jsonpath-plus - npm Package Compare versions

Comparing version 10.0.5 to 10.0.6

CHANGES.md

 # CHANGES for jsonpath-plus
 
+## 10.0.6
+
+- fix(security): prevent `call`/`apply` invocation of `Function`
+
 ## 10.0.5
@@ -4,0 +8,0 @@

dist/index-browser-esm.min.js

@@ -1,2 +0,2 @@
-class e{static get version(){return"1.3.9"}static toString(){return"JavaScript Expression Parser (JSEP) v"+e.version}static addUnaryOp(t){return e.max_unop_len=Math.max(t.length,e.max_unop_len),e.unary_ops[t]=1,e}static addBinaryOp(t,r,s){return e.max_binop_len=Math.max(t.length,e.max_binop_len),e.binary_ops[t]=r,s?e.right_associative.add(t):e.right_associative.delete(t),e}static addIdentifierChar(t){return e.additional_identifier_chars.add(t),e}static addLiteral(t,r){return e.literals[t]=r,e}static removeUnaryOp(t){return delete e.unary_ops[t],t.length===e.max_unop_len&&(e.max_unop_len=e.getMaxKeyLen(e.unary_ops)),e}static removeAllUnaryOps(){return e.unary_ops={},e.max_unop_len=0,e}static removeIdentifierChar(t){return e.additional_identifier_chars.delete(t),e}static removeBinaryOp(t){return delete e.binary_ops[t],t.length===e.max_binop_len&&(e.max_binop_len=e.getMaxKeyLen(e.binary_ops)),e.right_associative.delete(t),e}static removeAllBinaryOps(){return e.binary_ops={},e.max_binop_len=0,e}static removeLiteral(t){return delete e.literals[t],e}static removeAllLiterals(){return e.literals={},e}get char(){return this.expr.charAt(this.index)}get code(){return this.expr.charCodeAt(this.index)}constructor(e){this.expr=e,this.index=0}static parse(t){return new e(t).parse()}static getMaxKeyLen(e){return Math.max(0,...Object.keys(e).map((e=>e.length)))}static isDecimalDigit(e){return e>=48&&e<=57}static binaryPrecedence(t){return e.binary_ops[t]||0}static isIdentifierStart(t){return t>=65&&t<=90||t>=97&&t<=122||t>=128&&!e.binary_ops[String.fromCharCode(t)]||e.additional_identifier_chars.has(String.fromCharCode(t))}static isIdentifierPart(t){return e.isIdentifierStart(t)||e.isDecimalDigit(t)}throwError(e){const t=new Error(e+" at character "+this.index);throw t.index=this.index,t.description=e,t}runHook(t,r){if(e.hooks[t]){const s={context:this,node:r};return e.hooks.run(t,s),s.node}return r}searchHook(t){if(e.hooks[t]){const r={context:this};return e.hooks[t].find((function(e){return e.call(r.context,r),r.node})),r.node}}gobbleSpaces(){let t=this.code;for(;t===e.SPACE_CODE||t===e.TAB_CODE||t===e.LF_CODE||t===e.CR_CODE;)t=this.expr.charCodeAt(++this.index);this.runHook("gobble-spaces")}parse(){this.runHook("before-all");const t=this.gobbleExpressions(),r=1===t.length?t[0]:{type:e.COMPOUND,body:t};return this.runHook("after-all",r)}gobbleExpressions(t){let r,s,i=[];for(;this.index<this.expr.length;)if(r=this.code,r===e.SEMCOL_CODE||r===e.COMMA_CODE)this.index++;else if(s=this.gobbleExpression())i.push(s);else if(this.index<this.expr.length){if(r===t)break;this.throwError('Unexpected "'+this.char+'"')}return i}gobbleExpression(){const e=this.searchHook("gobble-expression")||this.gobbleBinaryExpression();return this.gobbleSpaces(),this.runHook("after-expression",e)}gobbleBinaryOp(){this.gobbleSpaces();let t=this.expr.substr(this.index,e.max_binop_len),r=t.length;for(;r>0;){if(e.binary_ops.hasOwnProperty(t)&&(!e.isIdentifierStart(this.code)||this.index+t.length<this.expr.length&&!e.isIdentifierPart(this.expr.charCodeAt(this.index+t.length))))return this.index+=r,t;t=t.substr(0,--r)}return!1}gobbleBinaryExpression(){let t,r,s,i,n,o,a,h,l;if(o=this.gobbleToken(),!o)return o;if(r=this.gobbleBinaryOp(),!r)return o;for(n={value:r,prec:e.binaryPrecedence(r),right_a:e.right_associative.has(r)},a=this.gobbleToken(),a||this.throwError("Expected expression after "+r),i=[o,n,a];r=this.gobbleBinaryOp();){if(s=e.binaryPrecedence(r),0===s){this.index-=r.length;break}n={value:r,prec:s,right_a:e.right_associative.has(r)},l=r;const h=e=>n.right_a&&e.right_a?s>e.prec:s<=e.prec;for(;i.length>2&&h(i[i.length-2]);)a=i.pop(),r=i.pop().value,o=i.pop(),t={type:e.BINARY_EXP,operator:r,left:o,right:a},i.push(t);t=this.gobbleToken(),t||this.throwError("Expected expression after "+l),i.push(n,t)}for(h=i.length-1,t=i[h];h>1;)t={type:e.BINARY_EXP,operator:i[h-1].value,left:i[h-2],right:t},h-=2;return t}gobbleToken(){let t,r,s,i;if(this.gobbleSpaces(),i=this.searchHook("gobble-token"),i)return this.runHook("after-token",i);if(t=this.code,e.isDecimalDigit(t)||t===e.PERIOD_CODE)return this.gobbleNumericLiteral();if(t===e.SQUOTE_CODE||t===e.DQUOTE_CODE)i=this.gobbleStringLiteral();else if(t===e.OBRACK_CODE)i=this.gobbleArray();else{for(r=this.expr.substr(this.index,e.max_unop_len),s=r.length;s>0;){if(e.unary_ops.hasOwnProperty(r)&&(!e.isIdentifierStart(this.code)||this.index+r.length<this.expr.length&&!e.isIdentifierPart(this.expr.charCodeAt(this.index+r.length)))){this.index+=s;const t=this.gobbleToken();return t||this.throwError("missing unaryOp argument"),this.runHook("after-token",{type:e.UNARY_EXP,operator:r,argument:t,prefix:!0})}r=r.substr(0,--s)}e.isIdentifierStart(t)?(i=this.gobbleIdentifier(),e.literals.hasOwnProperty(i.name)?i={type:e.LITERAL,value:e.literals[i.name],raw:i.name}:i.name===e.this_str&&(i={type:e.THIS_EXP})):t===e.OPAREN_CODE&&(i=this.gobbleGroup())}return i?(i=this.gobbleTokenProperty(i),this.runHook("after-token",i)):this.runHook("after-token",!1)}gobbleTokenProperty(t){this.gobbleSpaces();let r=this.code;for(;r===e.PERIOD_CODE||r===e.OBRACK_CODE||r===e.OPAREN_CODE||r===e.QUMARK_CODE;){let s;if(r===e.QUMARK_CODE){if(this.expr.charCodeAt(this.index+1)!==e.PERIOD_CODE)break;s=!0,this.index+=2,this.gobbleSpaces(),r=this.code}this.index++,r===e.OBRACK_CODE?((t={type:e.MEMBER_EXP,computed:!0,object:t,property:this.gobbleExpression()}).property||this.throwError('Unexpected "'+this.char+'"'),this.gobbleSpaces(),r=this.code,r!==e.CBRACK_CODE&&this.throwError("Unclosed ["),this.index++):r===e.OPAREN_CODE?t={type:e.CALL_EXP,arguments:this.gobbleArguments(e.CPAREN_CODE),callee:t}:(r===e.PERIOD_CODE||s)&&(s&&this.index--,this.gobbleSpaces(),t={type:e.MEMBER_EXP,computed:!1,object:t,property:this.gobbleIdentifier()}),s&&(t.optional=!0),this.gobbleSpaces(),r=this.code}return t}gobbleNumericLiteral(){let t,r,s="";for(;e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);if(this.code===e.PERIOD_CODE)for(s+=this.expr.charAt(this.index++);e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);if(t=this.char,"e"===t||"E"===t){for(s+=this.expr.charAt(this.index++),t=this.char,"+"!==t&&"-"!