Skip to content

Commit cb80998

Browse files
cs-rajcs-raj
authored
Merge pull request #6 from contentstack/next
Next
2 parents 89849cb + 1d1c9fa commit cb80998

File tree

9 files changed

+157
-15
lines changed

9 files changed

+157
-15
lines changed

‎.github/workflows/npm-publish.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,4 @@ jobs:
3131
- run: npm ci
3232
- run: npm publish --tag latest
3333
env:
34-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
NODE_AUTH_TOKEN: ${{ secrets.PKG_TOKEN }}

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
## Change log
22

3+
### Version: 4.0.1
4+
#### Date: May-20-2024
5+
Fixed SRE vulnerabilities
36

47
### Version: 4.0.0
58
#### Date: April-23-2024

‎package-lock.json‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@contentstack/delivery-sdk",
3-
"version": "4.0.0",
3+
"version": "4.0.1",
44
"type": "commonjs",
55
"main": "./dist/cjs/src/index.js",
66
"types": "./dist/types/src/index.d.ts",

‎src/lib/contentstack.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import { Policy, StackConfig } from './types';
66
import { getHost } from './utils';
77
export * as Utils from '@contentstack/utils';
88

9+
let version = '{{VERSION}}';
10+
911
/**
1012
* @method stack
1113
* @memberof Contentstack
@@ -67,10 +69,16 @@ export function stack(config: StackConfig): StackClass {
6769
throw new Error('Environment for Stack is required');
6870
}
6971

72+
if (config.branch) {
73+
defaultConfig.headers.branch = config.branch;
74+
}
75+
7076
if (config.early_access) {
7177
defaultConfig.headers['x-header-ea'] = config.early_access.join(',');
7278
}
7379

80+
defaultConfig.headers['X-User-Agent'] = 'contentstack-delivery-typescript-{{PLATFORM}}/' + version;
81+
7482
// return new Stack(httpClient(defaultConfig), config);
7583
const client = httpClient(defaultConfig as any);
7684

‎src/lib/query.ts‎

Lines changed: 136 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,27 @@ export class Query extends BaseQuery {
1818
this._parameters = { ...this._parameters, ...queryObj };
1919
}
2020
}
21+
// Validate if input is alphanumeric
22+
private isValidAlphanumeric(input: string): boolean {
23+
const alphanumericRegex = /^[a-zA-Z0-9_.-]+$/;
24+
return alphanumericRegex.test(input);
25+
}
26+
// Validate if input is a valid regex pattern
27+
private isValidRegexPattern(input: string): boolean {
28+
try {
29+
RegExp(input)
30+
return true;
31+
}
32+
catch {
33+
return false;
34+
}
35+
36+
}
37+
38+
// Validate if value is an array of strings, numbers, or booleans
39+
private isValidValue(value: any[]): boolean {
40+
return Array.isArray(value) && value.every(item => typeof item === 'string' || typeof item === 'number' || typeof item === 'boolean');
41+
}
2142

2243
/**
2344
* @method where
@@ -40,18 +61,22 @@ export class Query extends BaseQuery {
4061
* @returns {Query}
4162
*/
4263
where(
43-
fieldUid: string,
44-
queryOperation: QueryOperation | TaxonomyQueryOperation,
64+
fieldUid: string,
65+
queryOperation: QueryOperation | TaxonomyQueryOperation,
4566
fields: string | string[] | number | number[] | object | boolean,
4667
additionalData?: object
4768
): Query {
69+
if (!this.isValidAlphanumeric(fieldUid)) {
70+
console.error("Invalid fieldUid:", fieldUid);
71+
return this;
72+
}
4873
if (queryOperation == QueryOperation.EQUALS) {
4974
this._parameters[fieldUid] = fields;
50-
} else {
75+
}
76+
else {
5177
const parameterValue: { [key in QueryOperation]?: string | string[] } = { [queryOperation]: fields, ...additionalData };
5278
this._parameters[fieldUid] = parameterValue;
5379
}
54-
5580
return this;
5681
}
5782

@@ -70,11 +95,18 @@ export class Query extends BaseQuery {
7095
* @returns {Query}
7196
*/
7297
regex(fieldUid: string, regexPattern: string, options?: string): Query {
73-
this._parameters[fieldUid] = { $regex: regexPattern };
74-
75-
if (options) this._parameters[fieldUid].$options = options;
76-
77-
return this;
98+
if (!this.isValidAlphanumeric(fieldUid)) {
99+
console.error("Invalid fieldUid:", fieldUid);
100+
return this;
101+
}
102+
if (!this.isValidRegexPattern(regexPattern)) {
103+
throw new Error("Invalid regexPattern: Must be a valid regular expression");
104+
}
105+
else {
106+
this._parameters[fieldUid] = { $regex: regexPattern };
107+
if (options) this._parameters[fieldUid].$options = options;
108+
return this;
109+
}
78110
}
79111

