Skip to content

Commit d0812f0

Browse files
ziemekziemek
authored
Merge pull request #342 from Kashoo/340-lodash
Issue 340: Address lodash security vulnerability
2 parents 9fede0b + 43ceeee commit d0812f0

File tree

11 files changed

+1647
-2050
lines changed

11 files changed

+1647
-2050
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ This project adheres to [Semantic Versioning](http://semver.org/). All notable c
55
### Fixed
66
- [#338](https://github.com/Kashoo/synctos/issues/338): The `mustNotBeMissing` and `mustNotBeNull` constraints do not behave as expected
77

8+
### Security
9+
- [340](https://github.com/Kashoo/synctos/issues/340): Security vulnerability in lodash dev dependency
10+
811
### Deprecated
912
- `mustNotBeMissing` constraint
1013
- `mustNotBeNull` constraint

‎lib/commander/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.18.0
1+
2.19.0

‎lib/commander/index.js‎

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -580,9 +580,9 @@ Command.prototype.executeSubCommand = function(argv, args, unknown) {
580580
proc.on('close', process.exit.bind(process));
581581
proc.on('error', function(err) {
582582
if (err.code === 'ENOENT') {
583-
console.error('%s(1) does not exist, try --help', bin);
583+
console.error('error: %s(1) does not exist, try --help', bin);
584584
} else if (err.code === 'EACCES') {
585-
console.error('%s(1) not executable. try chmod or run with root', bin);
585+
console.error('error: %s(1) not executable. try chmod or run with root', bin);
586586
}
587587
process.exit(1);
588588
});
@@ -792,9 +792,7 @@ Command.prototype.opts = function() {
792792
*/
793793

794794
Command.prototype.missingArgument = function(name) {
795-
console.error();
796-
console.error(" error: missing required argument `%s'", name);
797-
console.error();
795+
console.error("error: missing required argument `%s'", name);
798796
process.exit(1);
799797
};
800798

@@ -807,13 +805,11 @@ Command.prototype.missingArgument = function(name) {
807805
*/
808806

809807
Command.prototype.optionMissingArgument = function(option, flag) {
810-
console.error();
811808
if (flag) {
812-
console.error(" error: option `%s' argument missing, got `%s'", option.flags, flag);
809+
console.error("error: option `%s' argument missing, got `%s'", option.flags, flag);
813810
} else {
814-
console.error(" error: option `%s' argument missing", option.flags);
811+
console.error("error: option `%s' argument missing", option.flags);
815812
}
816-
console.error();
817813
process.exit(1);
818814
};
819815

@@ -826,9 +822,7 @@ Command.prototype.optionMissingArgument = function(option, flag) {
826822

827823
Command.prototype.unknownOption = function(flag) {
828824
if (this._allowUnknownOption) return;
829-
console.error();
830-
console.error(" error: unknown option `%s'", flag);
831-
console.error();
825+
console.error("error: unknown option `%s'", flag);
832826
process.exit(1);
833827
};
834828

@@ -840,9 +834,7 @@ Command.prototype.unknownOption = function(flag) {
840834
*/
841835

842836
Command.prototype.variadicArgNotLast = function(name) {
843-
console.error();
844-
console.error(" error: variadic arguments must be last `%s'", name);
845-
console.error();
837+
console.error("error: variadic arguments must be last `%s'", name);
846838
process.exit(1);
847839
};
848840

@@ -1053,7 +1045,7 @@ Command.prototype.optionHelp = function() {
10531045
// Append the help information
10541046
return this.options.map(function(option) {
10551047
return pad(option.flags, width) + ' ' + option.description +
1056-
((option.bool && option.defaultValue !== undefined) ? ' (default: ' + option.defaultValue + ')' : '');
1048+
((option.bool && option.defaultValue !== undefined) ? ' (default: ' + JSON.stringify(option.defaultValue) + ')' : '');
10571049
}).concat([pad('-h, --help', width) + ' ' + 'output usage information'])
10581050
.join('\n');
10591051
};
@@ -1073,7 +1065,6 @@ Command.prototype.commandHelp = function() {
10731065

10741066
return [
10751067
'Commands:',
1076-
'',
10771068
commands.map(function(cmd) {
10781069
var desc = cmd[1] ? ' ' + cmd[1] : '';
10791070
return (desc ? pad(cmd[0], width) : cmd[0]) + desc;
@@ -1124,7 +1115,6 @@ Command.prototype.helpInformation = function() {
11241115

11251116
var options = [
11261117
'Options:',
1127-
'',
11281118
'' + this.optionHelp().replace(/^/gm, ' '),
11291119
''
11301120
];

lib/indent.js/LICENSE.md renamed to lib/indent.js/LICENSE

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
The MIT License (MIT)
22
=====================
33

4-
Copyright © `2017` `Zeb Zhao`
4+
Copyright © 2018 Zeb Zhao
55

66
Permission is hereby granted, free of charge, to any person
77
obtaining a copy of this software and associated documentation
@@ -22,4 +22,4 @@ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
2222
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
2323
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
2424
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
25-
OTHER DEALINGS IN THE SOFTWARE.
25+
OTHER DEALINGS IN THE SOFTWARE.

