84 lines
3.6 KiB
JavaScript
84 lines
3.6 KiB
JavaScript
import { readFileSync, readdirSync, statSync } from 'node:fs';
|
|
import { createRequire } from 'node:module';
|
|
import { extname, join, resolve } from 'node:path';
|
|
|
|
const workspaceRoot = resolve(import.meta.dirname, '..', '..');
|
|
const rootLock = JSON.parse(readFileSync(join(workspaceRoot, 'package-lock.json'), 'utf8'));
|
|
const apiLock = JSON.parse(readFileSync(join(workspaceRoot, 'api', 'package-lock.json'), 'utf8'));
|
|
|
|
assertVersionAtLeast(rootLock.packages['node_modules/postcss']?.version, [8, 5, 18], 'postcss');
|
|
assertVersionAtLeast(rootLock.packages['node_modules/react-router']?.version, [7, 18, 2], 'react-router');
|
|
assertVersionAtLeast(rootLock.packages['node_modules/nanoid']?.version, [3, 3, 18], 'nanoid');
|
|
assertEqual(apiLock.packages['node_modules/brace-expansion-safe']?.version, '5.0.9', 'brace-expansion-safe');
|
|
assertEqual(apiLock.packages['node_modules/fast-uri']?.version, '3.1.5', 'fast-uri');
|
|
assertEqual(apiLock.packages['node_modules/js-yaml']?.version, '4.3.1', 'js-yaml');
|
|
assertEqual(apiLock.packages['node_modules/@nestjs/swagger']?.version, '11.4.7', '@nestjs/swagger');
|
|
assertEqual(
|
|
apiLock.packages['node_modules/brace-expansion']?.resolved,
|
|
'vendor/brace-expansion-compat',
|
|
'brace-expansion compatibility adapter',
|
|
);
|
|
|
|
const forbiddenRscPatterns = [
|
|
/\bunstable_RSC\w*/u,
|
|
/\bRSCRouterConfig\b/u,
|
|
/\bRSCStaticRouter\b/u,
|
|
/\bcreateCallServer\b/u,
|
|
/react-router\/dom\/server/u,
|
|
];
|
|
for (const filePath of sourceFiles(join(workspaceRoot, 'src'))) {
|
|
const source = readFileSync(filePath, 'utf8');
|
|
for (const pattern of forbiddenRscPatterns) {
|
|
if (pattern.test(source)) {
|
|
throw new Error(`React Router RSC mitigation violated by ${filePath}: ${pattern}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
const apiRequire = createRequire(join(workspaceRoot, 'api', 'package.json'));
|
|
const expand = apiRequire('brace-expansion');
|
|
if (typeof expand !== 'function' || expand.EXPANSION_MAX_LENGTH !== 4_000_000) {
|
|
throw new Error('brace-expansion compatibility adapter is not using the bounded 5.0.9 implementation');
|
|
}
|
|
assertEqual(expand('{a,b}{1,2}').join(','), 'a1,a2,b1,b2', 'brace-expansion legacy API');
|
|
|
|
for (const relativePath of [
|
|
'node_modules/archiver-utils/node_modules/minimatch',
|
|
'node_modules/readdir-glob/node_modules/minimatch',
|
|
'node_modules/rimraf/node_modules/minimatch',
|
|
]) {
|
|
const loaded = apiRequire(join(workspaceRoot, 'api', relativePath));
|
|
const match = typeof loaded === 'function' ? loaded : loaded.minimatch;
|
|
if (typeof match !== 'function' || !match('file-a.xlsx', 'file-{a,b}.xlsx')) {
|
|
throw new Error(`Legacy minimatch compatibility failed for ${relativePath}`);
|
|
}
|
|
}
|
|
|
|
console.log(
|
|
'Dependency mitigations verified: frontend baselines, Swagger YAML/URI parsers and bounded brace expansion are patched.',
|
|
);
|
|
|
|
function sourceFiles(directory) {
|
|
return readdirSync(directory).flatMap((name) => {
|
|
const path = join(directory, name);
|
|
if (statSync(path).isDirectory()) return sourceFiles(path);
|
|
return ['.js', '.jsx', '.ts', '.tsx'].includes(extname(path)) ? [path] : [];
|
|
});
|
|
}
|
|
|
|
function assertVersionAtLeast(actual, minimum, label) {
|
|
if (!actual) throw new Error(`${label} is missing from package-lock.json`);
|
|
const parts = actual.split('.').map((part) => Number(part.replace(/\D.*$/u, '')));
|
|
if (
|
|
minimum.some(
|
|
(value, index) => parts[index] < value && minimum.slice(0, index).every((item, i) => parts[i] === item),
|
|
)
|
|
) {
|
|
throw new Error(`${label} ${actual} is older than ${minimum.join('.')}`);
|
|
}
|
|
}
|
|
|
|
function assertEqual(actual, expected, label) {
|
|
if (actual !== expected) throw new Error(`${label}: expected ${expected}, received ${actual ?? 'missing'}`);
|
|
}
|