find-my-way - npm Package Compare versions

Comparing version 8.2.0 to 8.2.1

index.js

@@ -195,2 +195,4 @@ 'use strict'
       let isRegexNode = false
+      let isParamSafe = true
+      let backtrack = ''
       const regexps = []
@@ -223,4 +225,6 @@
             j = endOfRegexIndex + 1
+            isParamSafe = true
           } else {
-            regexps.push('(.*?)')
+            regexps.push(isParamSafe ? '(.*?)' : `(${backtrack}|(?:(?!${backtrack}).)*)`)
+            isParamSafe = false
           }
@@ -243,3 +247,3 @@
             staticPart = staticPart.split('%').join('%25')
-            regexps.push(escapeRegExp(staticPart))
+            regexps.push(backtrack = escapeRegExp(staticPart))
           }
@@ -341,2 +345,4 @@
       let isRegexNode = false
+      let isParamSafe = true
+      let backtrack = ''
       const regexps = []
@@ -351,2 +357,3 @@
         const isEndOfNode = charCode === 47 || j === pattern.length
+
         if (isRegexParam || isStaticPart || isEndOfNode) {
@@ -369,4 +376,6 @@ const paramName = pattern.slice(lastParamStartIndex, j)
             j = endOfRegexIndex + 1
+            isParamSafe = false
           } else {
-            regexps.push('(.*?)')
+            regexps.push(isParamSafe ? '(.*?)' : `(${backtrack}|(?:(?!${backtrack}).)*)`)
+            isParamSafe = false
           }
@@ -389,3 +398,3 @@
             staticPart = staticPart.split('%').join('%25')
-            regexps.push(escapeRegExp(staticPart))
+            regexps.push(backtrack = escapeRegExp(staticPart))
           }
@@ -392,0 +401,0 @@

lib/handler-storage.js

 'use strict'
 
+const { NullObject } = require('./null-object')
 const httpMethodStrategy = require('./strategies/http-method')
@@ -64,7 +65,16 @@
   _compileCreateParamsObject (params) {
-    const lines = []
+    const fnBody = []
+
+    fnBody.push('const fn = function _createParamsObject (paramsArray) {')
+
+    fnBody.push('const params = new NullObject()')
     for (let i = 0; i < params.length; i++) {
-      lines.push(`'${params[i]}': paramsArray[${i}]`)
+      fnBody.push(`params['${params[i]}'] = paramsArray[${i}]`)
     }
-    return new Function('paramsArray', `return {${lines.join(',')}}`)  // eslint-disable-line
+    fnBody.push('return params')
+    fnBody.push('}')
+
+    fnBody.push('return fn')
+
+    return new Function('NullObject', fnBody.join('\n'))(NullObject)  // eslint-disable-line
   }
@@ -71,0 +81,0 @@

lib/strategies/http-method.js

@@ -12,4 +12,5 @@ 'use strict'
   },
-  deriveConstraint: /* istanbul ignore next */ (req) => req.method,
+  /* c8 ignore next 1 */
+  deriveConstraint: (req) => req.method,
   mustMatchWhenDerived: true
 }

package.json

 {
   "name": "find-my-way",
-  "version": "8.2.0",
+  "version": "8.2.1",
   "description": "Crazy fast http radix based router",
@@ -13,3 +13,3 @@ "main": "index.js",
     "test:typescript": "tsd",
-    "test": "standard && tap -J test/*.test.js && npm run test:typescript",
+    "test": "standard && tap --allow-incomplete-coverage test/*.test.js && npm run test:typescript",
     "test:report": "tap -J test/*.test.js --cov --coverage-report=html --coverage-report=cobertura | tee out.tap",
@@ -39,3 +39,3 @@ "test:reporter": "tap-mocha-reporter xunit < out.tap > test/junit-testresults.xml"
   "devDependencies": {
-    "@types/node": "^14.0.27",
+    "@types/node": "^20.0.0",
     "benchmark": "^2.1.4",
@@ -48,6 +48,6 @@ "chalk": "^4.1.2",
     "simple-git": "^3.7.1",
-    "standard": "^14.3.4",
-    "tap": "^16.0.1",
+    "standard": "^17.0.0",
+    "tap": "^21.0.1",
     "tap-mocha-reporter": "^5.0.1",
-    "tsd": "^0.13.1"
+    "tsd": "^0.31.0"
   },
@@ -57,3 +57,3 @@ "dependencies": {
     "fast-querystring": "^1.0.0",
-    "safe-regex2": "^3.1.0"
+    "safe-regex2": "^4.0.0"
   },
@@ -60,0 +60,0 @@ "tsd": {

test/find-route.test.js

@@ -50,3 +50,3 @@ 'use strict'
   t.equal(route.store, store)
-  t.deepEqual(route.params, [])
+  t.same(route.params, [])
 
