|
 |
d744d0 |
From 72e3450a325ee7b9f181cccb586bdf56c83aab84 Mon Sep 17 00:00:00 2001
|
|
|
d744d0 |
From: Marco Carini <cmdcarini@gmail.com>
|
|
|
d744d0 |
Date: Mon, 3 Aug 2020 17:16:07 -0500
|
|
|
d744d0 |
Subject: [PATCH] deps(dot-prop): patch 4.2.0 with fixes for CVE-2020-8116
|
|
|
d744d0 |
|
|
|
d744d0 |
Signed-off-by: rpm-build <rpm-build>
|
|
|
d744d0 |
---
|
|
|
d744d0 |
deps/npm/node_modules/dot-prop/index.js | 18 ++++++++++++++++++
|
|
|
d744d0 |
deps/npm/node_modules/dot-prop/package.json | 6 +++---
|
|
|
d744d0 |
deps/npm/node_modules/dot-prop/readme.md | 2 ++
|
|
|
d744d0 |
3 files changed, 23 insertions(+), 3 deletions(-)
|
|
|
d744d0 |
|
|
|
d744d0 |
diff --git a/deps/npm/node_modules/dot-prop/index.js b/deps/npm/node_modules/dot-prop/index.js
|
|
|
d744d0 |
index 15282bb..189831c 100644
|
|
|
d744d0 |
--- a/deps/npm/node_modules/dot-prop/index.js
|
|
|
d744d0 |
+++ b/deps/npm/node_modules/dot-prop/index.js
|
|
|
d744d0 |
@@ -1,6 +1,14 @@
|
|
|
d744d0 |
'use strict';
|
|
|
d744d0 |
const isObj = require('is-obj');
|
|
|
d744d0 |
|
|
|
d744d0 |
+const disallowedKeys = [
|
|
|
d744d0 |
+ '__proto__',
|
|
|
d744d0 |
+ 'prototype',
|
|
|
d744d0 |
+ 'constructor'
|
|
|
d744d0 |
+];
|
|
|
d744d0 |
+
|
|
|
d744d0 |
+const isValidPath = pathSegments => !pathSegments.some(segment => disallowedKeys.includes(segment));
|
|
|
d744d0 |
+
|
|
|
d744d0 |
function getPathSegments(path) {
|
|
|
d744d0 |
const pathArr = path.split('.');
|
|
|
d744d0 |
const parts = [];
|
|
|
d744d0 |
@@ -16,6 +24,10 @@ function getPathSegments(path) {
|
|
|
d744d0 |
parts.push(p);
|
|
|
d744d0 |
}
|
|
|
d744d0 |
|
|
|
d744d0 |
+ if (!isValidPath(parts)) {
|
|
|
d744d0 |
+ return [];
|
|
|
d744d0 |
+ }
|
|
|
d744d0 |
+
|
|
|
d744d0 |
return parts;
|
|
|
d744d0 |
}
|
|
|
d744d0 |
|
|
|
d744d0 |
@@ -26,6 +38,9 @@ module.exports = {
|
|
|
d744d0 |
}
|
|
|
d744d0 |
|
|
|
d744d0 |
const pathArr = getPathSegments(path);
|
|
|
d744d0 |
+ if (pathArr.length === 0) {
|
|
|
d744d0 |
+ return;
|
|
|
d744d0 |
+ }
|
|
|
d744d0 |
|
|
|
d744d0 |
for (let i = 0; i < pathArr.length; i++) {
|
|
|
d744d0 |
if (!Object.prototype.propertyIsEnumerable.call(obj, pathArr[i])) {
|
|
|
d744d0 |
@@ -58,6 +73,9 @@ module.exports = {
|
|
|
d744d0 |
|
|
|
d744d0 |
const root = obj;
|
|
|
d744d0 |
const pathArr = getPathSegments(path);
|
|
|
d744d0 |
+ if (pathArr.length === 0) {
|
|
|
d744d0 |
+ return;
|
|
|
d744d0 |
+ }
|
|
|
d744d0 |
|
|
|
d744d0 |
for (let i = 0; i < pathArr.length; i++) {
|
|
|
d744d0 |
const p = pathArr[i];
|
|
|
d744d0 |
diff --git a/deps/npm/node_modules/dot-prop/package.json b/deps/npm/node_modules/dot-prop/package.json
|
|
|
d744d0 |
index 40fefa3..93daf7d 100644
|
|
|
d744d0 |
--- a/deps/npm/node_modules/dot-prop/package.json
|
|
|
d744d0 |
+++ b/deps/npm/node_modules/dot-prop/package.json
|
|
|
d744d0 |
@@ -37,9 +37,9 @@
|
|
|
d744d0 |
"deprecated": false,
|
|
|
d744d0 |
"description": "Get, set, or delete a property from a nested object using a dot path",
|
|
|
d744d0 |
"devDependencies": {
|
|
|
d744d0 |
- "ava": "*",
|
|
|
d744d0 |
+ "ava": "1.4.1",
|
|
|
d744d0 |
"matcha": "^0.7.0",
|
|
|
d744d0 |
- "xo": "*"
|
|
|
d744d0 |
+ "xo": "0.24.0"
|
|
|
d744d0 |
},
|
|
|
d744d0 |
"engines": {
|
|
|
d744d0 |
"node": ">=4"
|
|
|
d744d0 |
@@ -73,7 +73,7 @@
|
|
|
d744d0 |
"bench": "matcha bench.js",
|
|
|
d744d0 |
"test": "xo && ava"
|
|
|
d744d0 |
},
|
|
|
d744d0 |
- "version": "4.2.0",
|
|
|
d744d0 |
+ "version": "4.2.1",
|
|
|
d744d0 |
"xo": {
|
|
|
d744d0 |
"esnext": true
|
|
|
d744d0 |
}
|
|
|
d744d0 |
diff --git a/deps/npm/node_modules/dot-prop/readme.md b/deps/npm/node_modules/dot-prop/readme.md
|
|
|
d744d0 |
index fab3b7a..0e18f78 100644
|
|
|
d744d0 |
--- a/deps/npm/node_modules/dot-prop/readme.md
|
|
|
d744d0 |
+++ b/deps/npm/node_modules/dot-prop/readme.md
|
|
|
d744d0 |
@@ -85,6 +85,8 @@ Path of the property in the object, using `.` to separate each nested key.
|
|
|
d744d0 |
|
|
|
d744d0 |
Use `\\.` if you have a `.` in the key.
|
|
|
d744d0 |
|
|
|
d744d0 |
+The following path components are invalid and results in `undefined` being returned: `__proto__`, `prototype`, `constructor`.
|
|
|
d744d0 |
+
|
|
|
d744d0 |
#### value
|
|
|
d744d0 |
|
|
|
d744d0 |
Type: `any`
|
|
|
d744d0 |
--
|
|
|
d744d0 |
2.26.2
|
|
|
d744d0 |
|