Refactor: strategy pattern, security fixes, DRY index extraction (audit fixes)#326
Merged
Refactor: strategy pattern, security fixes, DRY index extraction (audit fixes)#326
Conversation
…it fixes) - Extract #matchesPredicate into standalone Strategy module (query-strategy.js) with PredicateStrategy and ValueMatcher classes (SRP/SOLID) - Add #getIndexValues() helper to deduplicate index value extraction in #setIndex and #deleteIndex (DRY) - Filter prototype pollution keys (__proto__, constructor, prototype) before spread in set() (OWASP) - Reject RegExp patterns with source.length > 256 in search() (REDoS) - Fix where() returning undefined when indexes match nothing - Remove dead 'frozen' param from sort() - Remove unused 'override' parameter from #merge()
- AGENTS.md: add query-strategy module, new helper, signature updates - docs/API.md: Query Strategy section, new helpers, sort/where/set/search updates - docs/TECHNICAL_DOCUMENTATION.md: Security Model, Query Strategy, SORT complexity - types/haro.d.ts: remove frozen override, update merge, remove matchesPredicate - dist: regenerated build files
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses an SRP/DRY/YAGNI/SOLID/OWASP audit of
haro.jswith 9 changes across 4 files:New Files
src/query-strategy.js— Strategy pattern module withValueMatcherandPredicateStrategyclasses, replacing#matchesPredicatetests/unit/query-strategy.test.js— 22 new tests for the strategy classes and integrationCore Fixes
#matchesPredicatecomplexitysrc/query-strategy.jswith extensiblePredicateStrategyandValueMatcher#getIndexValues(field, source)helper used by both#setIndex()and#deleteIndex()set()now filters__proto__,constructor,prototypekeys before storingsearch()rejects RegExp withsource.length > 256where()returning void/undefinedCleanup (YAGNI/SRP)
frozenparameter fromsort()— immutable mode handles freezing via#freezeResult()sort()crash in immutable mode (frozen array +.sort()mutation) — now extracts data safelyoverrideparameter from#merge()Files Updated
src/constants.js— AddedINT_1,INT_256src/haro.js— All core fixestests/unit/utilities.test.js— Updatedsort()testAGENTS.md— Updated project guide with new helpers/signaturesdocs/API.md— New Query Strategy section, updated method docsdocs/TECHNICAL_DOCUMENTATION.md— New Security Model sectiontypes/haro.d.ts— RemovedmatchesPredicate, updatedsort/mergesignaturesdist/— Regenerated build filesTest Results