fix json5 alert

package.json

@@ -79,5 +79,9 @@
     "build": "yarn clean && tsc && copyfiles -u 1 src/**/*.pug build/",
     "start": "TS_NODE_BASEURL=./build node ./build/main.js",
     "dev": "yarn schema && nodemon --no-update-notifier -- ./src/main.ts"
+  },
+  "//": "Override to solve JSON5 vulnerability. Cleanup once eslint-plugin-import releases the update of deps",
+  "resolutions": {
+    "opstooling-js-style/**/tsconfig-paths": "^4.0.0"
   }
 }

src/api.ts

@@ -62,38 +62,40 @@ export const setupApi = (ctx: Context, server: Server): void => {
     }) => void | Promise<void>,
     { checkMasterToken }: { checkMasterToken?: boolean } = {},
   ) => {
-    server.expressApp[method](getApiRoute(routePath), jsonBodyParserMiddleware, async (req, res, next) => {
-      try {
-        const token = req.headers["x-auth"];
-        if (typeof token !== "string" || !token) {
-          return errorResponse(res, next, 400, "Invalid auth token");
-        }
-
-        /*
-            Empty when the masterToken is supposed to be used because it doesn't
-            matter in that case
-          */
-        let matrixRoom: string = "";
-        if (checkMasterToken) {
-          if (token !== config.masterToken) {
-            return errorResponse(res, next, 422, `Invalid ${token} for master token`);
+    server.expressApp[method](getApiRoute(routePath), jsonBodyParserMiddleware, (req, res, next) => {
+      void (async () => {
+        try {
+          const token = req.headers["x-auth"];
+          if (typeof token !== "string" || !token) {
+            return errorResponse(res, next, 400, "Invalid auth token");
           }
-        } else {
-          try {
-            matrixRoom = await accessDb.db.get(token);
-          } catch (error) {
-            if (error instanceof LevelErrors.NotFoundError) {
-              return errorResponse(res, next, 404, "Token not found");
-            } else {
-              return apiError(res, next, error);
+
+          /*
+              Empty when the masterToken is supposed to be used because it doesn't
+              matter in that case
+            */
+          let matrixRoom: string = "";
+          if (checkMasterToken) {
+            if (token !== config.masterToken) {
+              return errorResponse(res, next, 422, `Invalid ${token} for master token`);
+            }
+          } else {
+            try {
+              matrixRoom = await accessDb.db.get(token);
+            } catch (error) {
+              if (error instanceof LevelErrors.NotFoundError) {
+                return errorResponse(res, next, 404, "Token not found");
+              } else {
+                return apiError(res, next, error);
+              }
             }
           }
-        }
 
-        await handler({ req, res, next, token, matrixRoom });
-      } catch (error) {
-        apiError(res, next, error);
-      }
+          await handler({ req, res, next, token, matrixRoom });
+        } catch (error) {
+          apiError(res, next, error);
+        }
+      })();
     });
   };
 

yarn.lock

@@ -1629,11 +1629,6 @@
   resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.11.tgz#d421b6c527a3037f7c84433fd2c4229e016863d3"
   integrity sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ==
 
-"@types/json5@^0.0.29":
-  version "0.0.29"
-  resolved "https://registry.yarnpkg.com/@types/json5/-/json5-0.0.29.tgz#ee28707ae94e11d2b827bcbe5270bcea7f3e71ee"
-  integrity sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==
-
 "@types/jsonwebtoken@^8.3.3":
   version "8.5.8"
   resolved "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-8.5.8.tgz"
@@ -4978,18 +4973,16 @@ json-stringify-safe@~5.0.1:
   resolved "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz"
   integrity sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus=
 
-json5@^1.0.1:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/json5/-/json5-1.0.2.tgz#63d98d60f21b313b77c4d6da18bfa69d80e1d593"
-  integrity sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==
-  dependencies:
-    minimist "^1.2.0"
-
 json5@^2.2.1:
   version "2.2.1"
   resolved "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz"
   integrity sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==
 
+json5@^2.2.2:
+  version "2.2.3"
+  resolved "https://registry.yarnpkg.com/json5/-/json5-2.2.3.tgz#78cd6f1a19bdc12b73db5ad0c61efd66c1e29283"
+  integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
+
 jsonc-simple-parser@^2.2.1:
   version "2.2.1"
   resolved "https://registry.npmjs.org/jsonc-simple-parser/-/jsonc-simple-parser-2.2.1.tgz"
@@ -5441,7 +5434,7 @@ minimatch@^5.0.1:
   dependencies:
     brace-expansion "^2.0.1"
 
-minimist@^1.2.0, minimist@^1.2.5, minimist@^1.2.6:
+minimist@^1.2.5, minimist@^1.2.6:
   version "1.2.7"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.7.tgz#daa1c4d91f507390437c6a8bc01078e7000c4d18"
   integrity sha512-bzfL1YUZsP41gmu/qjrEk0Q6i2ix/cVeAhbCbqH9u3zYutS1cLg00qhrD0M2MVdCcx4Sc0UpP2eBWo9rotpq6g==
@@ -5773,7 +5766,6 @@ onetime@^5.1.2:
 
 "opstooling-js@https://github.com/paritytech/opstooling-js#v0.0.18":
   version "0.0.0"
-  uid dfc8601fed2287ebed1c3ff12192db864b610f35
   resolved "https://github.com/paritytech/opstooling-js#dfc8601fed2287ebed1c3ff12192db864b610f35"
   dependencies:
     "@octokit/rest" "^18.12.0"
@@ -7210,13 +7202,12 @@ ts-patch@^2.1.0:
     shelljs "^0.8.5"
     strip-ansi "^6.0.1"
 
-tsconfig-paths@^3.14.1:
-  version "3.14.1"
-  resolved "https://registry.yarnpkg.com/tsconfig-paths/-/tsconfig-paths-3.14.1.tgz#ba0734599e8ea36c862798e920bcf163277b137a"
-  integrity sha512-fxDhWnFSLt3VuTwtvJt5fpwxBHg5AdKWMsgcPOOIilyjymcYVZoCQF8fvFRezCNfblEXmi+PcM1eYHeOAgXCOQ==
+tsconfig-paths@^3.14.1, tsconfig-paths@^4.0.0:
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/tsconfig-paths/-/tsconfig-paths-4.2.0.tgz#ef78e19039133446d244beac0fd6a1632e2d107c"
+  integrity sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==
   dependencies:
-    "@types/json5" "^0.0.29"
-    json5 "^1.0.1"
+    json5 "^2.2.2"
     minimist "^1.2.6"
     strip-bom "^3.0.0"