80112
/**
@@ -95,8 +127,10 @@ export class Query extends BaseQuery {
95127
*/
96128
whereIn(referenceUid: string, queryInstance: Query): Query {
97129
// eslint-disable-next-line @typescript-eslint/naming-convention, prettier/prettier
130+
if (!this.isValidAlphanumeric(referenceUid)) {
131+
throw new Error("Invalid referenceUid: Must be alphanumeric.");
132+
}
98133
this._parameters[referenceUid] = { '$in_query': queryInstance._parameters };
99-
100134
return this;
101135
}
102136

@@ -118,8 +152,10 @@ export class Query extends BaseQuery {
118152
*/
119153
whereNotIn(referenceUid: string, queryInstance: Query): Query {
120154
// eslint-disable-next-line @typescript-eslint/naming-convention, prettier/prettier
155+
if (!this.isValidAlphanumeric(referenceUid)) {
156+
throw new Error("Invalid referenceUid: Must be alphanumeric.");
157+
}
121158
this._parameters[referenceUid] = { '$nin_query': queryInstance._parameters };
122-
123159
return this;
124160
}
125161

@@ -183,6 +219,14 @@ export class Query extends BaseQuery {
183219
* @returns {Query}
184220
*/
185221
containedIn(key: string, value: (string | number | boolean)[]): Query {
222+
if (!this.isValidAlphanumeric(key)) {
223+
console.error("Invalid key:", key);
224+
return this;
225+
}
226+
if (!this.isValidValue(value)) {
227+
console.error("Invalid value:", value);
228+
return this;
229+
}
186230
this._parameters[key] = { '$in': value };
187231
return this;
188232
}
@@ -201,6 +245,14 @@ export class Query extends BaseQuery {
201245
* @returns {Query}
202246
*/
203247
notContainedIn(key: string, value: (string | number | boolean)[]): Query {
248+
if (!this.isValidAlphanumeric(key)) {
249+
console.error("Invalid key:", key);
250+
return this;
251+
}
252+
if (!this.isValidValue(value)) {
253+
console.error("Invalid value:", value);
254+
return this;
255+
}
204256
this._parameters[key] = { '$nin': value };
205257
return this;
206258
}
@@ -219,6 +271,10 @@ export class Query extends BaseQuery {
219271
* @returns {Query}
220272
*/
221273
exists(key: string): Query {
274+
if (!this.isValidAlphanumeric(key)) {
275+
console.error("Invalid key:", key);
276+
return this;
277+
}
222278
this._parameters[key] = { '$exists': true };
223279
return this;
224280
}
@@ -237,6 +293,10 @@ export class Query extends BaseQuery {
237293
* @returns {Query}
238294
*/
239295
notExists(key: string): Query {
296+
if (!this.isValidAlphanumeric(key)) {
297+
console.error("Invalid key:", key);
298+
return this;
299+
}
240300
this._parameters[key] = { '$exists': false };
241301
return this;
242302
}
@@ -300,6 +360,14 @@ export class Query extends BaseQuery {
300360
* @returns {Query}
301361
*/
302362
equalTo(key: string, value: string | number | boolean): Query {
363+
if (!this.isValidAlphanumeric(key)) {
364+
console.error("Invalid key:", key);
365+
return this;
366+
}
367+
if (typeof value !== 'string' && typeof value !== 'number') {
368+
console.error("Invalid value (expected string or number):", value);
369+
return this;
370+
}
303371
this._parameters[key] = value;
304372
return this;
305373
}
@@ -317,6 +385,14 @@ export class Query extends BaseQuery {
317385
* @returns {Query}
318386
*/
319387
notEqualTo(key: string, value: string | number | boolean): Query {
388+
if (!this.isValidAlphanumeric(key)) {
389+
console.error("Invalid key:", key);
390+
return this;
391+
}
392+
if (typeof value !== 'string' && typeof value !== 'number') {
393+
console.error("Invalid value (expected string or number):", value);
394+
return this;
395+
}
320396
this._parameters[key] = { '$ne': value };
321397
return this;;
322398
}
@@ -335,6 +411,10 @@ export class Query extends BaseQuery {
335411
* @returns {Query}
336412
*/
337413
referenceIn(key: string, query: Query): Query {
414+
if (!this.isValidAlphanumeric(key)) {
415+
console.error("Invalid key:", key);
416+
return this;
417+
}
338418
this._parameters[key] = { '$in_query': query._parameters }
339419
return this;
340420
}
@@ -353,6 +433,10 @@ export class Query extends BaseQuery {
353433
* @returns {Query}
354434
*/
355435
referenceNotIn(key: string, query: Query): Query {
436+
if (!this.isValidAlphanumeric(key)) {
437+
console.error("Invalid key:", key);
438+
return this;
439+
}
356440
this._parameters[key] = { '$nin_query': query._parameters }
357441
return this;
358442
}
@@ -371,6 +455,10 @@ export class Query extends BaseQuery {
371455
* @returns {Query}
372456
*/
373457
tags(values: (string | number | boolean)[]): Query {
458+
if (!this.isValidValue(values)) {
459+
console.error("Invalid value:", values);
460+
return this;
461+
}
374462
this._parameters['tags'] = values;
375463
return this;
376464
}
@@ -389,6 +477,10 @@ export class Query extends BaseQuery {
389477
* @returns {Query}
390478
*/
391479
search(key: string): Query {
480+
if (!this.isValidAlphanumeric(key)) {
481+
console.error("Invalid key:", key);
482+
return this;
483+
}
392484
this._queryParams['typeahead'] = key
393485
return this
394486
}
@@ -407,6 +499,15 @@ export class Query extends BaseQuery {
407499
* @returns {Query}
408500
*/
409501
lessThan(key: string, value: (string | number)): Query {
502+
if (!this.isValidAlphanumeric(key)) {
503+
console.error("Invalid key:", key);
504+
return this;
505+
}
506+
if (typeof value !== 'string' && typeof value !== 'number') {
507+
console.error("Invalid value (expected string or number):", value);
508+
return this;
509+
}
510+
410511
this._parameters[key] = { '$lt': value };
411512
return this;
412513
}
@@ -425,6 +526,14 @@ export class Query extends BaseQuery {
425526
* @returns {Query}
426527
*/
427528
lessThanOrEqualTo(key: string, value: (string | number)): Query {
529+
if (!this.isValidAlphanumeric(key)) {
530+
console.error("Invalid key:", key);
531+
return this;
532+
}
533+
if (typeof value !== 'string' && typeof value !== 'number') {
534+
console.error("Invalid value (expected string or number):", value);
535+
return this;
536+
}
428537
this._parameters[key] = { '$lte': value };
429538
return this;
430539
}
@@ -443,6 +552,14 @@ export class Query extends BaseQuery {
443552
* @returns {Query}
444553
*/
445554
greaterThan(key: string, value: (string | number)): Query {
555+
if (!this.isValidAlphanumeric(key)) {
556+
console.error("Invalid key:", key);
557+
return this;
558+
}
559+
if (typeof value !== 'string' && typeof value !== 'number') {
560+
console.error("Invalid value (expected string or number):", value);
561+
return this;
562+
}
446563
this._parameters[key] = { '$gt': value };
447564
return this;
448565
}
@@ -461,6 +578,14 @@ export class Query extends BaseQuery {
461578
* @returns {Query}
462579
*/
463580
greaterThanOrEqualTo(key: string, value: (string | number)): Query {
581+
if (!this.isValidAlphanumeric(key)) {
582+
console.error("Invalid key:", key);
583+
return this;
584+
}
585+
if (typeof value !== 'string' && typeof value !== 'number') {
586+
console.error("Invalid value (expected string or number):", value);
587+
return this;
588+
}
464589
this._parameters[key] = { '$gte': value };
465590
return this;
466591
}

