json-refs - npm Package Compare versions

Comparing version 3.0.13 to 3.0.14

index.d.ts

@@ -18,3 +18,3 @@ /**
      */
-    export function decodePath(path: string[]): string;
+    export function decodePath(path: string[]): string[];
 
@@ -28,3 +28,3 @@ /**
      */
-    export function encodePath(path: string[]): string;
+    export function encodePath(path: string[]): string[];
 
@@ -31,0 +31,0 @@ /**

index.js

@@ -343,3 +343,3 @@ /*
       // Do not process directly-circular references (to an ancestor or self)
-      if (refKey.indexOf(refdKey + '/') === 0) {
+      if (refKey.indexOf(refdKey + '/') === 0 || refKey === refdKey) {
         refDetails.circular = true;
@@ -653,3 +653,2 @@
       var cOptions = _.cloneDeep(options);
-      var uriDetails = parseURI(options.location);
 
@@ -671,8 +670,2 @@ if (_.isUndefined(cacheEntry.refs)) {
 
-      if (!_.isUndefined(uriDetails.fragment)) {
-        cOptions.subDocPath = pathFromPtr(decodeURI(uriDetails.fragment));
-      } else if (!_.isUndefined(uriDetails.subDocPath)) {
-        cOptions.subDocPath = options.subDocPath;
-      }
-
       // This will use the cache so don't worry about calling it twice
@@ -690,3 +683,3 @@ return {
   var details = {
-    def: obj
+    def: _.cloneDeep(obj)
   };
@@ -698,41 +691,40 @@ var cacheKey;
   try {
-    if (isRefLike(obj, true)) {
-      cacheKey = obj.$ref;
-      uriDetails = uriDetailsCache[cacheKey];
+    // This will throw so the result doesn't matter
+    isRefLike(obj, true);
 
-      if (_.isUndefined(uriDetails)) {
-        uriDetails = uriDetailsCache[cacheKey] = parseURI(cacheKey);
-      }
+    cacheKey = obj.$ref;
+    uriDetails = uriDetailsCache[cacheKey];
 
-      details.uri = cacheKey;
-      details.uriDetails = uriDetails;
+    if (_.isUndefined(uriDetails)) {
+      uriDetails = uriDetailsCache[cacheKey] = parseURI(cacheKey);
+    }
 
-      if (_.isUndefined(uriDetails.error)) {
-        details.type = getRefType(details);
+    details.uri = cacheKey;
+    details.uriDetails = uriDetails;
 
-        // Validate the JSON Pointer
-        try {
-          if (['#', '/'].indexOf(cacheKey[0]) > -1) {
-            isPtr(cacheKey, true);
-          } else if (cacheKey.indexOf('#') > -1) {
-            isPtr(uriDetails.fragment, true);
-          }
-        } catch (err) {
-          details.error = err.message;
-          details.type = 'invalid';
+    if (_.isUndefined(uriDetails.error)) {
+      details.type = getRefType(details);
+
+      // Validate the JSON Pointer
+      try {
+        if (['#', '/'].indexOf(cacheKey[0]) > -1) {
+          isPtr(cacheKey, true);
+        } else if (cacheKey.indexOf('#') > -1) {
+          isPtr(uriDetails.fragment, true);
         }
-      } else {
-        details.error = details.uriDetails.error;
+      } catch (err) {
+        details.error = err.message;
         details.type = 'invalid';
       }
-
-      // Identify warning
-      extraKeys = getExtraRefKeys(obj);
-
-      if (extraKeys.length > 0) {
-        details.warning = 'Extra JSON Reference properties will be ignored: ' + extraKeys.join(', ');
-      }
     } else {
+      details.error = details.uriDetails.error;
       details.type = 'invalid';
     }
+
+    // Identify warning
+    extraKeys = getExtraRefKeys(obj);
+
+    if (extraKeys.length > 0) {
+      details.warning = 'Extra JSON Reference properties will be ignored: ' + extraKeys.join(', ');
+    }
   } catch (err) {
@@ -778,3 +770,3 @@ details.error = err.message;
 function isRef (obj, throwWithDetails) {
-  return isRefLike(obj, throwWithDetails) && getRefDetails(obj, throwWithDetails).type !== 'invalid';
+  return isRefLike(obj, throwWithDetails) && getRefDetails(obj).type !== 'invalid';
 }
@@ -930,3 +922,3 @@
             if (!options.resolveCirculars && refDetails.circular) {
-              refDetails.value = refDetails.def;
+              refDetails.value = _.cloneDeep(refDetails.def);
             } else {
@@ -1019,7 +1011,7 @@ try {
             var nSeg = uriSegments[uriSegments.length - time - 1];
+            var pSeg = uriSegments[uriSegments.length - time];
             var fqSegIndex = fqURISegments.length - time - 1;
-            var fqSeg = fqURISegments[fqSegIndex];
 