==t||(s+=this.expr.charAt(this.index++));e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);e.isDecimalDigit(this.expr.charCodeAt(this.index-1))||this.throwError("Expected exponent ("+s+this.char+")")}return r=this.code,e.isIdentifierStart(r)?this.throwError("Variable names cannot start with a number ("+s+this.char+")"):(r===e.PERIOD_CODE||1===s.length&&s.charCodeAt(0)===e.PERIOD_CODE)&&this.throwError("Unexpected period"),{type:e.LITERAL,value:parseFloat(s),raw:s}}gobbleStringLiteral(){let t="";const r=this.index,s=this.expr.charAt(this.index++);let i=!1;for(;this.index<this.expr.length;){let e=this.expr.charAt(this.index++);if(e===s){i=!0;break}if("\\"===e)switch(e=this.expr.charAt(this.index++),e){case"n":t+="\n";break;case"r":t+="\r";break;case"t":t+="\t";break;case"b":t+="\b";break;case"f":t+="\f";break;case"v":t+="\v";break;default:t+=e}else t+=e}return i||this.throwError('Unclosed quote after "'+t+'"'),{type:e.LITERAL,value:t,raw:this.expr.substring(r,this.index)}}gobbleIdentifier(){let t=this.code,r=this.index;for(e.isIdentifierStart(t)?this.index++:this.throwError("Unexpected "+this.char);this.index<this.expr.length&&(t=this.code,e.isIdentifierPart(t));)this.index++;return{type:e.IDENTIFIER,name:this.expr.slice(r,this.index)}}gobbleArguments(t){const r=[];let s=!1,i=0;for(;this.index<this.expr.length;){this.gobbleSpaces();let n=this.code;if(n===t){s=!0,this.index++,t===e.CPAREN_CODE&&i&&i>=r.length&&this.throwError("Unexpected token "+String.fromCharCode(t));break}if(n===e.COMMA_CODE){if(this.index++,i++,i!==r.length)if(t===e.CPAREN_CODE)this.throwError("Unexpected token ,");else if(t===e.CBRACK_CODE)for(let e=r.length;e<i;e++)r.push(null)}else if(r.length!==i&&0!==i)this.throwError("Expected comma");else{const t=this.gobbleExpression();t&&t.type!==e.COMPOUND||this.throwError("Expected comma"),r.push(t)}}return s||this.throwError("Expected "+String.fromCharCode(t)),r}gobbleGroup(){this.index++;let t=this.gobbleExpressions(e.CPAREN_CODE);if(this.code===e.CPAREN_CODE)return this.index++,1===t.length?t[0]:!!t.length&&{type:e.SEQUENCE_EXP,expressions:t};this.throwError("Unclosed (")}gobbleArray(){return this.index++,{type:e.ARRAY_EXP,elements:this.gobbleArguments(e.CBRACK_CODE)}}}const t=new class{add(e,t,r){if("string"!=typeof arguments[0])for(let e in arguments[0])this.add(e,arguments[0][e],arguments[1]);else(Array.isArray(e)?e:[e]).forEach((function(e){this[e]=this[e]||[],t&&this[e][r?"unshift":"push"](t)}),this)}run(e,t){this[e]=this[e]||[],this[e].forEach((function(e){e.call(t&&t.context?t.context:t,t)}))}};Object.assign(e,{hooks:t,plugins:new class{constructor(e){this.jsep=e,this.registered={}}register(){for(var e=arguments.length,t=new Array(e),r=0;r<e;r++)t[r]=arguments[r];t.forEach((e=>{if("object"!=typeof e||!e.name||!e.init)throw new Error("Invalid JSEP plugin format");this.registered[e.name]||(e.init(this.jsep),this.registered[e.name]=e)}))}}(e),COMPOUND:"Compound",SEQUENCE_EXP:"SequenceExpression",IDENTIFIER:"Identifier",MEMBER_EXP:"MemberExpression",LITERAL:"Literal",THIS_EXP:"ThisExpression",CALL_EXP:"CallExpression",UNARY_EXP:"UnaryExpression",BINARY_EXP:"BinaryExpression",ARRAY_EXP:"ArrayExpression",TAB_CODE:9,LF_CODE:10,CR_CODE:13,SPACE_CODE:32,PERIOD_CODE:46,COMMA_CODE:44,SQUOTE_CODE:39,DQUOTE_CODE:34,OPAREN_CODE:40,CPAREN_CODE:41,OBRACK_CODE:91,CBRACK_CODE:93,QUMARK_CODE:63,SEMCOL_CODE:59,COLON_CODE:58,unary_ops:{"-":1,"!":1,"~":1,"+":1},binary_ops:{"||":1,"&&":2,"|":3,"^":4,"&":5,"==":6,"!=":6,"===":6,"!==":6,"<":7,">":7,"<=":7,">=":7,"<<":8,">>":8,">>>":8,"+":9,"-":9,"*":10,"/":10,"%":10},right_associative:new Set,additional_identifier_chars:new Set(["$","_"]),literals:{true:!0,false:!1,null:null},this_str:"this"}),e.max_unop_len=e.getMaxKeyLen(e.unary_ops),e.max_binop_len=e.getMaxKeyLen(e.binary_ops);const r=t=>new e(t).parse(),s=Object.getOwnPropertyNames(class{});Object.getOwnPropertyNames(e).filter((e=>!s.includes(e)&&void 0===r[e])).forEach((t=>{r[t]=e[t]})),r.Jsep=e;var i={name:"ternary",init(e){e.hooks.add("after-expression",(function(t){if(t.node&&this.code===e.QUMARK_CODE){this.index++;const r=t.node,s=this.gobbleExpression();if(s||this.throwError("Expected expression"),this.gobbleSpaces(),this.code===e.COLON_CODE){this.index++;const i=this.gobbleExpression();if(i||this.throwError("Expected expression"),t.node={type:"ConditionalExpression",test:r,consequent:s,alternate:i},r.operator&&e.binary_ops[r.operator]<=.9){let s=r;for(;s.right.operator&&e.binary_ops[s.right.operator]<=.9;)s=s.right;t.node.test=s.right,s.right=t.node,t.node=r}}else this.throwError("Expected :")}}))}};r.plugins.register(i);var n={name:"regex",init(e){e.hooks.add("gobble-token",(function(t){if(47===this.code){const r=++this.index;let s=!1;for(;this.index<this.expr.length;){if(47===this.code&&!s){const s=this.expr.slice(r,this.index);let i,n="";for(;++this.index<this.expr.length;){const e=this.code;if(!(e>=97&&e<=122||e>=65&&e<=90||e>=48&&e<=57))break;n+=this.char}try{i=new RegExp(s,n)}catch(e){this.throwError(e.message)}return t.node={type:e.LITERAL,value:i,raw:this.expr.slice(r-1,this.index)},t.node=this.gobbleTokenProperty(t.node),t.node}this.code===e.OBRACK_CODE?s=!0:s&&this.code===e.CBRACK_CODE&&(s=!1),this.index+=92===this.code?2:1}this.throwError("Unclosed Regex")}}))}};const o={name:"assignment",assignmentOperators:new Set(["=","*=","**=","/=","%=","+=","-=","<<=",">>=",">>>=","&=","^=","|="]),updateOperators:[43,45],assignmentPrecedence:.9,init(e){const t=[e.IDENTIFIER,e.MEMBER_EXP];function r(e){o.assignmentOperators.has(e.operator)?(e.type="AssignmentExpression",r(e.left),r(e.right)):e.operator||Object.values(e).forEach((e=>{e&&"object"==typeof e&&r(e)}))}o.assignmentOperators.forEach((t=>e.addBinaryOp(t,o.assignmentPrecedence,!0))),e.hooks.add("gobble-token",(function(e){const r=this.code;o.updateOperators.some((e=>e===r&&e===this.expr.charCodeAt(this.index+1)))&&(this.index+=2,e.node={type:"UpdateExpression",operator:43===r?"++":"--",argument:this.gobbleTokenProperty(this.gobbleIdentifier()),prefix:!0},e.node.argument&&t.includes(e.node.argument.type)||this.throwError(`Unexpected ${e.node.operator}`))})),e.hooks.add("after-token",(function(e){if(e.node){const r=this.code;o.updateOperators.some((e=>e===r&&e===this.expr.charCodeAt(this.index+1)))&&(t.includes(e.node.type)||this.throwError(`Unexpected ${e.node.operator}`),this.index+=2,e.node={type:"UpdateExpression",operator:43===r?"++":"--",argument:e.node,prefix:!1})}})),e.hooks.add("after-expression",(function(e){e.node&&r(e.node)}))}};r.plugins.register(n,o);const a={evalAst(e,t){switch(e.type){case"BinaryExpression":case"LogicalExpression":return a.evalBinaryExpression(e,t);case"Compound":return a.evalCompound(e,t);case"ConditionalExpression":return a.evalConditionalExpression(e,t);case"Identifier":return a.evalIdentifier(e,t);case"Literal":return a.evalLiteral(e,t);case"MemberExpression":return a.evalMemberExpression(e,t);case"UnaryExpression":return a.evalUnaryExpression(e,t);case"ArrayExpression":return a.evalArrayExpression(e,t);case"CallExpression":return a.evalCallExpression(e,t);case"AssignmentExpression":return a.evalAssignmentExpression(e,t);default:throw SyntaxError("Unexpected expression",e)}},evalBinaryExpression:(e,t)=>({"||":(e,t)=>e||t(),"&&":(e,t)=>e&&t(),"|":(e,t)=>e|t(),"^":(e,t)=>e^t(),"&":(e,t)=>e&t(),"==":(e,t)=>e==t(),"!=":(e,t)=>e!=t(),"===":(e,t)=>e===t(),"!==":(e,t)=>e!==t(),"<":(e,t)=>e<t(),">":(e,t)=>e>t(),"<=":(e,t)=>e<=t(),">=":(e,t)=>e>=t(),"<<":(e,t)=>e<<t(),">>":(e,t)=>e>>t(),">>>":(e,t)=>e>>>t(),"+":(e,t)=>e+t(),"-":(e,t)=>e-t(),"*":(e,t)=>e*t(),"/":(e,t)=>e/t(),"%":(e,t)=>e%t()}[e.operator](a.evalAst(e.left,t),(()=>a.evalAst(e.right,t)))),evalCompound(e,t){let r;for(let s=0;s<e.body.length;s++){"Identifier"===e.body[s].type&&["var","let","const"].includes(e.body[s].name)&&e.body[s+1]&&"AssignmentExpression"===e.body[s+1].type&&(s+=1);const i=e.body[s];r=a.evalAst(i,t)}return r},evalConditionalExpression:(e,t)=>a.evalAst(e.test,t)?a.evalAst(e.consequent,t):a.evalAst(e.alternate,t),evalIdentifier(e,t){if(e.name in t)return t[e.name];throw ReferenceError(`${e.name} is not defined`)},evalLiteral:e=>e.value,evalMemberExpression(e,t){const r=e.computed?a.evalAst(e.property):e.property.name,s=a.evalAst(e.object,t),i=s[r];if("function"==typeof i){if(s===Function&&"bind"===r)throw new Error("Function.prototype.bind is disabled");return i===Function?i:i.bind(s)}return i},evalUnaryExpression:(e,t)=>({"-":e=>-a.evalAst(e,t),"!":e=>!a.evalAst(e,t),"~":e=>~a.evalAst(e,t),"+":e=>+a.evalAst(e,t)}[e.operator](e.argument)),evalArrayExpression:(e,t)=>e.elements.map((e=>a.evalAst(e,t))),evalCallExpression(e,t){const r=e.arguments.map((e=>a.evalAst(e,t))),s=a.evalAst(e.callee,t);if(s===Function)throw new Error("Function constructor is disabled");return s(...r)},evalAssignmentExpression(e,t){if("Identifier"!==e.left.type)throw SyntaxError("Invalid left-hand side in assignment");const r=e.left.name;if("__proto__"===r)throw new Error("Assignment to __proto__ is disabled");const s=a.evalAst(e.right,t);return t[r]=s,t[r]}};function h(e,t){return(e=e.slice()).push(t),e}function l(e,t){return(t=t.slice()).unshift(e),t}class c extends Error{constructor(e){super('JSONPath should not be called with "new" (it prevents return of (unwrapped) scalar values)'),this.avoidNew=!0,this.value=e,this.name="NewError"}}function p(e,t,r,s,i){if(!(this instanceof p))try{return new p(e,t,r,s,i)}catch(e){if(!e.avoidNew)throw e;return e.value}"string"==typeof e&&(i=s,s=r,r=t,t=e,e=null);const n=e&&"object"==typeof e;if(e=e||{},this.json=e.json||r,this.path=e.path||t,this.resultType=e.resultType||"value",this.flatten=e.flatten||!1,this.wrap=!Object.hasOwn(e,"wrap")||e.wrap,this.sandbox=e.sandbox||{},this.eval=void 0===e.eval?"safe":e.eval,this.ignoreEvalErrors=void 0!==e.ignoreEvalErrors&&e.ignoreEvalErrors,this.parent=e.parent||null,this.parentProperty=e.parentProperty||null,this.callback=e.callback||s||null,this.otherTypeCallback=e.otherTypeCallback||i||function(){throw new TypeError("You must supply an otherTypeCallback callback option with the @other() operator.")},!1!==e.autostart){const s={path:n?e.path:t};n?"json"in e&&(s.json=e.json):s.json=r;const i=this.evaluate(s);if(!i||"object"!=typeof i)throw new c(i);return i}}p.prototype.evaluate=function(e,t,r,s){let i=this.parent,n=this.parentProperty,{flatten:o,wrap:a}=this;if(this.currResultType=this.resultType,this.currEval=this.eval,this.currSandbox=this.sandbox,r=r||this.callback,this.currOtherTypeCallback=s||this.otherTypeCallback,t=t||this.json,(e=e||this.path)&&"object"==typeof e&&!Array.isArray(e)){if(!e.path&&""!==e.path)throw new TypeError('You must supply a "path" property when providing an object argument to JSONPath.evaluate().');if(!Object.hasOwn(e,"json"))throw new TypeError('You must supply a "json" property when providing an object argument to JSONPath.evaluate().');({json:t}=e),o=Object.hasOwn(e,"flatten")?e.flatten:o,this.currResultType=Object.hasOwn(e,"resultType")?e.resultType:this.currResultType,this.currSandbox=Object.hasOwn(e,"sandbox")?e.sandbox:this.currSandbox,a=Object.hasOwn(e,"wrap")?e.wrap:a,this.currEval=Object.hasOwn(e,"eval")?e.eval:this.currEval,r=Object.hasOwn(e,"callback")?e.callback:r,this.currOtherTypeCallback=Object.hasOwn(e,"otherTypeCallback")?e.otherTypeCallback:this.currOtherTypeCallback,i=Object.hasOwn(e,"parent")?e.parent:i,n=Object.hasOwn(e,"parentProperty")?e.parentProperty:n,e=e.path}if(i=i||null,n=n||null,Array.isArray(e)&&(e=p.toPathString(e)),!e&&""!==e||!t)return;const h=p.toPathArray(e);"$"===h[0]&&h.length>1&&h.shift(),this._hasParentSelector=null;const l=this._trace(h,t,["$"],i,n,r).filter((function(e){return e&&!e.isParentSelector}));return l.length?a||1!==l.length||l[0].hasArrExpr?l.reduce(((e,t)=>{const r=this._getPreferredOutput(t);return o&&Array.isArray(r)?e=e.concat(r):e.push(r),e}),[]):this._getPreferredOutput(l[0]):a?[]:void 0},p.prototype._getPreferredOutput=function(e){const t=this.currResultType;switch(t){case"all":{const t=Array.isArray(e.path)?e.path:p.toPathArray(e.path);return e.pointer=p.toPointer(t),e.path="string"==typeof e.path?e.path:p.toPathString(e.path),e}case"value":case"parent":case"parentProperty":return e[t];case"path":return p.toPathString(e[t]);case"pointer":return p.toPointer(e.path);default:throw new TypeError("Unknown result type")}},p.prototype._handleCallback=function(e,t,r){if(t){const s=this._getPreferredOutput(e);e.path="string"==typeof e.path?e.path:p.toPathString(e.path),t(s,r,e)}},p.prototype._trace=function(e,t,r,s,i,n,o,a){let c;if(!e.length)return c={path:r,value:t,parent:s,parentProperty:i,hasArrExpr:o},this._handleCallback(c,n,"value"),c;const p=e[0],u=e.slice(1),d=[];function f(e){Array.isArray(e)?e.forEach((e=>{d.push(e)})):d.push(e)}if(("string"!=typeof p||a)&&t&&Object.hasOwn(t,p))f(this._trace(u,t[p],h(r,p),t,p,n,o));else if("*"===p)this._walk(t,(e=>{f(this._trace(u,t[e],h(r,e),t,e,n,!0,!0))}));else if(".."