.hasOwnProperty.call(bsonGlobal, 'Map')) {
+var bsonGlobal = global_1.getGlobal();
+if (bsonGlobal.Map) {
     exports.Map = bsonMap = bsonGlobal.Map;
@@ -26,0 +14,0 @@ }

lib/parser/deserializer.js

@@ -52,2 +52,3 @@ "use strict";
 exports.deserialize = deserialize;
+var allowedDBRefKeys = /^\$ref$|^\$id$|^\$db$/;
 function deserializeObject(buffer, index, options, isArray) {
@@ -81,2 +82,3 @@ if (isArray === void 0) { isArray = false; }
     var done = false;
+    var isPossibleDBRef = isArray ? false : null;
     // While we have more left data left keep parsing
@@ -99,2 +101,5 @@ while (!done) {
         var name = isArray ? arrayIndex++ : buffer.toString('utf8', index, i);
+        if (isPossibleDBRef !== false && name[0] === '$') {
+            isPossibleDBRef = allowedDBRefKeys.test(name);
+        }
         var value = void 0;
@@ -111,6 +116,11 @@ index = i + 1;
                 throw new Error('bad string length in bson');
-            if (!validate_utf8_1.validateUtf8(buffer, index, index + stringSize - 1)) {
-                throw new Error('Invalid UTF-8 string in BSON document');
+            value = buffer.toString('utf8', index, index + stringSize - 1);
+            for (var i_1 = 0; i_1 < value.length; i_1++) {
+                if (value.charCodeAt(i_1) === 0xfffd) {
+                    if (!validate_utf8_1.validateUtf8(buffer, index, index + stringSize - 1)) {
+                        throw new Error('Invalid UTF-8 string in BSON document');
+                    }
+                    break;
+                }
             }
-            value = buffer.toString('utf8', index, index + stringSize - 1);
             index = index + stringSize;
@@ -545,11 +555,4 @@ }
     }
-    // check if object's $ keys are those of a DBRef
-    var dollarKeys = Object.keys(object).filter(function (k) { return k.startsWith('$'); });
-    var valid = true;
-    dollarKeys.forEach(function (k) {
-        if (['$ref', '$id', '$db'].indexOf(k) === -1)
-            valid = false;
-    });
-    // if a $key not in "$ref", "$id", "$db", don't make a DBRef
-    if (!valid)
+    // if we did not find "$ref", "$id", "$db", or found an extraneous $key, don't make a DBRef
+    if (!isPossibleDBRef)
         return object;
@@ -556,0 +559,0 @@ if (db_ref_1.isDBRefLike(object)) {

lib/parser/utils.js

@@ -5,2 +5,3 @@ "use strict";
 var buffer_1 = require("buffer");
+var global_1 = require("../utils/global");
 /**
@@ -14,7 +15,10 @@ * Normalizes our expected stringified form of a function across versions of node
 exports.normalizedFunctionString = normalizedFunctionString;
-var isReactNative = typeof global.navigator === 'object' && global.navigator.product === 'ReactNative';
-var insecureWarning = isReactNative
-    ? 'BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values.'
-    : 'BSON: No cryptographic implementation for random bytes present, falling back to a less secure implementation.';
+function isReactNative() {
+    var g = global_1.getGlobal();
+    return typeof g.navigator === 'object' && g.navigator.product === 'ReactNative';
+}
 var insecureRandomBytes = function insecureRandomBytes(size) {
+    var insecureWarning = isReactNative()
+        ? 'BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values.'
+        : 'BSON: No cryptographic implementation for random bytes present, falling back to a less secure implementation.';
     console.warn(insecureWarning);
@@ -94,3 +98,5 @@ var result = buffer_1.Buffer.alloc(size);
 function deprecate(fn, message) {
-    if (typeof window === 'undefined' && typeof self === 'undefined') {
+    if (typeof require === 'function' &&
+        typeof window === 'undefined' &&
+        typeof self === 'undefined') {
         // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -97,0 +103,0 @@ return require('util').deprecate(fn, message);

