|
1 | 1 |
|
2 | | -/*! js-yaml 4.1.0 https://github.com/nodeca/js-yaml @license MIT */ |
| 2 | +/*! js-yaml 4.1.1 https://github.com/nodeca/js-yaml @license MIT */ |
3 | 3 | (function (global, factory) { |
4 | 4 | typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) : |
5 | 5 | typeof define === 'function' && define.amd ? define(['exports'], factory) : |
6 | 6 | (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.jsyaml = {})); |
7 | | -}(this, (function (exports) { 'use strict'; |
| 7 | +})(this, (function (exports) { 'use strict'; |
8 | 8 |
|
9 | 9 | function isNothing(subject) { |
10 | 10 | return (typeof subject === 'undefined') || (subject === null); |
|
1216 | 1216 | ); |
1217 | 1217 | } |
1218 | 1218 |
|
| 1219 | + // set a property of a literal object, while protecting against prototype pollution, |
| 1220 | + // see https://github.com/nodeca/js-yaml/issues/164 for more details |
| 1221 | + function setProperty(object, key, value) { |
| 1222 | + // used for this specific key only because Object.defineProperty is slow |
| 1223 | + if (key === '__proto__') { |
| 1224 | + Object.defineProperty(object, key, { |
| 1225 | + configurable: true, |
| 1226 | + enumerable: true, |
| 1227 | + writable: true, |
| 1228 | + value: value |
| 1229 | + }); |
| 1230 | + } else { |
| 1231 | + object[key] = value; |
| 1232 | + } |
| 1233 | + } |
| 1234 | + |
1219 | 1235 | var simpleEscapeCheck = new Array(256); // integer, for fast access |
1220 | 1236 | var simpleEscapeMap = new Array(256); |
1221 | 1237 | for (var i = 0; i < 256; i++) { |
|
1394 | 1410 | key = sourceKeys[index]; |
1395 | 1411 |
|
1396 | 1412 | if (!_hasOwnProperty$1.call(destination, key)) { |
1397 | | - destination[key] = source[key]; |
| 1413 | + setProperty(destination, key, source[key]); |
1398 | 1414 | overridableKeys[key] = true; |
1399 | 1415 | } |
1400 | 1416 | } |
|
1454 | 1470 | throwError(state, 'duplicated mapping key'); |
1455 | 1471 | } |
1456 | 1472 |
|
1457 | | - // used for this specific key only because Object.defineProperty is slow |
1458 | | - if (keyNode === '__proto__') { |
1459 | | - Object.defineProperty(_result, keyNode, { |
1460 | | - configurable: true, |
1461 | | - enumerable: true, |
1462 | | - writable: true, |
1463 | | - value: valueNode |
1464 | | - }); |
1465 | | - } else { |
1466 | | - _result[keyNode] = valueNode; |
1467 | | - } |
| 1473 | + setProperty(_result, keyNode, valueNode); |
1468 | 1474 | delete overridableKeys[keyNode]; |
1469 | 1475 | } |
1470 | 1476 |
|
|
3860 | 3866 | exports.Schema = Schema; |
3861 | 3867 | exports.Type = Type; |
3862 | 3868 | exports.YAMLException = YAMLException; |
3863 | | - exports.default = jsYaml; |
| 3869 | + exports["default"] = jsYaml; |
3864 | 3870 | exports.dump = dump; |
3865 | 3871 | exports.load = load; |
3866 | 3872 | exports.loadAll = loadAll; |
|
3871 | 3877 |
|
3872 | 3878 | Object.defineProperty(exports, '__esModule', { value: true }); |
3873 | 3879 |
|
3874 | | -}))); |
| 3880 | +})); |
0 commit comments