===p)f(this._trace(u,t,r,s,i,n,o)),this._walk(t,(s=>{"object"==typeof t[s]&&f(this._trace(e.slice(),t[s],h(r,s),t,s,n,!0))}));else{if("^"===p)return this._hasParentSelector=!0,{path:r.slice(0,-1),expr:u,isParentSelector:!0};if("~"===p)return c={path:h(r,p),value:i,parent:s,parentProperty:null},this._handleCallback(c,n,"property"),c;if("$"===p)f(this._trace(u,t,r,null,null,n,o));else if(/^(-?\d*):(-?\d*):?(\d*)$/u.test(p))f(this._slice(p,u,t,r,s,i,n));else if(0===p.indexOf("?(")){if(!1===this.currEval)throw new Error("Eval [?(expr)] prevented in JSONPath expression.");const e=p.replace(/^\?\((.*?)\)$/u,"$1"),o=/@.?([^?]*)[['](\??\(.*?\))(?!.\)\])[\]']/gu.exec(e);o?this._walk(t,(e=>{const a=[o[2]],l=o[1]?t[e][o[1]]:t[e];this._trace(a,l,r,s,i,n,!0).length>0&&f(this._trace(u,t[e],h(r,e),t,e,n,!0))})):this._walk(t,(o=>{this._eval(e,t[o],o,r,s,i)&&f(this._trace(u,t[o],h(r,o),t,o,n,!0))}))}else if("("===p[0]){if(!1===this.currEval)throw new Error("Eval [(expr)] prevented in JSONPath expression.");f(this._trace(l(this._eval(p,t,r.at(-1),r.slice(0,-1),s,i),u),t,r,s,i,n,o))}else if("@"===p[0]){let e=!1;const o=p.slice(1,-2);switch(o){case"scalar":t&&["object","function"].includes(typeof t)||(e=!0);break;case"boolean":case"string":case"undefined":case"function":typeof t===o&&(e=!0);break;case"integer":!Number.isFinite(t)||t%1||(e=!0);break;case"number":Number.isFinite(t)&&(e=!0);break;case"nonFinite":"number"!=typeof t||Number.isFinite(t)||(e=!0);break;case"object":t&&typeof t===o&&(e=!0);break;case"array":Array.isArray(t)&&(e=!0);break;case"other":e=this.currOtherTypeCallback(t,r,s,i);break;case"null":null===t&&(e=!0);break;default:throw new TypeError("Unknown value type "+o)}if(e)return c={path:r,value:t,parent:s,parentProperty:i},this._handleCallback(c,n,"value"),c}else if("`"===p[0]&&t&&Object.hasOwn(t,p.slice(1))){const e=p.slice(1);f(this._trace(u,t[e],h(r,e),t,e,n,o,!0))}else if(p.includes(",")){const e=p.split(",");for(const o of e)f(this._trace(l(o,u),t,r,s,i,n,!0))}else!a&&t&&Object.hasOwn(t,p)&&f(this._trace(u,t[p],h(r,p),t,p,n,o,!0))}if(this._hasParentSelector)for(let e=0;e<d.length;e++){const r=d[e];if(r&&r.isParentSelector){const a=this._trace(r.expr,t,r.path,s,i,n,o);if(Array.isArray(a)){d[e]=a[0];const t=a.length;for(let r=1;r<t;r++)e++,d.splice(e,0,a[r])}else d[e]=a}}return d},p.prototype._walk=function(e,t){if(Array.isArray(e)){const r=e.length;for(let e=0;e<r;e++)t(e)}else e&&"object"==typeof e&&Object.keys(e).forEach((e=>{t(e)}))},p.prototype._slice=function(e,t,r,s,i,n,o){if(!Array.isArray(r))return;const a=r.length,h=e.split(":"),c=h[2]&&Number.parseInt(h[2])||1;let p=h[0]&&Number.parseInt(h[0])||0,u=h[1]&&Number.parseInt(h[1])||a;p=p<0?Math.max(0,p+a):Math.min(a,p),u=u<0?Math.max(0,u+a):Math.min(a,u);const d=[];for(let e=p;e<u;e+=c){this._trace(l(e,t),r,s,i,n,o,!0).forEach((e=>{d.push(e)}))}return d},p.prototype._eval=function(e,t,r,s,i,n){this.currSandbox._$_parentProperty=n,this.currSandbox._$_parent=i,this.currSandbox._$_property=r,this.currSandbox._$_root=this.json,this.currSandbox._$_v=t;const o=e.includes("@path");o&&(this.currSandbox._$_path=p.toPathString(s.concat([r])));const a=this.currEval+"Script:"+e;if(!p.cache[a]){let t=e.replaceAll("@parentProperty","_$_parentProperty").replaceAll("@parent","_$_parent").replaceAll("@property","_$_property").replaceAll("@root","_$_root").replaceAll(/@([.\s)[])/gu,"_$_v$1");if(o&&(t=t.replaceAll("@path","_$_path")),"safe"===this.currEval||!0===this.currEval||void 0===this.currEval)p.cache[a]=new this.safeVm.Script(t);else if("native"===this.currEval)p.cache[a]=new this.vm.Script(t);else if("function"==typeof this.currEval&&this.currEval.prototype&&Object.hasOwn(this.currEval.prototype,"runInNewContext")){const e=this.currEval;p.cache[a]=new e(t)}else{if("function"!=typeof this.currEval)throw new TypeError(`Unknown "eval" property "${this.currEval}"`);p.cache[a]={runInNewContext:e=>this.currEval(t,e)}}}try{return p.cache[a].runInNewContext(this.currSandbox)}catch(t){if(this.ignoreEvalErrors)return!1;throw new Error("jsonPath: "+t.message+": "+e)}},p.cache={},p.toPathString=function(e){const t=e,r=t.length;let s="$";for(let e=1;e<r;e++)/^(~|\^|@.*?\(\))$/u.test(t[e])||(s+=/^[0-9*]+$/u.test(t[e])?"["+t[e]+"]":"['"+t[e]+"']");return s},p.toPointer=function(e){const t=e,r=t.length;let s="";for(let e=1;e<r;e++)/^(~|\^|@.*?\(\))$/u.test(t[e])||(s+="/"+t[e].toString().replaceAll("~","~0").replaceAll("/","~1"));return s},p.toPathArray=function(e){const{cache:t}=p;if(t[e])return t[e].concat();const r=[],s=e.replaceAll(/@(?:null|boolean|number|string|integer|undefined|nonFinite|scalar|array|object|function|other)\(\)/gu,";$&;").replaceAll(/[['](\??\(.*?\))[\]'](?!.\])/gu,(function(e,t){return"[#"+(r.push(t)-1)+"]"})).replaceAll(/\[['"]([^'\]]*)['"]\]/gu,(function(e,t){return"['"+t.replaceAll(".","%@%").replaceAll("~","%%@@%%")+"']"})).replaceAll("~",";~;").replaceAll(/['"]?\.['"]?(?![^[]*\])|\[['"]?/gu,";").replaceAll("%@%",".").replaceAll("%%@@%%","~").replaceAll(/(?:;)?(\^+)(?:;)?/gu,(function(e,t){return";"+t.split("").join(";")+";"})).replaceAll(/;;;|;;/gu,";..;").replaceAll(/;$|'?\]|'$/gu,"").split(";").map((function(e){const t=e.match(/#(\d+)/u);return t&&t[1]?r[t[1]]:e}));return t[e]=s,t[e].concat()},p.prototype.safeVm={Script:class{constructor(e){this.code=e,this.ast=r(this.code)}runInNewContext(e){const t={...e};return a.evalAst(this.ast,t)}}};p.prototype.vm={Script:class{constructor(e){this.code=e}runInNewContext(e){let t=this.code;const r=Object.keys(e),s=[];!function(e,t,r){const s=e.length;for(let i=0;i<s;i++)r(e[i])&&t.push(e.splice(i--,1)[0])}(r,s,(t=>"function"==typeof e[t]));const i=r.map((t=>e[t]));t=s.reduce(((t,r)=>{let s=e[r].toString();return/function/u.test(s)||(s="function "+s),"var "+r+"="+s+";"+t}),"")+t,/(['"])use strict\1/u.test(t)||r.includes("arguments")||(t="var arguments = undefined;"+t),t=t.replace(/;\s*$/u,"");const n=t.lastIndexOf(";"),o=n>-1?t.slice(0,n+1)+" return "+t.slice(n+1):" return "+t;return new Function(...r,o)(...i)}}};export{p as JSONPath};
