mongodb-connection-string-url - npm Package Compare versions

Comparing version 2.4.1 to 2.4.2

lib/index.js

@@ -8,3 +8,7 @@ "use strict";
 const DUMMY_HOSTNAME = '__this_is_a_placeholder__';
-const HOSTS_REGEX = new RegExp(String.raw `^(?<protocol>mongodb(?:\+srv|)):\/\/(?:(?<username>[^:]*)(?::(?<password>[^@]*))?@)?(?<hosts>(?!:)[^\/?@]+)(?<rest>.*)`);
+function connectionStringHasValidScheme(connectionString) {
+    return (connectionString.startsWith('mongodb://') ||
+        connectionString.startsWith('mongodb+srv://'));
+}
+const HOSTS_REGEX = new RegExp(String.raw `^(?<protocol>mongodb(?:\+srv|)):\/\/(?:(?<username>[^:]*)(?::(?<password>[^@]*))?@)?(?<hosts>(?!:)[^\/?@]*)(?<rest>.*)`);
 class CaseInsensitiveMap extends Map {
@@ -81,2 +85,5 @@ delete(name) {
         var _a;
+        if (!connectionStringHasValidScheme(uri)) {
+            throw new MongoParseError('Invalid scheme, expected connection string to start with "mongodb://" or "mongodb+srv://"');
+        }
         const match = uri.match(HOSTS_REGEX);
@@ -83,0 +90,0 @@ if (!match) {

package.json

 {
   "name": "mongodb-connection-string-url",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "MongoDB connection strings, based on the WhatWG URL API",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

36467

increased by1.67%

Lines of code

341

increased by2.1%

Worsened metrics

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes