@adobe/helix-html-pipeline 3.8.9 → 3.8.11

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [3.8.11](https://github.com/adobe/helix-html-pipeline/compare/v3.8.10...v3.8.11) (2023-03-02)
+
+
+### Bug Fixes
+
+* 404 response should include path-based surrogate key ([3600968](https://github.com/adobe/helix-html-pipeline/commit/36009680c7450bbf6c7c1cb54e0d9781a59410dd))
+
+## [3.8.10](https://github.com/adobe/helix-html-pipeline/compare/v3.8.9...v3.8.10) (2023-02-22)
+
+
+### Bug Fixes
+
+* prevent prototype pollution ([#265](https://github.com/adobe/helix-html-pipeline/issues/265)) ([6902eb4](https://github.com/adobe/helix-html-pipeline/commit/6902eb4cbd2682633560b1cf6004cd22cf0988b4))
+
 ## [3.8.9](https://github.com/adobe/helix-html-pipeline/compare/v3.8.8...v3.8.9) (2023-02-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "3.8.9",
+  "version": "3.8.11",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -50,7 +50,7 @@
     "hast-util-to-html": "8.0.4",
     "hast-util-to-string": "2.0.0",
     "hastscript": "7.2.0",
-    "jose": "4.11.2",
+    "jose": "4.12.0",
     "mdast-util-gfm-footnote": "1.0.2",
     "mdast-util-gfm-strikethrough": "1.0.3",
     "mdast-util-gfm-table": "1.0.7",
@@ -77,14 +77,14 @@
     "unist-util-visit-parents": "5.1.3"
   },
   "devDependencies": {
-    "@adobe/eslint-config-helix": "2.0.1",
+    "@adobe/eslint-config-helix": "2.0.2",
     "@markedjs/html-differ": "4.0.2",
     "@semantic-release/changelog": "6.0.2",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/npm": "9.0.2",
-    "c8": "7.12.0",
-    "eslint": "8.33.0",
-    "eslint-import-resolver-exports": "1.0.0-beta.4",
+    "c8": "7.13.0",
+    "eslint": "8.34.0",
+    "eslint-import-resolver-exports": "1.0.0-beta.5",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.27.5",
     "esmock": "2.1.0",
@@ -92,11 +92,11 @@
     "js-yaml": "4.1.0",
     "jsdom": "21.1.0",
     "junit-report-builder": "3.0.1",
-    "lint-staged": "13.1.0",
+    "lint-staged": "13.1.2",
     "mocha": "10.2.0",
     "mocha-multi-reporters": "1.5.1",
     "remark-gfm": "3.0.1",
-    "semantic-release": "19.0.5"
+    "semantic-release": "20.1.0"
   },
   "lint-staged": {
     "*.js": "eslint",

package/src/forms-pipe.js

@@ -28,7 +28,7 @@ function error(log, msg, status, response) {
  * @returns {Object} The converted object
  */
 function searchParamsToObject(searchParams) {
-  const result = {};
+  const result = Object.create(null);
 
   for (const key of searchParams.keys()) {
     // get all values association with the key

package/src/steps/extract-metadata.js

@@ -37,7 +37,7 @@ function toList(list) {
  * @returns {object} The block config
  */
 function readBlockConfig($block) {
-  const config = {};
+  const config = Object.create(null);
   selectAll(':scope>div', $block).forEach(($row) => {
     if ($row?.children[1]) {
       const [$name, $value] = $row.children;

package/src/steps/fetch-content.js

@@ -82,7 +82,8 @@ export default async function fetchContent(state, req, res) {
       res.body = ret404.body;
       res.headers.set('last-modified', ret404.headers.get('last-modified'));
       res.headers.set('content-type', 'text/html; charset=utf-8');
-      res.headers.set('x-surrogate-key', `${ref}--${repo}--${owner}_404`);
+      const pathKey = await computeSurrogateKey(`${contentBusId}${info.path}`);
+      res.headers.set('x-surrogate-key', `${pathKey} ${ref}--${repo}--${owner}_404`);
     }
   }
 }

package/src/steps/get-metadata.js

@@ -15,7 +15,7 @@ import { rewriteUrl } from './utils.js';
 
 function yaml(section) {
   section.meta = selectAll('yaml', section)
-    .reduce((prev, { payload }) => Object.assign(prev, payload), {});
+    .reduce((prev, { payload }) => Object.assign(prev, payload), Object.create(null));
   return section;
 }
 

package/src/steps/split-sections.js

@@ -13,7 +13,7 @@ import { selectAll } from 'unist-util-select';
 
 // Compute the meta information for the section
 function computeMeta(section) {
-  return selectAll('yaml', section).reduce((prev, { payload }) => Object.assign(prev, payload), {});
+  return selectAll('yaml', section).reduce((prev, { payload }) => Object.assign(prev, payload), Object.create(null));
 }
 
 /**

package/src/utils/modifiers.js

@@ -48,7 +48,7 @@ function toLowerKeys(obj) {
   return Object.keys(obj).reduce((prev, key) => {
     prev[key.toLowerCase()] = obj[key];
     return prev;
-  }, {});
+  }, Object.create(null));
 }
 
 /**
@@ -91,7 +91,7 @@ export class Modifiers {
    * @returns {object} An object containing an array of key/value pairs for every glob
    */
   static fromModifierSheet(sheet, keyFilter = () => true) {
-    const res = {};
+    const res = Object.create(null);
     for (let row of sheet) {
       row = toLowerKeys(row);
       const {
@@ -140,7 +140,7 @@ export class Modifiers {
    * @return {object} the modifier
    */
   getModifiers(path) {
-    const modifiers = {};
+    const modifiers = Object.create(null);
     for (const { pat, mods } of this.modifiers) {
       if (pat === path || (pat instanceof RegExp && pat.test(path))) {
         for (const { key, value } of mods) {

package/src/utils/section-handler.js

@@ -41,7 +41,7 @@ function getAttributes(section) {
   // Add system properties as data-hlx-*
   const attributes = attributeKeys
     .filter((k) => SYSTEM_HTML_ATTRIBUTES.indexOf(k) > -1)
-    .reduce((result, attr) => Object.assign(result, { [`data-${HELIX_NAMESPACE}${attr}`]: toHtmlAttribute(section.meta[attr]) }), {});
+    .reduce((result, attr) => Object.assign(result, { [`data-${HELIX_NAMESPACE}${attr}`]: toHtmlAttribute(section.meta[attr]) }), Object.create(null));
   return attributeKeys
     .filter((k) => [...SYSTEM_HTML_ATTRIBUTES, ...SYSTEM_META_PROPERTIES].indexOf(k) === -1)
     .reduce((result, attr) => {