[dynamicjson dynamicyaml dynamictoml] switch to jsonpath-plus (#10551)

package.json

@@ -47,7 +47,7 @@
     "joi": "17.13.3",
     "joi-extension-semver": "5.0.0",
     "js-yaml": "^4.1.0",
-    "jsonpath": "~1.1.1",
+    "jsonpath-plus": "^9.0.0",
     "lodash.countby": "^4.6.0",
     "lodash.groupby": "^4.6.0",
     "lodash.times": "^4.3.2",

services/dynamic/dynamic-json.tester.js

@@ -145,8 +145,8 @@ t.create('query with lexical error')
   )
   .expectBadge({
     label: 'custom badge',
-    message: 'unparseable jsonpath query',
-    color: 'red',
+    message: 'no result',
+    color: 'lightgrey',
   })
 
 t.create('query with parse error')
@@ -155,8 +155,8 @@ t.create('query with parse error')
   )
   .expectBadge({
     label: 'custom badge',
-    message: 'unparseable jsonpath query',
-    color: 'red',
+    message: 'no result',
+    color: 'lightgrey',
   })
 
 // Example from https://stackoverflow.com/q/11670384/893113
@@ -170,7 +170,23 @@ t.create('query with invalid token')
   )
   .expectBadge({
     label: 'custom badge',
-    message: 'unparseable jsonpath query',
+    message: 'query not supported',
+    color: 'red',
+  })
+
+/*
+Based on https://github.com/JSONPath-Plus/JSONPath/blob/v9.0.0/test/test.errors.js#L53-L68
+This functionality is disabled for security reasons.
+*/
+t.create('query with eval filtering expression')
+  .get(
+    `.json?url=https://github.com/badges/shields/raw/master/package.json&query=${encodeURIComponent(
+      '$..keywords[(@.length-1)]',
+    )}`,
+  )
+  .expectBadge({
+    label: 'custom badge',
+    message: 'query not supported',
     color: 'red',
   })
 
@@ -185,12 +201,11 @@ t.create('JSON contains an array')
   })
 
 t.create('JSON contains a string')
-  .get('.json?url=https://example.test/json&query=$.foo,')
+  .get('.json?url=https://example.test/json&query=$')
   .intercept(nock =>
     nock('https://example.test').get('/json').reply(200, '"foo"'),
   )
   .expectBadge({
     label: 'custom badge',
-    message: 'resource must contain an object or array',
-    color: 'lightgrey',
+    message: 'foo',
   })

services/dynamic/dynamic-yaml.tester.js

@@ -102,12 +102,11 @@ t.create('YAML from url | error color overrides user specified')
   })
 
 t.create('YAML contains a string')
-  .get('.json?url=https://example.test/yaml&query=$.foo,')
+  .get('.json?url=https://example.test/yaml&query=$,')
   .intercept(nock =>
     nock('https://example.test').get('/yaml').reply(200, '"foo"'),
   )
   .expectBadge({
     label: 'custom badge',
-    message: 'resource must contain an object or array',
-    color: 'lightgrey',
+    message: 'foo',
   })

services/dynamic/json-path.js

@@ -3,7 +3,7 @@
  */
 
 import Joi from 'joi'
-import jp from 'jsonpath'
+import { JSONPath as jp } from 'jsonpath-plus'
 import { renderDynamicBadge, httpErrors } from '../dynamic-common.js'
 import { InvalidParameter, InvalidResponse } from '../index.js'
 
@@ -43,26 +43,14 @@ export default superclass =>
         httpErrors,
       })
 
-      // JSONPath only works on objects and arrays.
-      // https://github.com/badges/shields/issues/4018
-      if (typeof data !== 'object') {
-        throw new InvalidResponse({
-          prettyMessage: 'resource must contain an object or array',
-        })
-      }
-
       let values
       try {
-        values = jp.query(data, pathExpression)
+        values = jp({ json: data, path: pathExpression, eval: false })
       } catch (e) {
         const { message } = e
-        if (
-          message.startsWith('Lexical error') ||
-          message.startsWith('Parse error') ||
-          message.includes('Unexpected token')
-        ) {
+        if (message.includes('prevented in JSONPath expression')) {
           throw new InvalidParameter({
-            prettyMessage: 'unparseable jsonpath query',
+            prettyMessage: 'query not supported',
           })
         } else {
           throw e