From db1621fb1d557e295aa01eb7923f178d5d9074b5 Mon Sep 17 00:00:00 2001 From: gururaj1512 Date: Mon, 26 Oct 2026 12:57:17 +0530 Subject: [PATCH 1/4] feat: add utils/json-pointer/base/assert/is-safe-token --- type: pre_commit_static_analysis_report description: Results of running static analysis checks when committing changes. report: - task: lint_filenames status: passed - task: lint_editorconfig status: skipped - task: lint_markdown_pkg_readmes status: passed - task: lint_markdown_docs status: na - task: lint_markdown status: na - task: lint_package_json status: passed - task: lint_repl_help status: passed - task: lint_javascript_src status: passed - task: lint_javascript_cli status: na - task: lint_javascript_examples status: passed - task: lint_javascript_tests status: passed - task: lint_javascript_benchmarks status: passed - task: lint_python status: na - task: lint_r status: na - task: lint_c_src status: na - task: lint_c_examples status: na - task: lint_c_benchmarks status: na - task: lint_c_tests_fixtures status: na - task: lint_shell status: na - task: lint_typescript_declarations status: passed - task: lint_typescript_tests status: passed - task: lint_license_headers status: passed --- --- .../base/assert/is-safe-token/README.md | 133 ++++++++++++++++++ .../is-safe-token/benchmark/benchmark.js | 62 ++++++++ .../base/assert/is-safe-token/docs/repl.txt | 32 +++++ .../is-safe-token/docs/types/index.d.ts | 48 +++++++ .../assert/is-safe-token/docs/types/test.ts | 34 +++++ .../assert/is-safe-token/examples/index.js | 45 ++++++ .../base/assert/is-safe-token/lib/index.js | 49 +++++++ .../base/assert/is-safe-token/lib/main.js | 57 ++++++++ .../base/assert/is-safe-token/package.json | 72 ++++++++++ .../base/assert/is-safe-token/test/test.js | 77 ++++++++++ 10 files changed, 609 insertions(+) create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json create mode 100644 lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md new file mode 100644 index 000000000000..7131009e599b --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/README.md @@ -0,0 +1,133 @@ + + +# isSafeToken + +> Test whether a JSON Pointer reference token is safe. + + + +
+ +This function tests whether a [JSON Pointer][json-pointer] reference token is safe to use for property traversal. Tokens matching `__proto__`, `constructor`, or `prototype` are considered unsafe as they are common prototype pollution vectors. + +
+ + + + + +
+ +## Usage + +```javascript +var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); +``` + +#### isSafeToken( token ) + +Tests whether a JSON Pointer reference token is safe. + +```javascript +var bool = isSafeToken( 'foo' ); +// returns true + +bool = isSafeToken( '__proto__' ); +// returns false + +bool = isSafeToken( 'constructor' ); +// returns false + +bool = isSafeToken( 'prototype' ); +// returns false +``` + +
+ + + + + +
+ +
+ + + + + +
+ +## Examples + + + +```javascript +var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); + +var bool = isSafeToken( 'foo' ); +// returns true + +bool = isSafeToken( '0' ); +// returns true + +bool = isSafeToken( '-' ); +// returns true + +bool = isSafeToken( '__proto__' ); +// returns false + +bool = isSafeToken( 'constructor' ); +// returns false + +bool = isSafeToken( 'prototype' ); +// returns false +``` + +
+ + + + + +
+ +
+ + + + + +
+ +
+ + + + + +
+ +[json-pointer]: https://tools.ietf.org/html/rfc6901 + +
+ + diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js new file mode 100644 index 000000000000..a955ca90c766 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/benchmark/benchmark.js @@ -0,0 +1,62 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MODULES // + +var bench = require( '@stdlib/bench' ); +var isBoolean = require( '@stdlib/assert/is-boolean' ).isPrimitive; +var pkg = require( './../package.json' ).name; +var isSafeToken = require( './../lib' ); + + +// MAIN // + +bench( pkg, function benchmark( b ) { + var values; + var out; + var v; + var i; + + values = [ + 'foo', + 'bar', + '__proto__', + 'constructor', + 'prototype', + '0', + '-', + 'baz' + ]; + + b.tic(); + for ( i = 0; i < b.iterations; i++ ) { + v = values[ i % values.length ]; + out = isSafeToken( v ); + if ( typeof out !== 'boolean' ) { + b.fail( 'should return a boolean' ); + } + } + b.toc(); + if ( !isBoolean( out ) ) { + b.fail( 'should return a boolean' ); + } + b.pass( 'benchmark finished' ); + b.end(); +}); diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt new file mode 100644 index 000000000000..2b0b06093e23 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/repl.txt @@ -0,0 +1,32 @@ + +{{alias}}( token ) + Tests whether a JSON Pointer reference token is safe. + + Parameters + ---------- + token: string + JSON Pointer reference token. + + Returns + ------- + bool: boolean + Boolean indicating whether a token is safe. + + Examples + -------- + > var bool = {{alias}}( 'foo' ) + true + > bool = {{alias}}( '0' ) + true + > bool = {{alias}}( '-' ) + true + > bool = {{alias}}( '__proto__' ) + false + > bool = {{alias}}( 'constructor' ) + false + > bool = {{alias}}( 'prototype' ) + false + + See Also + -------- + diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts new file mode 100644 index 000000000000..adca029e9c38 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/index.d.ts @@ -0,0 +1,48 @@ +/* +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +// TypeScript Version: 4.1 + +/** +* Tests whether a JSON Pointer reference token is safe. +* +* @param token - reference token +* @returns boolean indicating whether a token is safe +* +* @example +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* @example +* var bool = isSafeToken( '__proto__' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'constructor' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'prototype' ); +* // returns false +*/ +declare function isSafeToken( token: string ): boolean; + + +// EXPORTS // + +export = isSafeToken; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts new file mode 100644 index 000000000000..9a6131706819 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/docs/types/test.ts @@ -0,0 +1,34 @@ +/* +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +import isSafeToken = require( './index' ); + + +// TESTS // + +// The function returns a boolean... +{ + isSafeToken( 'foo' ); // $ExpectType boolean + isSafeToken( '__proto__' ); // $ExpectType boolean +} + +// The compiler throws an error if the function is provided an unsupported number of arguments... +{ + isSafeToken(); // $ExpectError + isSafeToken( 'foo', 123 ); // $ExpectError +} diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js new file mode 100644 index 000000000000..b81494ac9c6f --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/examples/index.js @@ -0,0 +1,45 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +var isSafeToken = require( './../lib' ); + +var bool = isSafeToken( 'foo' ); +console.log( bool ); +// => true + +bool = isSafeToken( '0' ); +console.log( bool ); +// => true + +bool = isSafeToken( '-' ); +console.log( bool ); +// => true + +bool = isSafeToken( '__proto__' ); +console.log( bool ); +// => false + +bool = isSafeToken( 'constructor' ); +console.log( bool ); +// => false + +bool = isSafeToken( 'prototype' ); +console.log( bool ); +// => false diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js new file mode 100644 index 000000000000..f901786b8620 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/index.js @@ -0,0 +1,49 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +/** +* Test whether a JSON Pointer reference token is safe. +* +* @module @stdlib/utils/json-pointer/base/assert/is-safe-token +* +* @example +* var isSafeToken = require( '@stdlib/utils/json-pointer/base/assert/is-safe-token' ); +* +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* bool = isSafeToken( '__proto__' ); +* // returns false +* +* bool = isSafeToken( 'constructor' ); +* // returns false +* +* bool = isSafeToken( 'prototype' ); +* // returns false +*/ + +// MODULES // + +var main = require( './main.js' ); + + +// EXPORTS // + +module.exports = main; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js new file mode 100644 index 000000000000..c557d8912dcd --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js @@ -0,0 +1,57 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MAIN // + +/** +* Tests whether a JSON Pointer reference token is safe. +* +* @name isSafeToken +* @type {Function} +* @param {string} token - reference token +* @returns {boolean} boolean indicating whether a token is safe +* +* @example +* var bool = isSafeToken( 'foo' ); +* // returns true +* +* @example +* var bool = isSafeToken( '__proto__' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'constructor' ); +* // returns false +* +* @example +* var bool = isSafeToken( 'prototype' ); +* // returns false +*/ +function isSafeToken( token ) { + if ( token === '__proto__' || token === 'constructor' || token === 'prototype' ) { + return false; + } + return true; +} + + +// EXPORTS // + +module.exports = isSafeToken; diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json new file mode 100644 index 000000000000..86a987559c71 --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json @@ -0,0 +1,72 @@ +{ + "name": "@stdlib/utils/json-pointer/base/assert/is-safe-token", + "version": "0.0.0", + "description": "Test whether a JSON Pointer reference token is safe.", + "license": "Apache-2.0", + "author": { + "name": "The Stdlib Authors", + "url": "https://github.com/stdlib-js/stdlib/graphs/contributors" + }, + "contributors": [ + { + "name": "The Stdlib Authors", + "url": "https://github.com/stdlib-js/stdlib/graphs/contributors" + } + ], + "main": "./lib", + "directories": { + "doc": "./docs", + "example": "./examples", + "lib": "./lib", + "test": "./test" + }, + "types": "./docs/types", + "scripts": {}, + "homepage": "https://github.com/stdlib-js/stdlib", + "repository": { + "type": "git", + "url": "git://github.com/stdlib-js/stdlib.git" + }, + "bugs": { + "url": "https://github.com/stdlib-js/stdlib/issues" + }, + "dependencies": {}, + "devDependencies": {}, + "engines": { + "node": ">=0.10.0", + "npm": ">2.7.0" + }, + "os": [ + "aix", + "darwin", + "freebsd", + "linux", + "macos", + "openbsd", + "sunos", + "win32", + "windows" + ], + "keywords": [ + "stdlib", + "stdutils", + "utilities", + "utility", + "utils", + "util", + "base", + "assert", + "test", + "check", + "is", + "json", + "pointer", + "json-pointer", + "rfc6901", + "token", + "safe", + "prototype", + "pollution", + "security" + ] +} diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js new file mode 100644 index 000000000000..7672806037aa --- /dev/null +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/test/test.js @@ -0,0 +1,77 @@ +/** +* @license Apache-2.0 +* +* Copyright (c) 2026 The Stdlib Authors. +* +* Licensed under the Apache License, Version 2.0 (the "License"); +* you may not use this file except in compliance with the License. +* You may obtain a copy of the License at +* +* http://www.apache.org/licenses/LICENSE-2.0 +* +* Unless required by applicable law or agreed to in writing, software +* distributed under the License is distributed on an "AS IS" BASIS, +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +* See the License for the specific language governing permissions and +* limitations under the License. +*/ + +'use strict'; + +// MODULES // + +var tape = require( 'tape' ); +var isSafeToken = require( './../lib' ); + + +// TESTS // + +tape( 'main export is a function', function test( t ) { + t.ok( true, __filename ); + t.strictEqual( typeof isSafeToken, 'function', 'main export is a function' ); + t.end(); +}); + +tape( 'the function returns `false` if provided an unsafe token (prototype pollution vector)', function test( t ) { + var values; + var bool; + var i; + + values = [ + '__proto__', + 'constructor', + 'prototype' + ]; + for ( i = 0; i < values.length; i++ ) { + bool = isSafeToken( values[ i ] ); + t.strictEqual( bool, false, 'returns expected value' ); + } + t.end(); +}); + +tape( 'the function returns `true` if provided a safe reference token', function test( t ) { + var values; + var bool; + var i; + + values = [ + 'foo', + 'bar', + 'baz', + '0', + '1', + '-', + 'a/b', + 'm~n', + '', + 'hello world', + 'toString', + 'valueOf', + 'hasOwnProperty' + ]; + for ( i = 0; i < values.length; i++ ) { + bool = isSafeToken( values[ i ] ); + t.strictEqual( bool, true, 'returns expected value' ); + } + t.end(); +}); From b5f1dd5777f799be45b3eafe1a9d103f8efc19bb Mon Sep 17 00:00:00 2001 From: Athan Date: Sun, 8 Nov 2026 23:04:06 +0100 Subject: [PATCH 2/4] chore: add missing folder Signed-off-by: Athan --- .../utils/json-pointer/base/assert/is-safe-token/package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json index 86a987559c71..95f5cd308efb 100644 --- a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/package.json @@ -15,6 +15,7 @@ ], "main": "./lib", "directories": { + "benchmark": "./benchmark", "doc": "./docs", "example": "./examples", "lib": "./lib", From e12e782760599636e7a796ab83e51316304e06f0 Mon Sep 17 00:00:00 2001 From: Athan Date: Sun, 8 Nov 2026 23:48:21 +0100 Subject: [PATCH 3/4] refactor: use utility rather than hardcode conditional Signed-off-by: Athan --- .../base/assert/is-safe-token/lib/main.js | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js index c557d8912dcd..a157692c5cba 100644 --- a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js @@ -18,6 +18,20 @@ 'use strict'; +// MODULES // + +var contains = require( '@stdlib/array/base/assert/contains' ).factory; + + +// VARIABLES // + +var PROPS = [ + '__proto__', + 'constructor', + 'prototype' +]; + + // MAIN // /** @@ -44,12 +58,7 @@ * var bool = isSafeToken( 'prototype' ); * // returns false */ -function isSafeToken( token ) { - if ( token === '__proto__' || token === 'constructor' || token === 'prototype' ) { - return false; - } - return true; -} +var isSafeToken = contains( PROPS ); // EXPORTS // From 7a6a7b7ed5713255462ebf2b4f23bfb626633591 Mon Sep 17 00:00:00 2001 From: Athan Date: Sun, 8 Nov 2026 23:52:25 +0100 Subject: [PATCH 4/4] fix: invert test Signed-off-by: Athan --- .../json-pointer/base/assert/is-safe-token/lib/main.js | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js index a157692c5cba..a3a30788f12d 100644 --- a/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js +++ b/lib/node_modules/@stdlib/utils/json-pointer/base/assert/is-safe-token/lib/main.js @@ -30,6 +30,7 @@ var PROPS = [ 'constructor', 'prototype' ]; +var isInvalid = contains( PROPS ); // MAIN // @@ -37,8 +38,6 @@ var PROPS = [ /** * Tests whether a JSON Pointer reference token is safe. * -* @name isSafeToken -* @type {Function} * @param {string} token - reference token * @returns {boolean} boolean indicating whether a token is safe * @@ -58,7 +57,9 @@ var PROPS = [ * var bool = isSafeToken( 'prototype' ); * // returns false */ -var isSafeToken = contains( PROPS ); +function isSafeToken( token ) { + return !isInvalid( token ); +} // EXPORTS //