CVE-2023-45133: Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (#922)

Author: maximthomas

openam-ui/openam-ui-ria/Gruntfile.js

@@ -87,17 +87,16 @@ module.exports = function (grunt) {
                     }
                 },
                 ignore: ["libs/"],
-                presets: ["env", "react"],
-                plugins: [
-                    ["transform-es2015-classes", { "loose": true }],
-                    "transform-object-rest-spread"
-                ]
+                presets: [
+                    ["@babel/preset-env", { "targets": "> 0.2%, not dead, last 2 versions" }],
+                    "@babel/preset-react"],
+                plugins: [["@babel/plugin-transform-classes", { "loose": true }]]
             },
             transpileJS: {
                 files: [{
                     expand: true,
                     cwd: compositionDirectory,
-                    src: ["**/*.js"],
+                    src: ["**/*.js", "!libs/**/*.js"],
                     dest: transpiledDirectory
                 }]
             },
@@ -112,7 +111,7 @@ module.exports = function (grunt) {
                     }
                 }],
                 options: {
-                    plugins: ["transform-es2015-modules-amd"]
+                    plugins: ["@babel/plugin-transform-modules-amd"]
                 }
             }
         },
@@ -160,6 +159,14 @@ module.exports = function (grunt) {
                     ],
                     dest: compiledDirectory
                 }]
+            },
+            libraries: {
+                files: [{
+                    expand: true,
+                    cwd: compositionDirectory,
+                    src: ["libs/**/*.js"],
+                    dest: transpiledDirectory
+                }]
             }
         },
         eslint: {
@@ -370,6 +377,7 @@ module.exports = function (grunt) {
         "copy:compose",
         "eslint",
         "babel",
+        "copy:libraries",
         "requirejs",
         "less",
         "replace",

openam-ui/openam-ui-ria/karma.conf.js

@@ -23,7 +23,7 @@ module.exports = function (config) {
         babelPreprocessor: {
             options: {
                 ignore: ["libs/"],
-                presets: ["env"]
+                presets: [["@babel/preset-env", { "targets": "> 0.2%, not dead, last 2 versions" }],]
             }
         },
         reporters: ["notify", "nyan"],