+class e{static get version(){return"1.3.9"}static toString(){return"JavaScript Expression Parser (JSEP) v"+e.version}static addUnaryOp(t){return e.max_unop_len=Math.max(t.length,e.max_unop_len),e.unary_ops[t]=1,e}static addBinaryOp(t,r,s){return e.max_binop_len=Math.max(t.length,e.max_binop_len),e.binary_ops[t]=r,s?e.right_associative.add(t):e.right_associative.delete(t),e}static addIdentifierChar(t){return e.additional_identifier_chars.add(t),e}static addLiteral(t,r){return e.literals[t]=r,e}static removeUnaryOp(t){return delete e.unary_ops[t],t.length===e.max_unop_len&&(e.max_unop_len=e.getMaxKeyLen(e.unary_ops)),e}static removeAllUnaryOps(){return e.unary_ops={},e.max_unop_len=0,e}static removeIdentifierChar(t){return e.additional_identifier_chars.delete(t),e}static removeBinaryOp(t){return delete e.binary_ops[t],t.length===e.max_binop_len&&(e.max_binop_len=e.getMaxKeyLen(e.binary_ops)),e.right_associative.delete(t),e}static removeAllBinaryOps(){return e.binary_ops={},e.max_binop_len=0,e}static removeLiteral(t){return delete e.literals[t],e}static removeAllLiterals(){return e.literals={},e}get char(){return this.expr.charAt(this.index)}get code(){return this.expr.charCodeAt(this.index)}constructor(e){this.expr=e,this.index=0}static parse(t){return new e(t).parse()}static getMaxKeyLen(e){return Math.max(0,...Object.keys(e).map((e=>e.length)))}static isDecimalDigit(e){return e>=48&&e<=57}static binaryPrecedence(t){return e.binary_ops[t]||0}static isIdentifierStart(t){return t>=65&&t<=90||t>=97&&t<=122||t>=128&&!e.binary_ops[String.fromCharCode(t)]||e.additional_identifier_chars.has(String.fromCharCode(t))}static isIdentifierPart(t){return e.isIdentifierStart(t)||e.isDecimalDigit(t)}throwError(e){const t=new Error(e+" at character "+this.index);throw t.index=this.index,t.description=e,t}runHook(t,r){if(e.hooks[t]){const s={context:this,node:r};return e.hooks.run(t,s),s.node}return r}searchHook(t){if(e.hooks[t]){const r={context:this};return e.hooks[t].find((function(e){return e.call(r.context,r),r.node})),r.node}}gobbleSpaces(){let t=this.code;for(;t===e.SPACE_CODE||t===e.TAB_CODE||t===e.LF_CODE||t===e.CR_CODE;)t=this.expr.charCodeAt(++this.index);this.runHook("gobble-spaces")}parse(){this.runHook("before-all");const t=this.gobbleExpressions(),r=1===t.length?t[0]:{type:e.COMPOUND,body:t};return this.runHook("after-all",r)}gobbleExpressions(t){let r,s,i=[];for(;this.index<this.expr.length;)if(r=this.code,r===e.SEMCOL_CODE||r===e.COMMA_CODE)this.index++;else if(s=this.gobbleExpression())i.push(s);else if(this.index<this.expr.length){if(r===t)break;this.throwError('Unexpected "'+this.char+'"')}return i}gobbleExpression(){const e=this.searchHook("gobble-expression")||this.gobbleBinaryExpression();return this.gobbleSpaces(),this.runHook("after-expression",e)}gobbleBinaryOp(){this.gobbleSpaces();let t=this.expr.substr(this.index,e.max_binop_len),r=t.length;for(;r>0;){if(e.binary_ops.hasOwnProperty(t)&&(!e.isIdentifierStart(this.code)||this.index+t.length<this.expr.length&&!e.isIdentifierPart(this.expr.charCodeAt(this.index+t.length))))return this.index+=r,t;t=t.substr(0,--r)}return!1}gobbleBinaryExpression(){let t,r,s,i,n,o,a,h,l;if(o=this.gobbleToken(),!o)return o;if(r=this.gobbleBinaryOp(),!r)return o;for(n={value:r,prec:e.binaryPrecedence(r),right_a:e.right_associative.has(r)},a=this.gobbleToken(),a||this.throwError("Expected expression after "+r),i=[o,n,a];r=this.gobbleBinaryOp();){if(s=e.binaryPrecedence(r),0===s){this.index-=r.length;break}n={value:r,prec:s,right_a:e.right_associative.has(r)},l=r;const h=e=>n.right_a&&e.right_a?s>e.prec:s<=e.prec;for(;i.length>2&&h(i[i.length-2]);)a=i.pop(),r=i.pop().value,o=i.pop(),t={type:e.BINARY_EXP,operator:r,left:o,right:a},i.push(t);t=this.gobbleToken(),t||this.throwError("Expected expression after "+l),i.push(n,t)}for(h=i.length-1,t=i[h];h>1;)t={type:e.BINARY_EXP,operator:i[h-1].value,left:i[h-2],right:t},h-=2;return t}gobbleToken(){let t,r,s,i;if(this.gobbleSpaces(),i=this.searchHook("gobble-token"),i)return this.runHook("after-token",i);if(t=this.code,e.isDecimalDigit(t)||t===e.PERIOD_CODE)return this.gobbleNumericLiteral();if(t===e.SQUOTE_CODE||t===e.DQUOTE_CODE)i=this.gobbleStringLiteral();else if(t===e.OBRACK_CODE)i=this.gobbleArray();else{for(r=this.expr.substr(this.index,e.max_unop_len),s=r.length;s>0;){if(e.unary_ops.hasOwnProperty(r)&&(!e.isIdentifierStart(this.code)||this.index+r.length<this.expr.length&&!e.isIdentifierPart(this.expr.charCodeAt(this.index+r.length)))){this.index+=s;const t=this.gobbleToken();return t||this.throwError("missing unaryOp argument"),this.runHook("after-token",{type:e.UNARY_EXP,operator:r,argument:t,prefix:!0})}r=r.substr(0,--s)}e.isIdentifierStart(t)?(i=this.gobbleIdentifier(),e.literals.hasOwnProperty(i.name)?i={type:e.LITERAL,value:e.literals[i.name],raw:i.name}:i.name===e.this_str&&(i={type:e.THIS_EXP})):t===e.OPAREN_CODE&&(i=this.gobbleGroup())}return i?(i=this.gobbleTokenProperty(i),this.runHook("after-token",i)):this.runHook("after-token",!1)}gobbleTokenProperty(t){this.gobbleSpaces();let r=this.code;for(;r===e.PERIOD_CODE||r===e.OBRACK_CODE||r===e.OPAREN_CODE||r===e.QUMARK_CODE;){let s;if(r===e.QUMARK_CODE){if(this.expr.charCodeAt(this.index+1)!==e.PERIOD_CODE)break;s=!0,this.index+=2,this.gobbleSpaces(),r=this.code}this.index++,r===e.OBRACK_CODE?((t={type:e.MEMBER_EXP,computed:!0,object:t,property:this.gobbleExpression()}).property||this.throwError('Unexpected "'+this.char+'"'),this.gobbleSpaces(),r=this.code,r!==e.CBRACK_CODE&&this.throwError("Unclosed ["),this.index++):r===e.OPAREN_CODE?t={type:e.CALL_EXP,arguments:this.gobbleArguments(e.CPAREN_CODE),callee:t}:(r===e.PERIOD_CODE||s)&&(s&&this.index--,this.gobbleSpaces(),t={type:e.MEMBER_EXP,computed:!1,object:t,property:this.gobbleIdentifier()}),s&&(t.optional=!0),this.gobbleSpaces(),r=this.code}return t}gobbleNumericLiteral(){let t,r,s="";for(;e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);if(this.code===e.PERIOD_CODE)for(s+=this.expr.charAt(this.index++);e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);if(t=this.char,"e"===t||"E"===t){for(s+=this.expr.charAt(this.index++),t=this.char,"+"!==t&&"-"!==t||(s+=this.expr.charAt(this.index++));e.isDecimalDigit(this.code);)s+=this.expr.charAt(this.index++);e.isDecimalDigit(this.expr.charCodeAt(this.index-1))||this.throwError("Expected exponent ("+s+this.char+")")}return r=this.code,e.isIdentifierStart(r)?this.throwError("Variable names cannot start with a number ("+s+this.char+")"):(r===e.PERIOD_CODE||1===s.length&&s.charCodeAt(0)===e.PERIOD_CODE)&&this.throwError("Unexpected period"),{type:e.LITERAL,value:parseFloat(s),raw:s}}gobbleStringLiteral(){let t="";const r=this.index,s=this.expr.charAt(this.index++);let i=!1;for(;this.index<this.expr.length;){let e=this.expr.charAt(this.index++);if(e===s){i=!0;break}if("\\"===e)switch(e=this.expr.charAt(this.index++),e){case"n":t+="\n";break;case"r":t+="\r";break;case"t":t+="\t";break;case"b":t+="\b";break;case"f":t+="\f";break;case"v":t+="\v";break;default:t+=e}else t+=e}return i||this.throwError('Unclosed quote after "'+t+'"'),{type:e.LITERAL,value:t,raw:this.expr.substring(r,this.index)}}gobbleIdentifier(){let t=this.code,r=this.index;for(e.isIdentifierStart(t)?this.index++:this.throwError("Unexpected "+this.char);this.index<this.expr.length&&(t=this.code,e.isIdentifierPart(t));)this.index++;return{type:e.IDENTIFIER,name:this.expr.slice(r,this.index)}}gobbleArguments(t){const r=[];let s=!1,i=0;for(;this.index<this.expr.length;){this.gobbleSpaces();let n=this.code;if(n===t){s=!0,this.index++,t===e.CPAREN_CODE&&i&&i>=r.length&&this.throwError("Unexpected token "+String.fromCharCode(t));break}if(n===e.COMMA_CODE){if(this.index++,i++,i!==r.length)if(t===e.CPAREN_CODE)this.throwError("Unexpected token ,");else if(t===e.CBRACK_CODE)for(let e=r.length;e<i;e++)r.push(null)}else if(r.length!==i&&0!==i)this.throwError("Expected comma");else{const t=this.gobbleExpression();t&&t.type!==e.COMPOUND||this.throwError("Expected comma"),r.push(t)}}return s||this.throwError("Expected "+String.fromCharCode(t)),r}gobbleGroup(){this.index++;let t=this.gobbleExpressions(e.CPAREN_CODE);if(this.code===e.CPAREN_CODE)return this.index++,1===t.length?t[0]:!!t.length&&{type:e.SEQUENCE_EXP,expressions:t};this.throwError("Unclosed (")}gobbleArray(){return this.index++,{type:e.ARRAY_EXP,elements:this.gobbleArguments(e.CBRACK_CODE)}}}const t=new class{add(e,t,r){if("string"!=typeof arguments[0])for(let e in arguments[0])this.add(e,arguments[0][e],arguments[1]);else(Array.isArray(e)?e:[e]).forEach((function(e){this[e]=this[e]||[],t&&this[e][r?"unshift":"push"](t)}),this)}run(e,t){this[e]=this[e]||[],this[e].forEach((function(e){e.call(t&&t.context?t.context:t,t)}))}};Object.assign(e,{hooks:t,plugins:new class{constructor(e){this.jsep=e,this.registered={}}register(){for(var e=arguments.length,t=new Array(e),r=0;r<e;r++)t[r]=arguments[r];t.forEach((e=>{if("object"!=typeof e||!e.name||!e.init)throw new Error("Invalid JSEP plugin format");this.registered[e.name]||(e.init(this.jsep),this.registered[e.name]=e)}))}}(e),COMPOUND:"Compound",SEQUENCE_EXP:"SequenceExpression",IDENTIFIER:"Identifier",MEMBER_EXP:"MemberExpression",LITERAL:"Literal",THIS_EXP:"ThisExpression",CALL_EXP:"CallExpression",UNARY_EXP:"UnaryExpression",BINARY_EXP:"BinaryExpression",ARRAY_EXP:"ArrayExpression",TAB_CODE:9,LF_CODE:10,CR_CODE:13,SPACE_CODE:32,PERIOD_CODE:46,COMMA_CODE:44,SQUOTE_CODE:39,DQUOTE_CODE:34,OPAREN_CODE:40,CPAREN_CODE:41,OBRACK_CODE:91,CBRACK_CODE:93,QUMARK_CODE:63,SEMCOL_CODE:59,COLON_CODE:58,unary_ops:{"-":1,"!":1,"~":1,"+":1},binary_ops:{"||":1,"&&":2,"|":3,"^":4,"&":5,"==":6,"!=":6,"===":6,"!==":6,"<":7,">":7,"<=":7,">=":7,"<<":8,">>":8,">>>":8,"+":9,"-":9,"*":10,"/":10,"%":10},right_associative:new Set,additional_identifier_chars:new Set(["$","_"]),literals:{true:!0,false:!1,null:null},this_str:"this"}),e.max_unop_len=e.getMaxKeyLen(e.unary_ops),e.max_binop_len=e.getMaxKeyLen(e.binary_ops);const r=t=>new e(t).parse(),s=Object.getOwnPropertyNames(class{});Object.getOwnPropertyNames(e).filter((e=>!s.includes(e)&&void 0===r[e])).forEach((t=>{r[t]=e[t]})),r.Jsep=e;var i={name:"ternary",init(e){e.hooks.add("after-expression",(function(t){if(t.node&&this.code===e.QUMARK_CODE){this.index++;const r=t.node,s=this.gobbleExpression();if(s||this.throwError("Expected expression"),this.gobbleSpaces(),this.code===e.COLON_CODE){this.index++;const i=this.gobbleExpression();if(i||this.throwError("Expected expression"),t.node={type:"ConditionalExpression",test:r,consequent:s,alternate:i},r.operator&&e.binary_ops[r.operator]<=.9){let s=r;for(;s.right.operator&&e.binary_ops[s.right.operator]<=.9;)s=s.right;t.node.test=s.right,s.right=t.node,t.node=r}}else this.throwError("Expected :")}}))}};r.plugins.register(i);var n={name:"regex",init(e){e.hooks.add("gobble-token",(function(t){if(47===this.code){const r=++this.index;let s=!1;for(;this.index<this.expr.length;){if(47===this.code&&!s){const s=this.expr.slice(r,this.index);let i,n="";for(;++this.index<this.expr.length;){const e=this.code;if(!(e>=97&&e<=122||e>=65&&e<=90||e>=48&&e<=57))break;n+=this.char}try{i=new RegExp(s,n)}catch(e){this.throwError(e.message)}return t.node={type:e.LITERAL,value:i,raw:this.expr.slice(r-1,this.index)},t.node=this.gobbleTokenProperty(t.node),t.node}this.code===e.OBRACK_CODE?s=!0:s&&this.code===e.CBRACK_CODE&&(s=!1),this.index+=92===this.code?2:1}this.throwError("Unclosed Regex")}}))}};const o={name:"assignment",assignmentOperators:new Set(["=","*=","**=","/=","%=","+=","-=","<<=",">>=",">>>=","&=","^=","|="]),updateOperators:[43,45],assignmentPrecedence:.9,init(e){const t=[e.IDENTIFIER,e.MEMBER_EXP];function r(e){o.assignmentOperators.has(e.operator)?(e.type="AssignmentExpression",r(e.left),r(e.right)):e.operator||Object.values(e).forEach((e=>{e&&"object"==typeof e&&r(e)}))}o.assignmentOperators.forEach((t=>e.addBinaryOp(t,o.assignmentPrecedence,!0))),e.hooks.add("gobble-token",(function(e){const r=this.code;o.updateOperators.some((e=>e===r&&e===this.expr.charCodeAt(this.index+1)))&&(this.index+=2,e.node={type:"UpdateExpression",operator:43===r?"++":"--",argument:this.gobbleTokenProperty(this.gobbleIdentifier()),prefix:!0},e.node.argument&&t.includes(e.node.argument.type)||this.throwError(`Unexpected ${e.node.operator}`))})),e.hooks.add("after-token",(function(e){if(e.node){const r=this.code;o.updateOperators.some((e=>e===r&&e===this.expr.charCodeAt(this.index+1)))&&(t.includes(e.node.type)||this.throwError(`Unexpected ${e.node.operator}`),this.index+=2,e.node={type:"UpdateExpression",operator:43===r?"++":"--",argument:e.node,prefix:!1})}})),e.hooks.add("after-expression",(function(e){e.node&&r(e.node)}))}};r.plugins.register(n,o);const a={evalAst(e,t){switch(e.type){case"BinaryExpression":case"LogicalExpression":return a.evalBinaryExpression(e,t);case"Compound":return a.evalCompound(e,t);case"ConditionalExpression":return a.evalConditionalExpression(e,t);case"Identifier":return a.evalIdentifier(e,t);case"Literal":return a.evalLiteral(e,t);case"MemberExpression":return a.evalMemberExpression(e,t);case"UnaryExpression":return a.evalUnaryExpression(e,t);case"ArrayExpression":return a.evalArrayExpression(e,t);case"CallExpression":return a.evalCallExpression(e,t);case"AssignmentExpression":return a.evalAssignmentExpression(e,t);default:throw SyntaxError("Unexpected expression",e)}},evalBinaryExpression:(e,t)=>({"||":(e,t)=>e||t(),"&&":(e,t)=>e&&t(),"|":(e,t)=>e|t(),"^":(e,t)=>e^t(),"&":(e,t)=>e&t(),"==":(e,t)=>e==t(),"!=":(e,t)=>e!