0.2.0 - Mid migration

web/node_modules/@hapi/bourne/lib/index.js

@@ -0,0 +1,97 @@
+'use strict';
+
+
+const internals = {
+    suspectRx: /"(?:_|\\u005[Ff])(?:_|\\u005[Ff])(?:p|\\u0070)(?:r|\\u0072)(?:o|\\u006[Ff])(?:t|\\u0074)(?:o|\\u006[Ff])(?:_|\\u005[Ff])(?:_|\\u005[Ff])"\s*\:/
+};
+
+
+exports.parse = function (text, reviver, options) {
+
+    // Normalize arguments
+
+    if (!options) {
+        if (reviver &&
+            typeof reviver === 'object') {
+
+            options = reviver;
+            reviver = undefined;
+        }
+        else {
+            options = {};
+        }
+    }
+
+    // Parse normally, allowing exceptions
+
+    const obj = JSON.parse(text, reviver);
+
+    // options.protoAction: 'error' (default) / 'remove' / 'ignore'
+
+    if (options.protoAction === 'ignore') {
+        return obj;
+    }
+
+    // Ignore null and non-objects
+
+    if (!obj ||
+        typeof obj !== 'object') {
+
+        return obj;
+    }
+
+    // Check original string for potential exploit
+
+    if (!text.match(internals.suspectRx)) {
+        return obj;
+    }
+
+    // Scan result for proto keys
+
+    exports.scan(obj, options);
+
+    return obj;
+};
+
+
+exports.scan = function (obj, options) {
+
+    options = options || {};
+
+    let next = [obj];
+
+    while (next.length) {
+        const nodes = next;
+        next = [];
+
+        for (const node of nodes) {
+            if (Object.prototype.hasOwnProperty.call(node, '__proto__')) {      // Avoid calling node.hasOwnProperty directly
+                if (options.protoAction !== 'remove') {
+                    throw new SyntaxError('Object contains forbidden prototype property');
+                }
+
+                delete node.__proto__;
+            }
+
+            for (const key in node) {
+                const value = node[key];
+                if (value &&
+                    typeof value === 'object') {
+
+                    next.push(node[key]);
+                }
+            }
+        }
+    }
+};
+
+
+exports.safeParse = function (text, reviver) {
+
+    try {
+        return exports.parse(text, reviver);
+    }
+    catch (ignoreError) {
+        return null;
+    }
+};