-            if (nSeg === '.' || nSeg === '..') {
-              nSeg = fqSeg;
+            if (nSeg === '.' || nSeg === '..' || pSeg === '..') {
+              return;
             }
@@ -1053,6 +1045,13 @@
       // Sanitize the reference details
-      _.forOwn(results.refs, function (refDetails) {
+      _.forOwn(allRefs, function (refDetails, refPtr) {
         // Delete the reference id used for dependency tracking and circular identification
         delete refDetails.refdId;
 
+        // For locally-circular references, update the $ref to be fully qualified (Issue #175)
+        if (refDetails.circular && refDetails.type === 'local') {
+          refDetails.value.$ref = refDetails.fqURI;
+
+          setValue(results.docs[fullLocation], pathFromPtr(refPtr), refDetails.value);
+        }
+
         // To avoid the error message being URI encoded/decoded by mistake, replace the current JSON Pointer with the
@@ -1099,11 +1098,3 @@ // value in the JSON Reference definition.
     .then(function (res) {
-      var cOptions = _.cloneDeep(options);
-      var uriDetails = parseURI(options.location);
-
-      // Set the sub document path if necessary
-      if (!_.isUndefined(uriDetails.fragment)) {
-        cOptions.subDocPath = pathFromPtr(decodeURI(uriDetails.fragment));
-      }
-
-      return resolveRefs(res, cOptions)
+      return resolveRefs(res, options)
         .then(function (res2) {
@@ -1147,3 +1138,3 @@ return {
  *
- * @returns {string} the array of path segments with their JSON Pointer tokens decoded
+ * @returns {string[]} the array of path segments with their JSON Pointer tokens decoded
  *
@@ -1163,3 +1154,3 @@ * @throws {Error} if the path is not an `Array`
  *
- * @returns {string} the array of path segments with their JSON Pointer tokens encoded
+ * @returns {string[]} the array of path segments with their JSON Pointer tokens encoded
  *
@@ -1166,0 +1157,0 @@ * @throws {Error} if the path is not an `Array`

package.json

 {
   "name": "json-refs",
-  "version": "3.0.13",
+  "version": "3.0.14",
   "description": "Various utilities for JSON References (http://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03).",
@@ -42,40 +42,40 @@ "main": "index.js",
   "devDependencies": {
-    "@babel/core": "^7.2.2",
-    "@babel/preset-env": "^7.2.3",
+    "@babel/core": "^7.8.4",
+    "@babel/preset-env": "^7.8.4",
     "@otris/jsdoc-tsd": "^1.0.4",
-    "babel-loader": "^8.0.5",
-    "brfs": "~2.0.1",
-    "connect": "^3.6.6",
-    "del": "^3.0.0",
+    "babel-loader": "^8.0.6",
+    "brfs": "~2.0.2",
+    "connect": "^3.7.0",
+    "del": "^5.1.0",
     "gulp": "~3.9.1",
     "gulp-concat": "^2.6.1",
-    "gulp-eslint": "^5.0.0",
+    "gulp-eslint": "^6.0.0",
     "gulp-istanbul": "~1.1.3",
     "gulp-jsdoc-to-markdown": "^1.2.2",
     "gulp-jsdoc3": "^2.0.0",
-    "gulp-load-plugins": "^1.5.0",
+    "gulp-load-plugins": "^2.0.2",
     "gulp-mocha": "~3.0.1",
     "gulp-replace": "^1.0.0",
     "jsdoc": "^3.5.5",
-    "karma": "^3.1.4",
+    "karma": "^4.4.1",
     "karma-mocha": "^1.3.0",
     "karma-mocha-reporter": "^2.2.5",
     "karma-phantomjs-launcher": "^1.0.4",
-    "karma-webpack": "^4.0.0-rc.5",
-    "mocha": "^4.0.1",
+    "karma-webpack": "^4.0.2",
+    "mocha": "^7.0.1",
     "phantomjs-prebuilt": "^2.1.16",
     "run-sequence": "^2.2.1",
     "transform-loader": "^0.2.4",
-    "webpack": "^4.28.1"
+    "webpack": "^4.41.6"
   },
   "dependencies": {
-    "commander": "~2.19.0",
-    "graphlib": "^2.1.7",
-    "js-yaml": "^3.13.0",
-    "lodash": "^4.17.11",
+    "commander": "~4.1.1",
+    "graphlib": "^2.1.8",
+    "js-yaml": "^3.13.1",
+    "lodash": "^4.17.15",
     "native-promise-only": "^0.8.1",
     "path-loader": "^1.0.10",
-    "slash": "^2.0.0",
+    "slash": "^3.0.0",
     "uri-js": "^4.2.2"
   }
 }

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

3221332

0.36%

Lines of code

24766

0.26%

Number of low supply chain risk alerts

12

-29.41%

Number of medium supply chain risk alerts

4

-20%

Dependency changes

• + Added

  commander@4.1.1
  (transitive)

• + Added

  slash@3.0.0
  (transitive)

• - Removed

  commander@2.19.0
  (transitive)

• - Removed

  slash@2.0.0
  (transitive)

• Updated

  commander@~4.1.1

• Updated

  graphlib@^2.1.8

• Updated

  js-yaml@^3.13.1

• Updated

  lodash@^4.17.15

• Updated

  slash@^3.0.0