egg-core - npm Package Compare versions

Comparing version 4.24.0 to 4.24.1

History.md

 
+4.24.1 / 2022-06-23
+==================
+
+**fixes**
+  * [[`f8c069b`](http://github.com/eggjs/egg-core/commit/f8c069b0c1e8757ac8ee619c53d2d6f21ccd03db)] - fix: validate plugin.package (#244) (TZ | 天猪 <<[e-mail]>>)
+
 4.24.0 / 2022-06-21
@@ -3,0 +9,0 @@ ==================

lib/loader/mixin/plugin.js

 'use strict';
 
+const assert = require('assert');
 const fs = require('fs');
@@ -334,2 +335,6 @@ const path = require('path');
 
+    if (plugin.package) {
+      assert(isValidatePackageName(plugin.package), `plugin ${plugin.name} invalid, use 'path' instead of package: "${plugin.package}"`);
+    }
+
     const name = plugin.package || plugin.name;
@@ -403,1 +408,9 @@ const lookupDirs = new Set();
 }
+
+function isValidatePackageName(name) {
+  // only check file path style
+  if (name.startsWith('.')) return false;
+  if (name.startsWith('/')) return false;
+  if (name.includes(':')) return false;
+  return true;
+}

package.json

 {
   "name": "egg-core",
-  "version": "4.24.0",
+  "version": "4.24.1",
   "description": "A core Pluggable framework based on koa",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

134660

increased by0.48%

Lines of code

2980

increased by0.37%

No dependency changes