‎src/lib/types.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ export interface StackConfig extends HttpClientParams {
1414
apiKey: string;
1515
deliveryToken: string;
1616
environment: string;
17+
branch?: string;
1718
early_access?: string[];
1819
region?: Region;
1920
locale?: string;

‎test/api/live-preview.spec.ts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,20 @@ dotenv.config();
77
const apiKey = process.env.API_KEY as string
88
const deliveryToken = process.env.DELIVERY_TOKEN as string
99
const environment = process.env.ENVIRONMENT as string
10+
const branch = process.env.BRANCH as string
1011

1112
describe('Live preview tests', () => {
1213
test('should check for values initialized', () => {
1314
const stack = contentstack.stack({
1415
apiKey: apiKey,
1516
deliveryToken: deliveryToken,
1617
environment: environment,
18+
branch: branch,
1719
});
1820
const livePreviewObject = stack.config.live_preview;
1921
expect(livePreviewObject).toBeUndefined();
2022
expect(stack.config.host).toBe('cdn.contentstack.io');
23+
expect(stack.config.branch).toBe(branch);
2124
});
2225

2326
test('should check host when live preview is enabled and management token is provided', () => {

‎test/unit/contentstack.spec.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,12 +97,14 @@ describe('Contentstack', () => {
9797
apiKey: 'apiKey',
9898
deliveryToken: 'delivery',
9999
environment: 'env',
100+
branch: 'branch',
100101
};
101102
const stackInstance = createStackInstance(config);
102103
expect(stackInstance).toBeInstanceOf(Stack);
103104
expect(stackInstance.config.apiKey).toEqual(config.apiKey);
104105
expect(stackInstance.config.deliveryToken).toEqual(config.deliveryToken);
105106
expect(stackInstance.config.environment).toEqual(config.environment);
107+
expect(stackInstance.config.branch).toEqual(config.branch);
106108
done();
107109
});
108110

0 commit comments

Comments
 (0)