lib/timestamp.js

@@ -20,2 +20,3 @@ "use strict";
 var long_1 = require("./long");
+var utils_1 = require("./parser/utils");
 /** @public */
@@ -35,2 +36,5 @@ exports.LongWithoutOverridesClass = long_1.Long;
         }
+        else if (utils_1.isObjectLike(low) && typeof low.t !== 'undefined' && typeof low.i !== 'undefined') {
+            _this = _super.call(this, low.i, low.t, true) || this;
+        }
         else {
@@ -84,3 +88,3 @@ _this = _super.call(this, low, high, true) || this;
     Timestamp.fromExtendedJSON = function (doc) {
-        return new Timestamp(doc.$timestamp.i, doc.$timestamp.t);
+        return new Timestamp(doc.$timestamp);
     };
@@ -92,3 +96,3 @@ /** @internal */
     Timestamp.prototype.inspect = function () {
-        return "new Timestamp(" + this.getLowBits().toString() + ", " + this.getHighBits().toString() + ")";
+        return "new Timestamp({ t: " + this.getHighBits() + ", i: " + this.getLowBits() + " })";
     };
@@ -95,0 +99,0 @@ Timestamp.MAX_VALUE = long_1.Long.MAX_UNSIGNED_VALUE;

package.json

@@ -18,4 +18,7 @@ {
   "types": "bson.d.ts",
-  "version": "4.4.1",
-  "author": "Christian Amor Kvalheim <[e-mail]>",
+  "version": "4.5.0",
+  "author": {
+    "name": "The MongoDB NodeJS Team",
+    "email": "[e-mail]"
+  },
   "license": "Apache-2.0",
@@ -25,4 +28,3 @@ "contributors": [],
   "bugs": {
-    "mail": "[e-mail]",
-    "url": "https://github.com/mongodb/js-bson/issues"
+    "url": "https://jira.mongodb.org/projects/NODE/issues/"
   },
@@ -48,3 +50,3 @@ "devDependencies": {
     "eslint-plugin-tsdoc": "^0.2.6",
-    "karma": "^5.1.1",
+    "karma": "^6.3.4",
     "karma-chai": "^0.1.0",
@@ -62,5 +64,5 @@ "karma-chrome-launcher": "^3.1.0",
     "rollup-plugin-commonjs": "^10.1.0",
-    "rollup-plugin-node-builtins": "^2.1.2",
     "rollup-plugin-node-globals": "^1.4.0",
     "rollup-plugin-node-polyfills": "^0.2.1",
+    "rollup-plugin-polyfill-node": "^0.7.0",
     "standard-version": "^9.3.0",
@@ -67,0 +69,0 @@ "ts-node": "^9.0.0",

src/bson.ts

@@ -219,3 +219,3 @@ import { Buffer } from 'buffer';
 ): Document {
-  return internalDeserialize(ensureBuffer(buffer), options);
+  return internalDeserialize(buffer instanceof Buffer ? buffer : ensureBuffer(buffer), options);
 }
@@ -222,0 +222,0 @@

src/decimal128.ts

@@ -15,55 +15,10 @@ import { Buffer } from 'buffer';
 const NAN_BUFFER = [
-  0x7c,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00
+  0x7c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
 // Infinity value bits 32 bit values (due to lack of longs)
 const INF_NEGATIVE_BUFFER = [
-  0xf8,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00
+  0xf8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
 const INF_POSITIVE_BUFFER = [
-  0x78,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00,
-  0x00
+  0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 ].reverse();
@@ -70,0 +25,0 @@

src/long.ts

@@ -30,3 +30,3 @@ import type { EJSONOptions } from './extended_json';
 try {
-  wasm = (new WebAssembly.Instance(
+  wasm = new WebAssembly.Instance(
     new WebAssembly.Module(
@@ -37,3 +37,3 @@ // prettier-ignore
     {}
-  ).exports as unknown) as LongWASMHelpers;
+  ).exports as unknown as LongWASMHelpers;
 } catch {
@@ -40,0 +40,0 @@ // no wasm support

src/map.ts

 /* eslint-disable @typescript-eslint/no-explicit-any */
 // We have an ES6 Map available, return the native instance
 
-/* We do not want to have to include DOM types just for this check */
-declare const window: unknown;
-declare const self: unknown;
-declare const global: unknown;
+import { getGlobal } from './utils/global';
 
@@ -12,25 +9,8 @@ /** @public */
 
-const check = function (potentialGlobal: any) {
-  // eslint-disable-next-line eqeqeq
-  return potentialGlobal && potentialGlobal.Math == Math && potentialGlobal;
-};
-
-// https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
-function getGlobal() {
-  // eslint-disable-next-line no-undef
-  return (
-    check(typeof globalThis === 'object' && globalThis) ||
-    check(typeof window === 'object' && window) ||
-    check(typeof self === 'object' && self) ||
-    check(typeof global === 'object' && global) ||
-    Function('return this')()
-  );
-}
-
-const bsonGlobal = getGlobal();
-if (Object.prototype.hasOwnProperty.call(bsonGlobal, 'Map')) {
+const bsonGlobal = getGlobal<{ Map?: MapConstructor }>();
+if (bsonGlobal.Map) {
   bsonMap = bsonGlobal.Map;
 } else {
   // We will return a polyfill
-  bsonMap = (class Map {
+  bsonMap = class Map {
     private _keys: string[];
@@ -137,5 +117,5 @@ private _values: Record<string, any>;
     }
-  } as unknown) as MapConstructor;
+  } as unknown as MapConstructor;
 }
 
 export { bsonMap as Map };

src/parser/deserializer.ts

@@ -96,2 +96,4 @@ import { Buffer } from 'buffer';
 
+const allowedDBRefKeys = /^\$ref$|^\$id$|^\$db$/;
+
 function deserializeObject(
@@ -138,2 +140,4 @@ buffer: Buffer,
 
+  let isPossibleDBRef = isArray ? false : null;
+
   // While we have more left data left keep parsing
@@ -157,2 +161,5 @@ while (!done) {
     const name = isArray ? arrayIndex++ : buffer.toString('utf8', index, i);
+    if (isPossibleDBRef !== false && (name as string)[0] === '$') {
+      isPossibleDBRef = allowedDBRefKeys.test(name as string);
+    }
     let value;
@@ -175,8 +182,13 @@
 
-      if (!validateUtf8(buffer, index, index + stringSize - 1)) {
-        throw new Error('Invalid UTF-8 string in BSON document');
+      value = buffer.toString('utf8', index, index + stringSize - 1);
+
+      for (let i = 0; i < value.length; i++) {
+        if (value.charCodeAt(i) === 0xfffd) {
+          if (!validateUtf8(buffer, index, index + stringSize - 1)) {
+            throw new Error('Invalid UTF-8 string in BSON document');
+          }
+          break;
+        }
       }
 
-      value = buffer.toString('utf8', index, index + stringSize - 1);
-
       index = index + stringSize;
@@ -253,5 +265,7 @@ } else if (elementType === constants.BSON_DATA_OID) {
         for (const n in options) {
-          (arrayOptions as {
-            [key: string]: DeserializeOptions[keyof DeserializeOptions];
-          })[n] = options[n as keyof DeserializeOptions];
+          (
+            arrayOptions as {
+              [key: string]: DeserializeOptions[keyof DeserializeOptions];
+            }
+          )[n] = options[n as keyof DeserializeOptions];
         }
@@ -631,12 +645,5 @@ arrayOptions['raw'] = true;
 
-  // check if object's $ keys are those of a DBRef
-  const dollarKeys = Object.keys(object).filter(k => k.startsWith('$'));
-  let valid = true;
-  dollarKeys.forEach(k => {
-    if (['$ref', '$id', '$db'].indexOf(k) === -1) valid = false;
-  });
+  // if we did not find "$ref", "$id", "$db", or found an extraneous $key, don't make a DBRef
+  if (!isPossibleDBRef) return object;
 
-  // if a $key not in "$ref", "$id", "$db", don't make a DBRef
-  if (!valid) return object;
-
   if (isDBRefLike(object)) {
@@ -643,0 +650,0 @@ const copy = Object.assign({}, object) as Partial<DBRefLike>;

src/parser/utils.ts

 import { Buffer } from 'buffer';
+import { getGlobal } from '../utils/global';
 
@@ -13,10 +14,11 @@ type RandomBytesFunction = (size: number) => Uint8Array;
 
-const isReactNative =
-  typeof global.navigator === 'object' && global.navigator.product === 'ReactNative';
+function isReactNative() {
+  const g = getGlobal<{ navigator?: { product?: string } }>();
+  return typeof g.navigator === 'object' && g.navigator.product === 'ReactNative';
+}
 
