tsoa

node_modules/@hapi/bourne/lib/index.d.ts

@@ -0,0 +1,62 @@
+interface Reviver {
+  (this: any, key: string, value: any): any;
+}
+
+interface ParseOptions {
+  /**
+   * - `'error'` - throw a `SyntaxError` when a `__proto__` key is found. This is the default value.
+   * - `'remove'` - deletes any `__proto__` keys from the result object.
+   * - `'ignore'` - skips all validation (same as calling `JSON.parse()` directly).
+   */
+  protoAction?: 'error' | 'remove' | 'ignore';
+}
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ */
+export function parse(text: string): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ */
+export function parse(text: string, reviver: Reviver): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param options optional configuration object.
+ */
+export function parse(text: string, options: ParseOptions): any;
+
+/**
+ * Parses a given JSON-formatted text into an object.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ * @param options optional configuration object.
+ */
+export function parse(text: string, reviver: Reviver, options: ParseOptions): any;
+
+interface ScanOptions {
+  /**
+   * - `'error'` - throw a `SyntaxError` when a `__proto__` key is found. This is the default value.
+   * - `'remove'` - deletes any `__proto__` keys from the input `obj`.
+   */
+  protoAction?: 'error' | 'remove';
+}
+
+/**
+ * Scans a given object for prototype properties.
+ * @param obj the object being scanned.
+ * @param options optional configuration object.
+ */
+export function scan(obj: any, options?: ScanOptions): void;
+
+/**
+ * Parses a given JSON-formatted text into an object or `null` if an error is found.
+ * @param text the JSON text string.
+ * @param reviver the `JSON.parse()` optional `reviver` argument.
+ */
+export function safeParse(text: string, reviver?: Reviver) : any | null;

node_modules/@hapi/bourne/lib/index.js

@@ -0,0 +1,87 @@
+'use strict';
+
+
+const internals = {
+    suspectRx: /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*\:/
+};
+
+
+exports.parse = function (text, ...args) {
+
+    // Normalize arguments
+
+    const firstOptions = typeof args[0] === 'object' && args[0];
+    const reviver = args.length > 1 || !firstOptions ? args[0] : undefined;
+    const options = (args.length > 1 && args[1]) || firstOptions || {};
+
+    // Parse normally, allowing exceptions
+
+    const obj = JSON.parse(text, reviver);
+
+    // options.protoAction: 'error' (default) / 'remove' / 'ignore'
+
+    if (options.protoAction === 'ignore') {
+        return obj;
+    }
+
+    // Ignore null and non-objects
+
+    if (!obj ||
+        typeof obj !== 'object') {
+
+        return obj;
+    }
+
+    // Check original string for potential exploit
+
+    if (!text.match(internals.suspectRx)) {
+        return obj;
+    }
+
+    // Scan result for proto keys
+
+    exports.scan(obj, options);
+
+    return obj;
+};
+
+
+exports.scan = function (obj, options = {}) {
+
+    let next = [obj];
+
+    while (next.length) {
+        const nodes = next;
+        next = [];
+
+        for (const node of nodes) {
+            if (Object.prototype.hasOwnProperty.call(node, '__proto__')) {      // Avoid calling node.hasOwnProperty directly
+                if (options.protoAction !== 'remove') {
+                    throw new SyntaxError('Object contains forbidden prototype property');
+                }
+
+                delete node.__proto__;
+            }
+
+            for (const key in node) {
+                const value = node[key];
+                if (value &&
+                    typeof value === 'object') {
+
+                    next.push(node[key]);
+                }
+            }
+        }
+    }
+};
+
+
+exports.safeParse = function (text, reviver) {
+
+    try {
+        return exports.parse(text, reviver);
+    }
+    catch (ignoreError) {
+        return null;
+    }
+};