=t(),"===":(e,t)=>e===t(),"!==":(e,t)=>e!==t(),"<":(e,t)=>e<t(),">":(e,t)=>e>t(),"<=":(e,t)=>e<=t(),">=":(e,t)=>e>=t(),"<<":(e,t)=>e<<t(),">>":(e,t)=>e>>t(),">>>":(e,t)=>e>>>t(),"+":(e,t)=>e+t(),"-":(e,t)=>e-t(),"*":(e,t)=>e*t(),"/":(e,t)=>e/t(),"%":(e,t)=>e%t()}[e.operator](a.evalAst(e.left,t),(()=>a.evalAst(e.right,t)))),evalCompound(e,t){let r;for(let s=0;s<e.body.length;s++){"Identifier"===e.body[s].type&&["var","let","const"].includes(e.body[s].name)&&e.body[s+1]&&"AssignmentExpression"===e.body[s+1].type&&(s+=1);const i=e.body[s];r=a.evalAst(i,t)}return r},evalConditionalExpression:(e,t)=>a.evalAst(e.test,t)?a.evalAst(e.consequent,t):a.evalAst(e.alternate,t),evalIdentifier(e,t){if(e.name in t)return t[e.name];throw ReferenceError(`${e.name} is not defined`)},evalLiteral:e=>e.value,evalMemberExpression(e,t){const r=e.computed?a.evalAst(e.property):e.property.name,s=a.evalAst(e.object,t),i=s[r];if("function"==typeof i){if(s===Function&&"bind"===r)throw new Error("Function.prototype.bind is disabled");if(s===Function&&("call"===r||"apply"===r))throw new Error("Function.prototype.call and Function.prototype.apply are disabled");return i===Function?i:i.bind(s)}return i},evalUnaryExpression:(e,t)=>({"-":e=>-a.evalAst(e,t),"!":e=>!a.evalAst(e,t),"~":e=>~a.evalAst(e,t),"+":e=>+a.evalAst(e,t)}[e.operator](e.argument)),evalArrayExpression:(e,t)=>e.elements.map((e=>a.evalAst(e,t))),evalCallExpression(e,t){const r=e.arguments.map((e=>a.evalAst(e,t))),s=a.evalAst(e.callee,t);if(s===Function)throw new Error("Function constructor is disabled");return s(...r)},evalAssignmentExpression(e,t){if("Identifier"!==e.left.type)throw SyntaxError("Invalid left-hand side in assignment");const r=e.left.name;if("__proto__"===r)throw new Error("Assignment to __proto__ is disabled");const s=a.evalAst(e.right,t);return t[r]=s,t[r]}};function h(e,t){return(e=e.slice()).push(t),e}function l(e,t){return(t=t.slice()).unshift(e),t}class c extends Error{constructor(e){super('JSONPath should not be called with "new" (it prevents return of (unwrapped) scalar values)'),this.avoidNew=!0,this.value=e,this.name="NewError"}}function p(e,t,r,s,i){if(!(this instanceof p))try{return new p(e,t,r,s,i)}catch(e){if(!e.avoidNew)throw e;return e.value}"string"==typeof e&&(i=s,s=r,r=t,t=e,e=null);const n=e&&"object"==typeof e;if(e=e||{},this.json=e.json||r,this.path=e.path||t,this.resultType=e.resultType||"value",this.flatten=e.flatten||!1,this.wrap=!Object.hasOwn(e,"wrap")||e.wrap,this.sandbox=e.sandbox||{},this.eval=void 0===e.eval?"safe":e.eval,this.ignoreEvalErrors=void 0!==e.ignoreEvalErrors&&e.ignoreEvalErrors,this.parent=e.parent||null,this.parentProperty=e.parentProperty||null,this.callback=e.callback||s||null,this.otherTypeCallback=e.otherTypeCallback||i||function(){throw new TypeError("You must supply an otherTypeCallback callback option with the @other() operator.")},!1!==e.autostart){const s={path:n?e.path:t};n?"json"in e&&(s.json=e.json):s.json=r;const i=this.evaluate(s);if(!i||"object"!=typeof i)throw new c(i);return i}}p.prototype.evaluate=function(e,t,r,s){let i=this.parent,n=this.parentProperty,{flatten:o,wrap:a}=this;if(this.currResultType=this.resultType,this.currEval=this.eval,this.currSandbox=this.sandbox,r=r||this.callback,this.currOtherTypeCallback=s||this.otherTypeCallback,t=t||this.json,(e=e||this.path)&&"object"==typeof e&&!Array.isArray(e)){if(!e.path&&""!==e.path)throw new TypeError('You must supply a "path" property when providing an object argument to JSONPath.evaluate().');if(!Object.hasOwn(e,"json"))throw new TypeError('You must supply a "json" property when providing an object argument to JSONPath.evaluate().');({json:t}=e),o=Object.hasOwn(e,"flatten")?e.flatten:o,this.currResultType=Object.hasOwn(e,"resultType")?e.resultType:this.currResultType,this.currSandbox=Object.hasOwn(e,"sandbox")?e.sandbox:this.currSandbox,a=Object.hasOwn(e,"wrap")?e.wrap:a,this.currEval=Object.hasOwn(e,"eval")?e.eval:this.currEval,r=Object.hasOwn(e,"callback")?e.callback:r,this.currOtherTypeCallback=Object.hasOwn(e,"otherTypeCallback")?e.otherTypeCallback:this.currOtherTypeCallback,i=Object.hasOwn(e,"parent")?e.parent:i,n=Object.hasOwn(e,"parentProperty")?e.parentProperty:n,e=e.path}if(i=i||null,n=n||null,Array.isArray(e)&&(e=p.toPathString(e)),!e&&""!==e||!t)return;const h=p.toPathArray(e);"$"===h[0]&&h.length>1&&h.shift(),this._hasParentSelector=null;const l=this._trace(h,t,["$"],i,n,r).filter((function(e){return e&&!e.isParentSelector}));return l.length?a||1!==l.length||l[0].hasArrExpr?l.reduce(((e,t)=>{const r=this._getPreferredOutput(t);return o&&Array.isArray(r)?e=e.concat(r):e.push(r),e}),[]):this._getPreferredOutput(l[0]):a?[]:void 0},p.prototype._getPreferredOutput=function(e){const t=this.currResultType;switch(t){case"all":{const t=Array.isArray(e.path)?e.path:p.toPathArray(e.path);return e.pointer=p.toPointer(t),e.path="string"==typeof e.path?e.path:p.toPathString(e.path),e}case"value":case"parent":case"parentProperty":return e[t];case"path":return p.toPathString(e[t]);case"pointer":return p.toPointer(e.path);default:throw new TypeError("Unknown result type")}},p.prototype._handleCallback=function(e,t,r){if(t){const s=this._getPreferredOutput(e);e.path="string"==typeof e.path?e.path:p.toPathString(e.path),t(s,r,e)}},p.prototype._trace=function(e,t,r,s,i,n,o,a){let c;if(!e.length)return c={path:r,value:t,parent:s,parentProperty:i,hasArrExpr:o},this._handleCallback(c,n,"value"),c;const p=e[0],u=e.slice(1),d=[];function f(e){Array.isArray(e)?e.forEach((e=>{d.push(e)})):d.push(e)}if(("string"!=typeof p||a)&&t&&Object.hasOwn(t,p))f(this._trace(u,t[p],h(r,p),t,p,n,o));else if("*"===p)this._walk(t,(e=>{f(this._trace(u,t[e],h(r,e),t,e,n,!0,!0))}));else if(".."===p)f(this._trace(u,t,r,s,i,n,o)),this._walk(t,(s=>{"object"==typeof t[s]&&f(this._trace(e.slice(),t[s],h(r,s),t,s,n,!0))}));else{if("^"===p)return this._hasParentSelector=!0,{path:r.slice(0,-1),expr:u,isParentSelector:!0};if("~"===p)return c={path:h(r,p),value:i,parent:s,parentProperty:null},this._handleCallback(c,n,"property"),c;if("$"===p)f(this._trace(u,t,r,null,null,n,o));else if(/^(-?\d*):(-?\d*):?(\d*)$/u.test(p))f(this._slice(p,u,t,r,s,i,n));else if(0===p.indexOf("?(")){if(!1===this.currEval)throw new Error("Eval [?(expr)] prevented in JSONPath expression.");const e=p.replace(/^\?\((.*?)\)$/u,"$1"),o=/@.?([^?]*)[['](\??\(.*?\))(?!.