|
| 1 | +From 6f1351c1c631d01ced7d2461c5eeee4552865306 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Rohit Rawat < [email protected]> |
| 3 | +Date: Thu, 10 Oct 2024 12:14:51 +0000 |
| 4 | +Subject: [PATCH] Upgrade path-to-regexp from 0.1.7 to 0.1.11 |
| 5 | + |
| 6 | +CVE-2024-45296 was fixed in https://github.com/pillarjs/path-to-regexp/pull/320 |
| 7 | +which was released in version 0.1.11 |
| 8 | +--- |
| 9 | + path-to-regexp/index.js | 103 ++++++++++++++++++++++++---------------- |
| 10 | + 1 file changed, 62 insertions(+), 41 deletions(-) |
| 11 | + |
| 12 | +diff --git a/src/ui/node_modules/path-to-regexp/index.js b/src/ui/node_modules/path-to-regexp/index.js |
| 13 | +index 500d1dad..39b7caac 100644 |
| 14 | +--- a/src/ui/node_modules/path-to-regexp/index.js |
| 15 | ++++ b/src/ui/node_modules/path-to-regexp/index.js |
| 16 | +@@ -1,13 +1,13 @@ |
| 17 | + /** |
| 18 | +- * Expose `pathtoRegexp`. |
| 19 | ++ * Expose `pathToRegexp`. |
| 20 | + */ |
| 21 | + |
| 22 | +-module.exports = pathtoRegexp; |
| 23 | ++module.exports = pathToRegexp; |
| 24 | + |
| 25 | + /** |
| 26 | + * Match matching groups in a regular expression. |
| 27 | + */ |
| 28 | +-var MATCHING_GROUP_REGEXP = /\((?!\?)/g; |
| 29 | ++var MATCHING_GROUP_REGEXP = /\\.|\((?:\?<(.*?)>)?(?!\?)/g; |
| 30 | + |
| 31 | + /** |
| 32 | + * Normalize the given path string, |
| 33 | +@@ -25,22 +25,27 @@ var MATCHING_GROUP_REGEXP = /\((?!\?)/g; |
| 34 | + * @api private |
| 35 | + */ |
| 36 | + |
| 37 | +-function pathtoRegexp(path, keys, options) { |
| 38 | ++function pathToRegexp(path, keys, options) { |
| 39 | + options = options || {}; |
| 40 | + keys = keys || []; |
| 41 | + var strict = options.strict; |
| 42 | + var end = options.end !== false; |
| 43 | + var flags = options.sensitive ? '' : 'i'; |
| 44 | ++ var lookahead = options.lookahead !== false; |
| 45 | + var extraOffset = 0; |
| 46 | + var keysOffset = keys.length; |
| 47 | + var i = 0; |
| 48 | + var name = 0; |
| 49 | ++ var pos = 0; |
| 50 | ++ var backtrack = ''; |
| 51 | + var m; |
| 52 | + |
| 53 | + if (path instanceof RegExp) { |
| 54 | + while (m = MATCHING_GROUP_REGEXP.exec(path.source)) { |
| 55 | ++ if (m[0][0] === '\\') continue; |
| 56 | ++ |
| 57 | + keys.push({ |
| 58 | +- name: name++, |
| 59 | ++ name: m[1] || name++, |
| 60 | + optional: false, |
| 61 | + offset: m.index |
| 62 | + }); |
| 63 | +@@ -54,20 +59,51 @@ function pathtoRegexp(path, keys, options) { |
| 64 | + // the same keys and options instance into every generation to get |
| 65 | + // consistent matching groups before we join the sources together. |
| 66 | + path = path.map(function (value) { |
| 67 | +- return pathtoRegexp(value, keys, options).source; |
| 68 | ++ return pathToRegexp(value, keys, options).source; |
| 69 | + }); |
| 70 | + |
| 71 | +- return new RegExp('(?:' + path.join('|') + ')', flags); |
| 72 | ++ return new RegExp(path.join('|'), flags); |
| 73 | ++ } |
| 74 | ++ |
| 75 | ++ if (typeof path !== 'string') { |
| 76 | ++ throw new TypeError('path must be a string, array of strings, or regular expression'); |
| 77 | + } |
| 78 | + |
| 79 | +- path = ('^' + path + (strict ? '' : path[path.length - 1] === '/' ? '?' : '/?')) |
| 80 | +- .replace(/\/\(/g, '/(?:') |
| 81 | +- .replace(/([\/\.])/g, '\\$1') |
| 82 | +- .replace(/(\\\/)?(\\\.)?:(\w+)(\(.*?\))?(\*)?(\?)?/g, function (match, slash, format, key, capture, star, optional, offset) { |
| 83 | ++ path = path.replace( |
| 84 | ++ /\\.|(\/)?(\.)?:(\w+)(\(.*?\))?(\*)?(\?)?|[.*]|\/\(/g, |
| 85 | ++ function (match, slash, format, key, capture, star, optional, offset) { |