@@ -84,3 +84,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['param'])
+  t.same(route.params, ['param'])
 
@@ -118,3 +118,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['param'])
+  t.same(route.params, ['param'])
 
@@ -150,3 +150,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['param1'])
+  t.same(route.params, ['param1'])
 
@@ -168,3 +168,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['param1', 'param2'])
+  t.same(route.params, ['param1', 'param2'])
 
@@ -200,3 +200,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['param'])
+  t.same(route.params, ['param'])
 
@@ -232,3 +232,3 @@ equalRouters(t, findMyWay, fundMyWayClone)
   t.equal(route.handler, handler)
-  t.deepEqual(route.params, ['*'])
+  t.same(route.params, ['*'])
 
@@ -235,0 +235,0 @@ equalRouters(t, findMyWay, fundMyWayClone)

test/issue-17.test.js

@@ -135,4 +135,4 @@ 'use strict'
   findMyWay.on('GET', '/a/:p1-:p2', (req, res, params) => {
-    t.equal(params.p1, 'foo')
-    t.equal(params.p2, 'bar-baz')
+    t.equal(params.p1, 'foo-bar')
+    t.equal(params.p2, 'baz')
   })
@@ -139,0 +139,0 @@

test/issue-330.test.js

@@ -152,3 +152,3 @@ const t = require('tap')
   constrainer._buildDeriveConstraints()
-  t.sameStrict(constrainer.deriveSyncConstraints, before)
+  t.same(constrainer.deriveSyncConstraints, before)
 })
@@ -199,9 +199,9 @@
   storage.set('2.0.0')
-  t.sameStrict(storage.maxPatches, { '2.0': 0 })
+  t.same(storage.maxPatches, { '2.0': 0 })
 
   storage.set('2.0.2')
-  t.sameStrict(storage.maxPatches, { '2.0': 2 })
+  t.same(storage.maxPatches, { '2.0': 2 })
 
   storage.set('2.0.1')
-  t.sameStrict(storage.maxPatches, { '2.0': 2 })
+  t.same(storage.maxPatches, { '2.0': 2 })
 })
@@ -233,3 +233,3 @@
   const findMyWay = FindMyWay()
-  t.sameStrict(findMyWay.buildPrettyMeta(), {})
+  t.same(findMyWay.buildPrettyMeta(), {})
 })

test/optional-params.test.js

@@ -71,4 +71,4 @@ 'use strict'
     if (params.p1 && params.p2) {
-      t.equal(params.p1, 'foo')
-      t.equal(params.p2, 'bar-baz')
+      t.equal(params.p1, 'foo-bar')
+      t.equal(params.p2, 'baz')
     }
@@ -75,0 +75,0 @@ })

test/regex.test.js

@@ -258,1 +258,15 @@ 'use strict'
 })
+
+test('prevent back-tracking', (t) => {
+  t.plan(0)
+  t.setTimeout(20)
+
+  const findMyWay = FindMyWay({
+    defaultRoute: () => {
+      t.fail('route not matched')
+    }
+  })
+
+  findMyWay.on('GET', '/:foo-:bar-', (req, res, params) => {})
+  findMyWay.find('GET', '/' + '-'.repeat(16_000) + 'a', { host: 'fastify.io' })
+})

test/types/router.test-d.ts

 import { expectType } from 'tsd'
-import * as Router from '../../'
+import Router from '../../'
 import { Http2ServerRequest, Http2ServerResponse } from 'http2'
@@ -4,0 +4,0 @@ import { IncomingMessage, ServerResponse } from 'http'

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

385804

increased by0.44%

Number of package files

93

increased by1.09%

Lines of code

9610

increased by0.64%

Dependency changes

• + Addedret@0.5.0(transitive)

• + Addedsafe-regex2@4.0.0(transitive)

• - Removedret@0.4.3(transitive)

• - Removedsafe-regex2@3.1.0(transitive)

• Updatedsafe-regex2@^4.0.0