parse-link-header - npm Package Compare versions

Comparing version 1.0.1 to 2.0.0

index.js

@@ -7,2 +7,5 @@ 'use strict';
 
+const PARSE_LINK_HEADER_MAXLEN = parseInt(process.env.PARSE_LINK_HEADER_MAXLEN) || 2000;
+const PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED = process.env.PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED != null
+
 function hasRel(x) {
@@ -50,4 +53,17 @@ return x && x.rel;
 
+function checkHeader(linkHeader){
+  if (!linkHeader) return false;
+
+  if (linkHeader.length > PARSE_LINK_HEADER_MAXLEN) {
+    if (PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED) {
+      throw new Error('Input string too long, it should be under ' + PARSE_LINK_HEADER_MAXLEN + ' characters.');
+    } else {
+        return false;
+      }
+  }
+  return true;
+}
+
 module.exports = function (linkHeader) {
-  if (!linkHeader) return null;
+  if (!checkHeader(linkHeader)) return null;
 
@@ -54,0 +70,0 @@ return linkHeader.split(/,\s*</)

package.json

 {
   "name": "parse-link-header",
-  "version": "1.0.1",
+  "version": "2.0.0",
   "description": "Parses a link header and returns paging information for each contained link.",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -49,4 +49,12 @@ # parse-link-header [![build status](https://secure.travis-ci.org/thlorenz/parse-link-header.png)](http://travis-ci.org/thlorenz/parse-link-header)
 
+### Environmental Variables
+
+To avoid redundantly parsing of extremely long (invalid) input, the package uses 2 env variabes:
+
+`PARSE_LINK_HEADER_MAXLEN` - Sets the number of characters the input should be limited to - longer inputs will not be handled. Defaults to `2000`.
+
+`PARSE_LINK_HEADER_THROW_ON_MAXLEN_EXCEEDED` - Defines behavior for when the `PARSE_LINK_HEADER_MAXLEN` parameter is exceeded. if defined, an error will be thrown; if it's `null`, the function fails silently by returning `null`. Defaults to `null`.
+
 ### Formatting a link header
 
-The purpose of this module it´s to parse the link header information. To format an object generated by this module back to the link header string use the [format-link-header](https://github.com/jonathansamines/format-link-header) module.
+The purpose of this module is to parse the link header information. To format an object generated by this module back to the link header string, use the [format-link-header](https://github.com/jonathansamines/format-link-header) module.

test/parse-link-header.js

@@ -189,1 +189,19 @@ 'use strict';
 })
+
+test('parsing an extremely long link header', function (t) {
+  function payload (n) {
+    var ret = ""
+    for (var i = 0; i < n; i++) {
+      ret += " "
+    }
+    return ret
+    }
+  var linkHeader = '; rel="' + payload(10000) + '",'
+
+  t.equal(
+      parse(linkHeader)
+    , null
+    , 'correctly returns null when dealing with an extremely long link header'
+  )
+  t.end()
+})

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

12729

increased by12.11%

Lines of code

243

increased by13.55%

Number of lines in readme file

60

increased by15.38%

Worsened metrics

Number of package files

7

decreased by-12.5%

Number of low supply chain risk alerts

2

increased byInfinity%

No dependency changes