@adobe/helix-html-pipeline 3.8.8 → 3.8.10

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [3.8.10](https://github.com/adobe/helix-html-pipeline/compare/v3.8.9...v3.8.10) (2023-02-22)
+
+
+### Bug Fixes
+
+* prevent prototype pollution ([#265](https://github.com/adobe/helix-html-pipeline/issues/265)) ([6902eb4](https://github.com/adobe/helix-html-pipeline/commit/6902eb4cbd2682633560b1cf6004cd22cf0988b4))
+
+## [3.8.9](https://github.com/adobe/helix-html-pipeline/compare/v3.8.8...v3.8.9) (2023-02-06)
+
+
+### Bug Fixes
+
+* allow admin jwts ([#258](https://github.com/adobe/helix-html-pipeline/issues/258)) ([312f17d](https://github.com/adobe/helix-html-pipeline/commit/312f17d018b717e35189bca81dee0baa05f531ae))
+
 ## [3.8.8](https://github.com/adobe/helix-html-pipeline/compare/v3.8.7...v3.8.8) (2023-02-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "3.8.8",
+  "version": "3.8.10",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -50,12 +50,12 @@
     "hast-util-to-html": "8.0.4",
     "hast-util-to-string": "2.0.0",
     "hastscript": "7.2.0",
-    "jose": "4.11.2",
+    "jose": "4.12.0",
     "mdast-util-gfm-footnote": "1.0.2",
-    "mdast-util-gfm-strikethrough": "1.0.2",
-    "mdast-util-gfm-table": "1.0.6",
+    "mdast-util-gfm-strikethrough": "1.0.3",
+    "mdast-util-gfm-table": "1.0.7",
     "mdast-util-gfm-task-list-item": "1.0.2",
-    "mdast-util-to-hast": "12.2.6",
+    "mdast-util-to-hast": "12.3.0",
     "mdast-util-to-string": "3.1.1",
     "micromark-extension-gfm-footnote": "1.0.4",
     "micromark-extension-gfm-strikethrough": "1.0.4",
@@ -82,8 +82,8 @@
     "@semantic-release/changelog": "6.0.2",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/npm": "9.0.2",
-    "c8": "7.12.0",
-    "eslint": "8.32.0",
+    "c8": "7.13.0",
+    "eslint": "8.34.0",
     "eslint-import-resolver-exports": "1.0.0-beta.4",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.27.5",
@@ -92,11 +92,11 @@
     "js-yaml": "4.1.0",
     "jsdom": "21.1.0",
     "junit-report-builder": "3.0.1",
-    "lint-staged": "13.1.0",
+    "lint-staged": "13.1.2",
     "mocha": "10.2.0",
     "mocha-multi-reporters": "1.5.1",
     "remark-gfm": "3.0.1",
-    "semantic-release": "19.0.5"
+    "semantic-release": "20.1.0"
   },
   "lint-staged": {
     "*.js": "eslint",

package/src/forms-pipe.js

@@ -28,7 +28,7 @@ function error(log, msg, status, response) {
  * @returns {Object} The converted object
  */
 function searchParamsToObject(searchParams) {
-  const result = {};
+  const result = Object.create(null);
 
   for (const key of searchParams.keys()) {
     // get all values association with the key

package/src/steps/extract-metadata.js

@@ -37,7 +37,7 @@ function toList(list) {
  * @returns {object} The block config
  */
 function readBlockConfig($block) {
-  const config = {};
+  const config = Object.create(null);
   selectAll(':scope>div', $block).forEach(($row) => {
     if ($row?.children[1]) {
       const [$name, $value] = $row.children;

package/src/steps/get-metadata.js

@@ -15,7 +15,7 @@ import { rewriteUrl } from './utils.js';
 
 function yaml(section) {
   section.meta = selectAll('yaml', section)
-    .reduce((prev, { payload }) => Object.assign(prev, payload), {});
+    .reduce((prev, { payload }) => Object.assign(prev, payload), Object.create(null));
   return section;
 }
 

package/src/steps/split-sections.js

@@ -13,7 +13,7 @@ import { selectAll } from 'unist-util-select';
 
 // Compute the meta information for the section
 function computeMeta(section) {
-  return selectAll('yaml', section).reduce((prev, { payload }) => Object.assign(prev, payload), {});
+  return selectAll('yaml', section).reduce((prev, { payload }) => Object.assign(prev, payload), Object.create(null));
 }
 
 /**

package/src/utils/auth.js

@@ -16,12 +16,14 @@ import {
 import { clearAuthCookie, getAuthCookie, setAuthCookie } from './auth-cookie.js';
 
 import idpMicrosoft from './idp-configs/microsoft.js';
+import idpAdmin from './idp-configs/admin.js';
 
 // eslint-disable-next-line import/no-unresolved
 import cryptoImpl from '#crypto';
 
 export const IDPS = [
   idpMicrosoft,
+  idpAdmin,
 ];
 
 const AUTH_REDIRECT_URL = 'https://login.hlx.page/.auth';

package/src/utils/idp-configs/admin.js

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2022 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/**
+ * virtual idp config for the admin service
+ */
+export default {
+  name: 'admin',
+  client: (state) => ({
+    clientId: state.env.HLX_SITE_APP_AZURE_CLIENT_ID,
+  }),
+  validateIssuer: (iss) => iss === 'https://admin.hlx.page/',
+  discovery: {
+    jwks_uri: 'https://admin.hlx.page/auth/discovery/keys',
+  },
+};

package/src/utils/modifiers.js

@@ -48,7 +48,7 @@ function toLowerKeys(obj) {
   return Object.keys(obj).reduce((prev, key) => {
     prev[key.toLowerCase()] = obj[key];
     return prev;
-  }, {});
+  }, Object.create(null));
 }
 
 /**
@@ -91,7 +91,7 @@ export class Modifiers {
    * @returns {object} An object containing an array of key/value pairs for every glob
    */
   static fromModifierSheet(sheet, keyFilter = () => true) {
-    const res = {};
+    const res = Object.create(null);
     for (let row of sheet) {
       row = toLowerKeys(row);
       const {
@@ -140,7 +140,7 @@ export class Modifiers {
    * @return {object} the modifier
    */
   getModifiers(path) {
-    const modifiers = {};
+    const modifiers = Object.create(null);
     for (const { pat, mods } of this.modifiers) {
       if (pat === path || (pat instanceof RegExp && pat.test(path))) {
         for (const { key, value } of mods) {

package/src/utils/section-handler.js

@@ -41,7 +41,7 @@ function getAttributes(section) {
   // Add system properties as data-hlx-*
   const attributes = attributeKeys
     .filter((k) => SYSTEM_HTML_ATTRIBUTES.indexOf(k) > -1)
-    .reduce((result, attr) => Object.assign(result, { [`data-${HELIX_NAMESPACE}${attr}`]: toHtmlAttribute(section.meta[attr]) }), {});
+    .reduce((result, attr) => Object.assign(result, { [`data-${HELIX_NAMESPACE}${attr}`]: toHtmlAttribute(section.meta[attr]) }), Object.create(null));
   return attributeKeys
     .filter((k) => [...SYSTEM_HTML_ATTRIBUTES, ...SYSTEM_META_PROPERTIES].indexOf(k) === -1)
     .reduce((result, attr) => {