-const insecureWarning = isReactNative
-  ? 'BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values.'
-  : 'BSON: No cryptographic implementation for random bytes present, falling back to a less secure implementation.';
-
 const insecureRandomBytes: RandomBytesFunction = function insecureRandomBytes(size: number) {
+  const insecureWarning = isReactNative()
+    ? 'BSON: For React Native please polyfill crypto.getRandomValues, e.g. using: https://www.npmjs.com/package/react-native-get-random-values.'
+    : 'BSON: No cryptographic implementation for random bytes present, falling back to a less secure implementation.';
   console.warn(insecureWarning);
@@ -113,3 +115,7 @@
 export function deprecate<T extends Function>(fn: T, message: string): T {
-  if (typeof window === 'undefined' && typeof self === 'undefined') {
+  if (
+    typeof require === 'function' &&
+    typeof window === 'undefined' &&
+    typeof self === 'undefined'
+  ) {
     // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -126,3 +132,3 @@ return require('util').deprecate(fn, message);
   }
-  return (deprecated as unknown) as T;
+  return deprecated as unknown as T;
 }

src/regexp.ts

@@ -76,3 +76,3 @@ import type { EJSONOptions } from './extended_json';
         if (doc.$regex._bsontype === 'BSONRegExp') {
-          return (doc as unknown) as BSONRegExp;
+          return doc as unknown as BSONRegExp;
         }
@@ -79,0 +79,0 @@ } else {

src/timestamp.ts

 import { Long } from './long';
+import { isObjectLike } from './parser/utils';
 
@@ -6,7 +7,8 @@ /** @public */
 /** @public */
-export type LongWithoutOverrides = new (low: number | Long, high?: number, unsigned?: boolean) => {
+export type LongWithoutOverrides = new (low: unknown, high?: number, unsigned?: boolean) => {
   [P in Exclude<keyof Long, TimestampOverrides>]: Long[P];
 };
 /** @public */
-export const LongWithoutOverridesClass: LongWithoutOverrides = (Long as unknown) as LongWithoutOverrides;
+export const LongWithoutOverridesClass: LongWithoutOverrides =
+  Long as unknown as LongWithoutOverrides;
 
@@ -30,10 +32,14 @@ /** @public */
    */
-  constructor(low: Long);
+  constructor(long: Long);
   /**
+   * @param value - A pair of two values indicating timestamp and increment.
+   */
+  constructor(value: { t: number; i: number });
+  /**
    * @param low - the low (signed) 32 bits of the Timestamp.
    * @param high - the high (signed) 32 bits of the Timestamp.
+   * @deprecated Please use `Timestamp({ t: high, i: low })` or `Timestamp(Long(low, high))` instead.
    */
-  constructor(low: Long);
   constructor(low: number, high: number);
-  constructor(low: number | Long, high?: number) {
+  constructor(low: number | Long | { t: number; i: number }, high?: number) {
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
@@ -45,2 +51,4 @@ ///@ts-expect-error
       super(low.low, low.high, true);
+    } else if (isObjectLike(low) && typeof low.t !== 'undefined' && typeof low.i !== 'undefined') {
+      super(low.i, low.t, true);
     } else {
@@ -100,3 +108,3 @@ super(low, high, true);
   static fromExtendedJSON(doc: TimestampExtended): Timestamp {
-    return new Timestamp(doc.$timestamp.i, doc.$timestamp.t);
+    return new Timestamp(doc.$timestamp);
   }
@@ -110,4 +118,4 @@
   inspect(): string {
-    return `new Timestamp(${this.getLowBits().toString()}, ${this.getHighBits().toString()})`;
+    return `new Timestamp({ t: ${this.getHighBits()}, i: ${this.getLowBits()} })`;
   }
 }

src/uuid_utils.ts

 import { Buffer } from 'buffer';
 
 // Validation regex for v4 uuid (validates with or without dashes)
-const VALIDATION_REGEX = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|[0-9a-f]{12}4[0-9a-f]{3}[89ab][0-9a-f]{15})$/i;
+const VALIDATION_REGEX =
+  /^(?:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|[0-9a-f]{12}4[0-9a-f]{3}[89ab][0-9a-f]{15})$/i;
 
@@ -6,0 +7,0 @@ export const uuidValidateString = (str: string): boolean =>

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Number of package files

95

increased by2.15%

Worsened metrics

Total package byte prevSize

2836832

decreased by-14.36%

Lines of code

38868

decreased by-11.81%

Number of medium supply chain risk alerts

16

increased by166.67%

No dependency changes