‎lib/indent.js/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0.3.2
1+
0.3.4

‎lib/indent.js/indent.js‎

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,25 @@
1010
var indent = (function (root) {
1111
var rulesCache = {};
1212

13+
function map(array, predicate) {
14+
var i, results = [];
15+
for (i=0; i<array.length; i++) {
16+
results.push(predicate(array[i], i, array));
17+
}
18+
return results;
19+
}
20+
21+
function some(array, predicate) {
22+
var i, result;
23+
for (i=0; i<array.length; i++) {
24+
result = predicate(array[i], i, array);
25+
if (result) {
26+
return result;
27+
}
28+
}
29+
return false;
30+
}
31+
1332
function filterRules(language, rules, excludes) {
1433
if (rulesCache[language])
1534
return rulesCache[language];
@@ -32,6 +51,7 @@ var indent = (function (root) {
3251
}
3352

3453
var NEW_LINE_REGEX = /\r*\n/;
54+
var HTML_TAG_RULES = ["tag", "void-tags", "html-tag"];
3555

3656
/**
3757
* Soft dedent: this type of dedent has the opposite effect and will actually indent every line
@@ -48,6 +68,7 @@ var indent = (function (root) {
4868
* $matchBeginning - match at beginning of line only
4969
* $languages - used to filter by language later
5070
* $lineOffset - added to the line field when rule is applied
71+
* $excludeIf - used to exclude rule matching if any of these rules are active
5172
* $lastRule - used to continue a previous rule
5273
* $newScope - used to determine if rule creates a new scope, used for lastRule
5374
*
@@ -57,7 +78,7 @@ var indent = (function (root) {
5778
*/
5879
var MASTER_RULES = [
5980
{
60-
$languages: "html",
81+
$languages: "js html",
6182
$name: "comment",
6283
$startPatterns: [/\<\!\-\-/],
6384
$endPatterns: [/\-\-\>/],
@@ -73,7 +94,7 @@ var indent = (function (root) {
7394
$consumeEndMatch: true
7495
},
7596
{
76-
$languages: "html",
97+
$languages: "js html",
7798
$name: "void-tags",
7899
$startPatterns: [
79100
/\<(area|base|br|col|command|embed|hr|img|input|keygen|link|menuitem|meta|param|source|track|wbr)/i],
@@ -135,10 +156,10 @@ var indent = (function (root) {
135156
$consumeEndMatch: true
136157
},
137158
{
138-
$languages: "html",
159+
$languages: "js html",
139160
$name: "tag",
140161
$startPatterns: [function (string, rule, state) {
141-
var re = /<([A-Za-z0-9\-]+)/;
162+
var re = /<([A-Za-z][A-Za-z0-9\-\.]*)/;
142163
var match = string.match(re);
143164
if (match) {
144165
state.openingTag = match[1];
@@ -151,7 +172,7 @@ var indent = (function (root) {
151172
}
152173
}],
153174
$endPatterns: [function (string, rule, state) {
154-
var re = new RegExp("</" + state.openingTag + ">", "i");
175+
var re = new RegExp("<\/" + state.openingTag + ">|\\s\/>", "i");
155176
var match = string.match(re);
156177
if (match) {
157178
return {
@@ -228,16 +249,18 @@ var indent = (function (root) {
228249
$consumeEndMatch: true
229250
},
230251
{
231-
$languages: "html",
252+
$languages: "js html",
232253
$name: "quotes",
254+
$excludeIf: HTML_TAG_RULES,
233255
$startPatterns: [/"/],
234256
$endPatterns: [/"/, NEW_LINE_REGEX],
235257
$ignoreRules: true,
236258
$consumeEndMatch: true
237259
},
238260
{
239-
$languages: "html",
261+
$languages: "js html",
240262
$name: "quotes",
263+
$excludeIf: HTML_TAG_RULES,
241264
$startPatterns: [/'/],
242265
$endPatterns: [/'/, NEW_LINE_REGEX],
243266
$ignoreRules: true,
@@ -381,6 +404,7 @@ var indent = (function (root) {
381404
{
382405
$languages: "js",
383406
$name: "=",
407+
$excludeIf: HTML_TAG_RULES,
384408
$startPatterns: [/=/],
385409
$endPatterns: [/[,;\)\]}]/, NEW_LINE_REGEX]
386410
},
@@ -598,10 +622,16 @@ var indent = (function (root) {
598622

599623
var lastMatch = lastMatches[lastMatches.length - 1];
600624
var lastRuleInScope = lastMatch ? lastMatch.rule.$name : '';
625+
var activeRules = map(activeMatches, function (match) {
626+
return match.rule.$name;
627+
}).join('\n'); // Use \n as a special delimiter for rule names
601628

602629
for (var rule, r = 0; r < rules.length; r++) {
603630
rule = rules[r];
604-
if (!rule.$lastRule ||
631+
if (rule.$excludeIf && some(rule.$excludeIf, function (excludeRule) {
632+
return activeRules.indexOf(excludeRule) != -1;
633+
})) {
634+
} else if (!rule.$lastRule ||
605635
(lastRuleInScope && rule.$lastRule.indexOf(lastRuleInScope) !== -1)
606636
) {
607637
match = searchAny(string, rule.$startPatterns, rule);

‎lib/joi/LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Joi
33
===
44

5-
Copyright (c) 2012-2017, Project contributors
5+
Copyright (c) 2012-2018, Project contributors
66
Copyright (c) 2012-2014, Walmart
77
All rights reserved.
88

‎lib/joi/VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
13.7.0
1+
14.3.1

0 commit comments

Comments
 (0)