Improve any token

src/config/normalize/lib/star_dot_path/entries.js

@@ -1,13 +1,13 @@
 import isPlainObj from 'is-plain-obj'
 
+import { isAnyToken } from './parsing/any.js'
 import {
   convertIndexInteger,
   convertIndexString,
   getArrayIndex,
   isIndexToken,
 } from './parsing/array.js'
 import { serialize } from './parsing/serialize.js'
-import { ANY_TOKEN } from './parsing/special.js'
 
 // List all values (and their associated path) matching a specific query for
 // on specific target value.
@@ -28,7 +28,7 @@ const listTokenEntries = function (entries, token) {
 }
 
 const getTokenEntries = function ({ value, path }, token) {
-  return token === ANY_TOKEN
+  return isAnyToken(token)
     ? getAnyEntries(value, path)
     : getKeyEntries(value, path, token)
 }

src/config/normalize/lib/star_dot_path/parsing/any.js

@@ -0,0 +1,13 @@
+import isPlainObj from 'is-plain-obj'
+
+// Create a new token for *
+export const createAnyToken = function () {
+  return { type: ANY_TYPE }
+}
+
+// Check if a token is *
+export const isAnyToken = function (token) {
+  return isPlainObj(token) && token.type === ANY_TYPE
+}
+
+const ANY_TYPE = 'any'

src/config/normalize/lib/star_dot_path/parsing/parse.js

@@ -1,13 +1,7 @@
+import { createAnyToken } from './any.js'
 import { convertIndexInteger } from './array.js'
 import { normalizePath } from './normalize.js'
-import {
-  ESCAPE,
-  SEPARATOR,
-  ANY,
-  MINUS,
-  SPECIAL_CHARS,
-  ANY_TOKEN,
-} from './special.js'
+import { ESCAPE, SEPARATOR, ANY, MINUS, SPECIAL_CHARS } from './special.js'
 import { isQueryString } from './validate.js'
 
 // Parse a query string into an array of tokens.
@@ -29,9 +23,9 @@ import { isQueryString } from './validate.js'
 // Tokens are an array of one of:
 //  - Object property as a string or symbol
 //  - Array index as a positive|negative integer|string
-//  - `Symbol.for('*')` for wildcards
-//     - We use symbols as it allows using dynamic strings without injection
-//       risk
+//  - Wildcards: { type: "any" }
+//     - We use objects instead of strings or symbols as both are valid as
+//       object properties which creates a risk for injections
 // We allow passing an array of tokens instead of a query string which:
 //  - Removes the need for escaping
 //  - Is sometimes more convenient
@@ -123,5 +117,5 @@ Regular expressions can be used instead.`,
     )
   }
 
-  return ANY_TOKEN
+  return createAnyToken()
 }

src/config/normalize/lib/star_dot_path/parsing/serialize.js

@@ -1,6 +1,7 @@
+import { isAnyToken } from './any.js'
 import { isIndexToken } from './array.js'
 import { parse } from './parse.js'
-import { SEPARATOR, ANY, ANY_TOKEN, SPECIAL_CHARS_REGEXP } from './special.js'
+import { SEPARATOR, ANY, SPECIAL_CHARS_REGEXP } from './special.js'
 
 // Inverse of `parse()`
 // When passing a query string, it is parsed and re-serialized to validate and
@@ -15,7 +16,7 @@ const serializePath = function (path) {
 }
 
 const serializeToken = function (token, index) {
-  if (token === ANY_TOKEN) {
+  if (isAnyToken(token)) {
     return ANY
   }
 

src/config/normalize/lib/star_dot_path/parsing/special.js

@@ -4,7 +4,5 @@ export const SEPARATOR = '.'
 export const ANY = '*'
 export const MINUS = '-'
 export const SPECIAL_CHARS = new Set([ESCAPE, SEPARATOR, ANY, MINUS])
-// Tokens for special characters
-export const ANY_TOKEN = Symbol.for('*')
 // Special characters which should always be escaped
 export const SPECIAL_CHARS_REGEXP = /[\\.*]|^-/gu

src/config/normalize/lib/star_dot_path/parsing/validate.js

@@ -1,7 +1,7 @@
 import { inspect } from 'util'
 
+import { isAnyToken } from './any.js'
 import { isIndexToken } from './array.js'
-import { ANY_TOKEN } from './special.js'
 
 // Most methods accept both query and path syntaxes.
 // This checks which one is used.
@@ -31,13 +31,13 @@ const validateToken = function (token, path) {
     throwTokenError(
       path,
       token,
-      'It must be a string, integer or Symbol.for("*").',
+      'It must be a string, an integer or { type: "any" }',
     )
   }
 }
 
 const isValidToken = function (token) {
-  return typeof token === 'string' || isIndexToken(token) || token === ANY_TOKEN
+  return typeof token === 'string' || isIndexToken(token) || isAnyToken(token)
 }
 
 const throwPathError = function (path, message) {