\)\])[\]']/gu.exec(e);o?this._walk(t,(e=>{const a=[o[2]],l=o[1]?t[e][o[1]]:t[e];this._trace(a,l,r,s,i,n,!0).length>0&&f(this._trace(u,t[e],h(r,e),t,e,n,!0))})):this._walk(t,(o=>{this._eval(e,t[o],o,r,s,i)&&f(this._trace(u,t[o],h(r,o),t,o,n,!0))}))}else if("("===p[0]){if(!1===this.currEval)throw new Error("Eval [(expr)] prevented in JSONPath expression.");f(this._trace(l(this._eval(p,t,r.at(-1),r.slice(0,-1),s,i),u),t,r,s,i,n,o))}else if("@"===p[0]){let e=!1;const o=p.slice(1,-2);switch(o){case"scalar":t&&["object","function"].includes(typeof t)||(e=!0);break;case"boolean":case"string":case"undefined":case"function":typeof t===o&&(e=!0);break;case"integer":!Number.isFinite(t)||t%1||(e=!0);break;case"number":Number.isFinite(t)&&(e=!0);break;case"nonFinite":"number"!=typeof t||Number.isFinite(t)||(e=!0);break;case"object":t&&typeof t===o&&(e=!0);break;case"array":Array.isArray(t)&&(e=!0);break;case"other":e=this.currOtherTypeCallback(t,r,s,i);break;case"null":null===t&&(e=!0);break;default:throw new TypeError("Unknown value type "+o)}if(e)return c={path:r,value:t,parent:s,parentProperty:i},this._handleCallback(c,n,"value"),c}else if("`"===p[0]&&t&&Object.hasOwn(t,p.slice(1))){const e=p.slice(1);f(this._trace(u,t[e],h(r,e),t,e,n,o,!0))}else if(p.includes(",")){const e=p.split(",");for(const o of e)f(this._trace(l(o,u),t,r,s,i,n,!0))}else!a&&t&&Object.hasOwn(t,p)&&f(this._trace(u,t[p],h(r,p),t,p,n,o,!0))}if(this._hasParentSelector)for(let e=0;e<d.length;e++){const r=d[e];if(r&&r.isParentSelector){const a=this._trace(r.expr,t,r.path,s,i,n,o);if(Array.isArray(a)){d[e]=a[0];const t=a.length;for(let r=1;r<t;r++)e++,d.splice(e,0,a[r])}else d[e]=a}}return d},p.prototype._walk=function(e,t){if(Array.isArray(e)){const r=e.length;for(let e=0;e<r;e++)t(e)}else e&&"object"==typeof e&&Object.keys(e).forEach((e=>{t(e)}))},p.prototype._slice=function(e,t,r,s,i,n,o){if(!Array.isArray(r))return;const a=r.length,h=e.split(":"),c=h[2]&&Number.parseInt(h[2])||1;let p=h[0]&&Number.parseInt(h[0])||0,u=h[1]&&Number.parseInt(h[1])||a;p=p<0?Math.max(0,p+a):Math.min(a,p),u=u<0?Math.max(0,u+a):Math.min(a,u);const d=[];for(let e=p;e<u;e+=c){this._trace(l(e,t),r,s,i,n,o,!0).forEach((e=>{d.push(e)}))}return d},p.prototype._eval=function(e,t,r,s,i,n){this.currSandbox._$_parentProperty=n,this.currSandbox._$_parent=i,this.currSandbox._$_property=r,this.currSandbox._$_root=this.json,this.currSandbox._$_v=t;const o=e.includes("@path");o&&(this.currSandbox._$_path=p.toPathString(s.concat([r])));const a=this.currEval+"Script:"+e;if(!p.cache[a]){let t=e.replaceAll("@parentProperty","_$_parentProperty").replaceAll("@parent","_$_parent").replaceAll("@property","_$_property").replaceAll("@root","_$_root").replaceAll(/@([.\s)[])/gu,"_$_v$1");if(o&&(t=t.replaceAll("@path","_$_path")),"safe"===this.currEval||!0===this.currEval||void 0===this.currEval)p.cache[a]=new this.safeVm.Script(t);else if("native"===this.currEval)p.cache[a]=new this.vm.Script(t);else if("function"==typeof this.currEval&&this.currEval.prototype&&Object.hasOwn(this.currEval.prototype,"runInNewContext")){const e=this.currEval;p.cache[a]=new e(t)}else{if("function"!=typeof this.currEval)throw new TypeError(`Unknown "eval" property "${this.currEval}"`);p.cache[a]={runInNewContext:e=>this.currEval(t,e)}}}try{return p.cache[a].runInNewContext(this.currSandbox)}catch(t){if(this.ignoreEvalErrors)return!1;throw new Error("jsonPath: "+t.message+": "+e)}},p.cache={},p.toPathString=function(e){const t=e,r=t.length;let s="$";for(let e=1;e<r;e++)/^(~|\^|@.*?\(\))$/u.test(t[e])||(s+=/^[0-9*]+$/u.test(t[e])?"["+t[e]+"]":"['"+t[e]+"']");return s},p.toPointer=function(e){const t=e,r=t.length;let s="";for(let e=1;e<r;e++)/^(~|\^|@.*?\(\))$/u.test(t[e])||(s+="/"+t[e].toString().replaceAll("~","~0").replaceAll("/","~1"));return s},p.toPathArray=function(e){const{cache:t}=p;if(t[e])return t[e].concat();const r=[],s=e.replaceAll(/@(?:null|boolean|number|string|integer|undefined|nonFinite|scalar|array|object|function|other)\(\)/gu,";$&;").replaceAll(/[['](\??\(.*?\))[\]'](?!.\])/gu,(function(e,t){return"[#"+(r.push(t)-1)+"]"})).replaceAll(/\[['"]([^'\]]*)['"]\]/gu,(function(e,t){return"['"+t.replaceAll(".","%@%").replaceAll("~","%%@@%%")+"']"})).replaceAll("~",";~;").replaceAll(/['"]?\.['"]?(?![^[]*\])|\[['"]?/gu,";").replaceAll("%@%",".").replaceAll("%%@@%%","~").replaceAll(/(?:;)?(\^+)(?:;)?/gu,(function(e,t){return";"+t.split("").join(";")+";"})).replaceAll(/;;;|;;/gu,";..;").replaceAll(/;$|'?\]|'$/gu,"").split(";").map((function(e){const t=e.match(/#(\d+)/u);return t&&t[1]?r[t[1]]:e}));return t[e]=s,t[e].concat()},p.prototype.safeVm={Script:class{constructor(e){this.code=e,this.ast=r(this.code)}runInNewContext(e){const t={...e};return a.evalAst(this.ast,t)}}};p.prototype.vm={Script:class{constructor(e){this.code=e}runInNewContext(e){let t=this.code;const r=Object.keys(e),s=[];!function(e,t,r){const s=e.length;for(let i=0;i<s;i++)r(e[i])&&t.push(e.splice(i--,1)[0])}(r,s,(t=>"function"==typeof e[t]));const i=r.map((t=>e[t]));t=s.reduce(((t,r)=>{let s=e[r].toString();return/function/u.test(s)||(s="function "+s),"var "+r+"="+s+";"+t}),"")+t,/(['"])use strict\1/u.test(t)||r.includes("arguments")||(t="var arguments = undefined;"+t),t=t.replace(/;\s*$/u,"");const n=t.lastIndexOf(";"),o=n>-1?t.slice(0,n+1)+" return "+t.slice(n+1):" return "+t;return new Function(...r,o)(...i)}}};export{p as JSONPath};
 //# sourceMappingURL=index-browser-esm.min.js.map

dist/index-node-esm.js

@@ -1301,2 +1301,5 @@ import vm from 'vm';
       }
+      if (obj === Function && (prop === 'call' || prop === 'apply')) {
+        throw new Error('Function.prototype.call and ' + 'Function.prototype.apply are disabled');
+      }
       if (result === Function) {
@@ -1303,0 +1306,0 @@ return result; // Don't bind so can identify and throw later

package.json

 {
   "author": "Stefan Goessner",
   "name": "jsonpath-plus",
-  "version": "10.0.5",
+  "version": "10.0.6",
   "type": "module",
@@ -6,0 +6,0 @@ "bin": {

src/Safe-Script.js

@@ -117,2 +117,8 @@ /* eslint-disable no-bitwise -- Convenient */
             }
+            if (obj === Function && (prop === 'call' || prop === 'apply')) {
+                throw new Error(
+                    'Function.prototype.call and ' +
+                    'Function.prototype.apply are disabled'
+                );
+            }
             if (result === Function) {
@@ -119,0 +125,0 @@ return result; // Don't bind so can identify and throw later

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

612128

increased by0.32%

Lines of code

9498

increased by0.21%

No dependency changes