node-shield/dist/Shield.js at master · panga/node-shield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const ShieldError_1 = require("./ShieldError");
const Utils_1 = require("./Utils");
class Shield {
    static traverse(obj, opts) {
        let error;
        for (const k in obj) {
            if (opts.mongo && Utils_1.default.isString(k) && k.indexOf('$') === 0 && k.length > 1) {
                error = new ShieldError_1.default('Mongo $ injection found', 'mongo_error', obj);
                break;
            }
            if (Utils_1.default.isPlainObject(obj[k])) {
                if (opts.proto && (k === '__proto__' || k === 'constructor')) {
                    error = new ShieldError_1.default('Prototype pollution found', 'proto_error', obj);
                    break;
                }
                error = this.traverse(obj[k], opts);
                if (error) {
                    break;
                }
            }
        }
        return error;
    }
    static evaluate(obj, opts, callback) {
        if (Utils_1.default.isPlainObject(obj)) {
            callback(this.traverse(obj, opts));
        }
        else {
            callback();
        }
    }
    static evaluateAsync(obj, opts) {
        return new Promise((resolve, reject) => {
            if (Utils_1.default.isPlainObject(obj)) {
                const error = this.traverse(obj, opts);
                if (error) {
                    reject(error);
                }
                else {
                    resolve();
                }
            }
            else {
                resolve();
            }
        });
    }
}
exports.Shield = Shield;