| 86 | ++ pos = offset + match.length; |
| 87 | ++ |
| 88 | ++ if (match[0] === '\\') { |
| 89 | ++ backtrack += match; |
| 90 | ++ return match; |
| 91 | ++ } |
| 92 | ++ |
| 93 | ++ if (match === '.') { |
| 94 | ++ backtrack += '\\.'; |
| 95 | ++ extraOffset += 1; |
| 96 | ++ return '\\.'; |
| 97 | ++ } |
| 98 | ++ |
| 99 | ++ backtrack = slash || format ? '' : path.slice(pos, offset); |
| 100 | ++ |
| 101 | ++ if (match === '*') { |
| 102 | ++ extraOffset += 3; |
| 103 | ++ return '(.*)'; |
| 104 | ++ } |
| 105 | ++ |
| 106 | ++ if (match === '/(') { |
| 107 | ++ backtrack += '/'; |
| 108 | ++ extraOffset += 2; |
| 109 | ++ return '/(?:'; |
| 110 | ++ } |
| 111 | ++ |
| 112 | + slash = slash || ''; |
| 113 | +- format = format || ''; |
| 114 | +- capture = capture || '([^\\/' + format + ']+?)'; |
| 115 | ++ format = format ? '\\.' : ''; |
| 116 | + optional = optional || ''; |
| 117 | ++ capture = capture ? |
| 118 | ++ capture.replace(/\\.|\*/, function (m) { return m === '*' ? '(.*)' : m; }) : |
| 119 | ++ (backtrack ? '((?:(?!/|' + backtrack + ').)+?)' : '([^/' + format + ']+?)'); |
| 120 | + |
| 121 | + keys.push({ |
| 122 | + name: key, |
| 123 | +@@ -75,41 +111,20 @@ function pathtoRegexp(path, keys, options) { |
| 124 | + offset: offset + extraOffset |
| 125 | + }); |
| 126 | + |
| 127 | +- var result = '' |
| 128 | +- + (optional ? '' : slash) |
| 129 | +- + '(?:' |
| 130 | +- + format + (optional ? slash : '') + capture |
| 131 | +- + (star ? '((?:[\\/' + format + '].+?)?)' : '') |
| 132 | ++ var result = '(?:' |
| 133 | ++ + format + slash + capture |
| 134 | ++ + (star ? '((?:[/' + format + '].+?)?)' : '') |
| 135 | + + ')' |
| 136 | + + optional; |
| 137 | + |
| 138 | + extraOffset += result.length - match.length; |
| 139 | + |
| 140 | + return result; |
| 141 | +- }) |
| 142 | +- .replace(/\*/g, function (star, index) { |
| 143 | +- var len = keys.length |
| 144 | +- |
| 145 | +- while (len-- > keysOffset && keys[len].offset > index) { |
| 146 | +- keys[len].offset += 3; // Replacement length minus asterisk length. |
| 147 | +- } |
| 148 | +- |
| 149 | +- return '(.*)'; |
| 150 | + }); |
| 151 | + |
| 152 | + // This is a workaround for handling unnamed matching groups. |
| 153 | + while (m = MATCHING_GROUP_REGEXP.exec(path)) { |
| 154 | +- var escapeCount = 0; |
| 155 | +- var index = m.index; |
| 156 | +- |
| 157 | +- while (path.charAt(--index) === '\\') { |
| 158 | +- escapeCount++; |
| 159 | +- } |
| 160 | +- |
| 161 | +- // It's possible to escape the bracket. |
| 162 | +- if (escapeCount % 2 === 1) { |
| 163 | +- continue; |
| 164 | +- } |
| 165 | ++ if (m[0][0] === '\\') continue; |
| 166 | + |
| 167 | + if (keysOffset + i === keys.length || keys[keysOffset + i].offset > m.index) { |
| 168 | + keys.splice(keysOffset + i, 0, { |
| 169 | +@@ -122,8 +137,14 @@ function pathtoRegexp(path, keys, options) { |
| 170 | + i++; |
| 171 | + } |
| 172 | + |
| 173 | ++ path += strict ? '' : path[path.length - 1] === '/' ? '?' : '/?'; |
| 174 | ++ |
| 175 | + // If the path is non-ending, match until the end or a slash. |
| 176 | +- path += (end ? '$' : (path[path.length - 1] === '/' ? '' : '(?=\\/|$)')); |
| 177 | ++ if (end) { |
| 178 | ++ path += '$'; |
| 179 | ++ } else if (path[path.length - 1] !== '/') { |
| 180 | ++ path += lookahead ? '(?=/|$)' : '(?:/|$)'; |
| 181 | ++ } |
| 182 | + |
| 183 | +- return new RegExp(path, flags); |
| 184 | +-}; |
| 185 | ++ return new RegExp('^' + path, flags); |
| 186 | ++}; |
| 187 | +\ No newline at end of file |
| 188 | +-- |
| 189 | +2.39.4 |
| 190 | + |
0 commit comments