node-sec-patterns - npm Package Compare versions

Comparing version 2.0.3 to 2.0.4

index.js

@@ -31,6 +31,6 @@ 'use strict'
 const weakSetHas = WeakSet.prototype.has
-const { lastIndexOf, split, substring } = String.prototype
+const { indexOf, lastIndexOf, split, substring } = String.prototype
 
 const { dedot, dirname } = require('module-keys/lib/relpath.js')
-const { sep } = require('path')
+const { isAbsolute, sep } = require('path')
 
@@ -299,2 +299,9 @@ // Module keys polyfill as per module-keys/babel
 
+  function toFullModuleId (moduleId) {
+    if (moduleId[0] !== '/' && !isAbsolute(moduleId)) {
+      return `${configRoot}${sep}${moduleId}`
+    }
+    return moduleId
+  }
+
   function mayMint (pubKey) {
@@ -312,6 +319,7 @@ const moduleId = dedot(pubKey.moduleIdentifier)
         let publicKey = null
+
         // Treat the exported publicKey as the source of truth.
         try {
           // eslint-disable-next-line global-require
-          publicKey = require(`${configRoot}${sep}${moduleId}`)[publicKeySymbol]
+          publicKey = require(toFullModuleId(moduleId))[publicKeySymbol]
         } catch (failedToRequire) {
@@ -351,8 +359,20 @@ // deny
 function relModuleId (moduleIdentifier) {
-  const prefix = 'node_modules/'
-  const i = apply(lastIndexOf, moduleIdentifier, [ prefix, 0 ])
-  if (i === 0) {
-    // node_modules/foo/bar/baz -> "foo/bar/baz"
-    return apply(substring, moduleIdentifier, [ i + prefix.length ])
+  {
+    const prefix = 'node_modules/'
+    const i = apply(lastIndexOf, moduleIdentifier, [ prefix, 0 ])
+    if (i === 0) {
+      // node_modules/foo/bar/baz -> "foo/bar/baz"
+      return apply(substring, moduleIdentifier, [ i + prefix.length ])
+    }
   }
+  {
+    const infix = '/node_modules/'
+    const i = apply(indexOf, moduleIdentifier, [ infix ])
+    if (i >= 0) {
+      return apply(substring, moduleIdentifier, [ i + infix.length ])
+    }
+  }
+  if (moduleIdentifier[0] === '/') {
+    return moduleIdentifier
+  }
   return `./${moduleIdentifier}`
@@ -359,0 +379,0 @@ }

package.json

 {
   "name": "node-sec-patterns",
   "description": "Allow projects control over which dependencies can create objects that encapsulate security guarantees.",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "keywords": [
@@ -14,4 +14,3 @@ "design-patterns",
   "files": [
-    "index.js",
-    "lib/mintable.js"
+    "index.js"
   ],
@@ -18,0 +17,0 @@ "dependencies": {

README.md

@@ -191,3 +191,3 @@ # Node security design patterns
        1.  targetPackage = targetPackage.slice(targetPackage.indexOf('node_modules') + 1)
-       1.  targetPackage = targetPackage.slice(0, targetPackage[0][0] === '@' ? 2 : 1)
+       1.  targetPackage = targetPackage.slice(0, targetPackage\[0\]\[0\] === '@' ? 2 : 1)
        1.  targetPackage = targetPackage.join('/')
@@ -197,5 +197,5 @@ 1.  Fetch the target configuration
    1.  Incorporate any self nominations into the application's grants
-       1.  let selfNominations = (targetConfig.mintable || {}).selfNominate || []
+       1.  let selfNominations = (targetConfig.mintable || {}).selfNominate || \[\]
        1.  for (selfNomination of selfNominations)
-           1.  grants[selfNomination] = grants[selfNomination] || []
+           1.  grants[selfNomination] = grants[selfNomination] || \[\]
            1.  grants[selfNomination].push(
@@ -202,0 +202,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

39271

increased by1.17%

Lines of code

440

increased by4.27%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes