diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md new file mode 100644 index 000000000000..7131009e599b --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md @@ -0,0 +1,133 @@ + + +# isSafeToken + +> Test whether a JSON Pointer reference token is safe. + + + +
+ +This function tests whether a [JSON Pointer][json-pointer] reference token is safe to use for property traversal. Tokens matching `__proto__`, `constructor`, or `prototype` are considered unsafe as they are common prototype pollution vectors. + +
+ + + + + +
+ +## Usage + +```javascript +var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); +``` + +#### isSafeToken( token ) + +Tests whether a JSON Pointer reference token is safe. + +```javascript +var bool = isSafeToken( 'foo' ); +// returns true + +bool = isSafeToken( '__proto__' ); +// returns false + +bool = isSafeToken( 'constructor' ); +// returns false + +bool = isSafeToken( 'prototype' ); +// returns false +``` + +
+ + + + + +
+ +
+ + + + + +
+ +## Examples + + + +```javascript +var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); + +var bool = isSafeToken( 'foo' ); +// returns true + +bool = isSafeToken( '0' ); +// returns true + +bool = isSafeToken( '-' ); +// returns true + +bool = isSafeToken( '__proto__' ); +// returns false + +bool = isSafeToken( 'constructor' ); +// returns false + +bool = isSafeToken( 'prototype' ); +// returns false +``` + +
+ + + + + +
+ +
+ + + + + +
+ +
+ + + + + +
+ +[json-pointer]: https://tools.ietf.org/html/rfc6901 + +
+ + diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js new file mode 100644 index 000000000000..a955ca90c766 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js @@ -0,0 +1,62 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MODULES // + +var bench = require( '@stdlib/bench' ); +var isBoolean = require( '@stdlib/assert/is-boolean' ).isPrimitive; +var pkg = require( './../package.json' ).name; +var isSafeToken = require( './../lib' ); + + +// MAIN // + +bench( pkg, function benchmark( b ) { + var values; + var out; + var v; + var i; + + values = [ + 'foo', + 'bar', + '__proto__', + 'constructor', + 'prototype', + '0', + '-', + 'baz' + ]; + + b.tic(); + for ( i = 0; i < b.iterations; i++ ) { + v = values[ i % values.length ]; + out = isSafeToken( v ); + if ( typeof out !== 'boolean' ) { + b.fail( 'should return a boolean' ); + } + } + b.toc(); + if ( !isBoolean( out ) ) { + b.fail( 'should return a boolean' ); + } + b.pass( 'benchmark finished' ); + b.end(); +}); diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt new file mode 100644 index 000000000000..2b0b06093e23 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt @@ -0,0 +1,32 @@ + +{{alias}}( token ) + Tests whether a JSON Pointer reference token is safe. + + Parameters + ---------- + token: string + JSON Pointer reference token. + + Returns + ------- + bool: boolean + Boolean indicating whether a token is safe. + + Examples + -------- + > var bool = {{alias}}( 'foo' ) + true + > bool = {{alias}}( '0' ) + true + > bool = {{alias}}( '-' ) + true + > bool = {{alias}}( '__proto__' ) + false + > bool = {{alias}}( 'constructor' ) + false + > bool = {{alias}}( 'prototype' ) + false + + See Also + -------- + diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts new file mode 100644 index 000000000000..adca029e9c38 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts @@ -0,0 +1,48 @@ +/* +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +// TypeScript Version: 4.1 + +/** +* Tests whether a JSON Pointer reference token is safe. +* +* @param token - reference token +* @returns boolean indicating whether a token is safe +* +* @example +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* @example +* var bool = isSafeToken( '__proto__' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'constructor' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'prototype' ); +* // returns false +*/ +declare function isSafeToken( token: string ): boolean; + + +// EXPORTS // + +export = isSafeToken; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts new file mode 100644 index 000000000000..9a6131706819 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts @@ -0,0 +1,34 @@ +/* +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +import isSafeToken = require( './index' ); + + +// TESTS // + +// The function returns a boolean... +{ + isSafeToken( 'foo' ); // $ExpectType boolean + isSafeToken( '__proto__' ); // $ExpectType boolean +} + +// The compiler throws an error if the function is provided an unsupported number of arguments... +{ + isSafeToken(); // $ExpectError + isSafeToken( 'foo', 123 ); // $ExpectError +} diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js new file mode 100644 index 000000000000..b81494ac9c6f --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js @@ -0,0 +1,45 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +var isSafeToken = require( './../lib' ); + +var bool = isSafeToken( 'foo' ); +console.log( bool ); +// => true + +bool = isSafeToken( '0' ); +console.log( bool ); +// => true + +bool = isSafeToken( '-' ); +console.log( bool ); +// => true + +bool = isSafeToken( '__proto__' ); +console.log( bool ); +// => false + +bool = isSafeToken( 'constructor' ); +console.log( bool ); +// => false + +bool = isSafeToken( 'prototype' ); +console.log( bool ); +// => false diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js new file mode 100644 index 000000000000..f901786b8620 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js @@ -0,0 +1,49 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +/** +* Test whether a JSON Pointer reference token is safe. +* +* @module @stdlib/utils/json-pointer/base/assert/is-safe-token +* +* @example +* var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); +* +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* bool = isSafeToken( '__proto__' ); +* // returns false +* +* bool = isSafeToken( 'constructor' ); +* // returns false +* +* bool = isSafeToken( 'prototype' ); +* // returns false +*/ + +// MODULES // + +var main = require( './main.js' ); + + +// EXPORTS // + +module.exports = main; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js new file mode 100644 index 000000000000..a3a30788f12d --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js @@ -0,0 +1,67 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MODULES // + +var contains = require( '@stdlib/array/base/assert/contains' ).factory; + + +// VARIABLES // + +var PROPS = [ + '__proto__', + 'constructor', + 'prototype' +]; +var isInvalid = contains( PROPS ); + + +// MAIN // + +/** +* Tests whether a JSON Pointer reference token is safe. +* +* @param {string} token - reference token +* @returns {boolean} boolean indicating whether a token is safe +* +* @example +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* @example +* var bool = isSafeToken( '__proto__' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'constructor' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'prototype' ); +* // returns false +*/ +function isSafeToken( token ) { + return !isInvalid( token ); +} + + +// EXPORTS // + +module.exports = isSafeToken; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json new file mode 100644 index 000000000000..95f5cd308efb --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json @@ -0,0 +1,73 @@ +{ + "name": "@stdlib/utils/json-pointer/base/assert/is-safe-token", + "version": "0.0.0", + "description": "Test whether a JSON Pointer reference token is safe.", + "license": "Apache-2.0", + "author": { + "name": "The Stdlib Authors", + "url": "https://github.com/stdlib-js/stdlib/graphs/contributors" + }, + "contributors": [ + { + "name": "The Stdlib Authors", + "url": "https://github.com/stdlib-js/stdlib/graphs/contributors" + } + ], + "main": "./lib", + "directories": { + "benchmark": "./benchmark", + "doc": "./docs", + "example": "./examples", + "lib": "./lib", + "test": "./test" + }, + "types": "./docs/types", + "scripts": {}, + "homepage": "https://github.com/stdlib-js/stdlib", + "repository": { + "type": "git", + "url": "git://github.com/stdlib-js/stdlib.git" + }, + "bugs": { + "url": "https://github.com/stdlib-js/stdlib/issues" + }, + "dependencies": {}, + "devDependencies": {}, + "engines": { + "node": ">=0.10.0", + "npm": ">2.7.0" + }, + "os": [ + "aix", + "darwin", + "freebsd", + "linux", + "macos", + "openbsd", + "sunos", + "win32", + "windows" + ], + "keywords": [ + "stdlib", + "stdutils", + "utilities", + "utility", + "utils", + "util", + "base", + "assert", + "test", + "check", + "is", + "json", + "pointer", + "json-pointer", + "rfc6901", + "token", + "safe", + "prototype", + "pollution", + "security" + ] +} diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js new file mode 100644 index 000000000000..7672806037aa --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js @@ -0,0 +1,77 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MODULES // + +var tape = require( 'tape' ); +var isSafeToken = require( './../lib' ); + + +// TESTS // + +tape( 'main export is a function', function test( t ) { + t.ok( true, __filename ); + t.strictEqual( typeof isSafeToken, 'function', 'main export is a function' ); + t.end(); +}); + +tape( 'the function returns `false` if provided an unsafe token (prototype pollution vector)', function test( t ) { + var values; + var bool; + var i; + + values = [ + '__proto__', + 'constructor', + 'prototype' + ]; + for ( i = 0; i < values.length; i++ ) { + bool = isSafeToken( values[ i ] ); + t.strictEqual( bool, false, 'returns expected value' ); + } + t.end(); +}); + +tape( 'the function returns `true` if provided a safe reference token', function test( t ) { + var values; + var bool; + var i; + + values = [ + 'foo', + 'bar', + 'baz', + '0', + '1', + '-', + 'a/b', + 'm~n', + '', + 'hello world', + 'toString', + 'valueOf', + 'hasOwnProperty' + ]; + for ( i = 0; i < values.length; i++ ) { + bool = isSafeToken( values[ i ] ); + t.strictEqual( bool, true, 'returns expected value' ); + } + t.end(); +});