@exodus/market-history 9.0.2 → 9.0.4

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [9.0.4](https://github.com/ExodusMovement/exodus-hydra/compare/@exodus/market-history@9.0.3...@exodus/market-history@9.0.4) (2024-07-25)
+
+### Bug Fixes
+
+- **market-history:** harden against prototype pollution bugs ([#8079](https://github.com/ExodusMovement/exodus-hydra/issues/8079)) ([3715950](https://github.com/ExodusMovement/exodus-hydra/commit/3715950347c3228e7a156952430b6b1f41901847))
+
+## [9.0.3](https://github.com/ExodusMovement/exodus-hydra/compare/@exodus/market-history@9.0.2...@exodus/market-history@9.0.3) (2024-07-25)
+
+### Bug Fixes
+
+- migrate definitions ([#8030](https://github.com/ExodusMovement/exodus-hydra/issues/8030)) ([d2dfde5](https://github.com/ExodusMovement/exodus-hydra/commit/d2dfde55dfa843eb52842f64b3aac3a6f9a59069))
+
 ## [9.0.2](https://github.com/ExodusMovement/exodus-hydra/compare/@exodus/market-history@9.0.1...@exodus/market-history@9.0.2) (2024-07-18)
 
 **Note:** Version bump only for package @exodus/market-history

package/atoms/index.js

@@ -4,8 +4,9 @@ import { createRemoteConfigAtomFactory } from '@exodus/remote-config-atoms'
 export const marketHistoryAtomDefinition = {
   id: 'marketHistoryAtom',
   type: 'atom',
-  factory: () => createInMemoryAtom({}), // eslint-disable-line @exodus/hydra/in-memory-atom-default-value
+  factory: () => createInMemoryAtom(Object.create(null)), // eslint-disable-line @exodus/hydra/in-memory-atom-default-value
   dependencies: [],
+  public: true,
 }
 
 export const marketHistoryRefreshIntervalAtomDefinition = {
@@ -13,6 +14,7 @@ export const marketHistoryRefreshIntervalAtomDefinition = {
   type: 'atom',
   factory: ({ config, remoteConfig }) => createRemoteConfigAtomFactory({ remoteConfig })(config),
   dependencies: ['config', 'remoteConfig'],
+  public: true,
 }
 
 export const marketHistoryClearCacheAtomDefinition = {
@@ -20,6 +22,7 @@ export const marketHistoryClearCacheAtomDefinition = {
   type: 'atom',
   factory: ({ config }) => createInMemoryAtom(config),
   dependencies: ['config'],
+  public: true,
 }
 
 export const remoteConfigClearMarketHistoryCacheAtomDefinition = {
@@ -27,4 +30,5 @@ export const remoteConfigClearMarketHistoryCacheAtomDefinition = {
   type: 'atom',
   factory: ({ config, remoteConfig }) => createRemoteConfigAtomFactory({ remoteConfig })(config),
   dependencies: ['config', 'remoteConfig'],
+  public: true,
 }

package/module/index.js

@@ -145,7 +145,7 @@ class MarketHistoryMonitor extends ExodusModule {
       }
 
       return acc
-    }, {})
+    }, Object.create(null))
 
     if (!hasChanges) return
     await this.storage.batchSet(changes)
@@ -175,7 +175,8 @@ class MarketHistoryMonitor extends ExodusModule {
     const assets = this.assetsModule.getAssets()
     const assetTickers = assetNames.map((assetName) => assets[assetName].ticker)
 
-    const cacheRefreshData = (await this.storage.get(MARKET_HISTORY_REFRESH_KEY)) || {}
+    const cacheRefreshData =
+      (await this.storage.get(MARKET_HISTORY_REFRESH_KEY)) || Object.create(null)
 
     const cacheRefreshKey = `${granularity}-${currency}`
     const latestRefreshTimestamp = cacheRefreshData[cacheRefreshKey] || 0
@@ -250,7 +251,7 @@ class MarketHistoryMonitor extends ExodusModule {
       await this.#marketHistoryAtom.set(async (current) => ({
         data: mergePricesInAtom({
           prices,
-          atomData: current?.data ?? {},
+          atomData: current?.data ?? Object.create(null),
           currency,
           parsedGranularity,
         }),
@@ -299,7 +300,7 @@ class MarketHistoryMonitor extends ExodusModule {
     const promises = granularities.map((granularity) => this.#updateAssets(granularity, assetNames))
 
     const results = await Promise.all(promises)
-    let changes = {}
+    let changes = Object.create(null)
     const updateChanges = ({ prices, granularity }) => {
       changes = {
         ...changes,
@@ -319,7 +320,7 @@ class MarketHistoryMonitor extends ExodusModule {
 
     if (Object.keys(changes).length > 0) {
       await this.#marketHistoryAtom.set((current) => {
-        let data = current?.data ?? {}
+        let data = current?.data ?? Object.create(null)
         granularities.forEach((granularity, index) => {
           const result = results[index]
           if (result) {
@@ -400,7 +401,7 @@ class MarketHistoryMonitor extends ExodusModule {
       enabledAssets: this.#enabledAssetsAtom,
     })
 
-    await difference(combinedAtom).observe(({ current, previous = {} }) => {
+    await difference(combinedAtom).observe(({ current, previous = Object.create(null) }) => {
       const { currency, enabledAssets } = current
       const { currency: previousCurrency, enabledAssets: previousEnabledAssets } = previous
       if (!enabledAssets || Object.keys(enabledAssets).length === 0) return
@@ -504,7 +505,7 @@ class MarketHistoryMonitor extends ExodusModule {
           prices: {
             [assetName]: transformedPrices,
           },
-          atomData: current?.data ?? {},
+          atomData: current?.data ?? Object.create(null),
           currency,
           parsedGranularity: parseGranularity(granularity),
         })
@@ -517,7 +518,8 @@ class MarketHistoryMonitor extends ExodusModule {
   )
 }
 
-const createMarketHistoryMonitor = (args = {}) => new MarketHistoryMonitor({ ...args })
+const createMarketHistoryMonitor = (args = Object.create(null)) =>
+  new MarketHistoryMonitor({ ...args })
 
 const marketHistoryMonitorDefinition = {
   id: MODULE_ID,
@@ -538,6 +540,7 @@ const marketHistoryMonitorDefinition = {
     'config',
     'synchronizedTime',
   ],
+  public: true,
 }
 
 export default marketHistoryMonitorDefinition

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/market-history",
-  "version": "9.0.2",
+  "version": "9.0.4",
   "description": "Fetches historical prices for assets",
   "author": "Exodus Movement, Inc.",
   "license": "UNLICENSED",
@@ -36,12 +36,12 @@
   "devDependencies": {
     "@exodus/assets": "^8.0.94",
     "@exodus/assets-base": "^8.1.6",
-    "@exodus/assets-feature": "^5.8.1",
+    "@exodus/assets-feature": "^5.8.2",
     "@exodus/bitcoin-meta": "^1.0.1",
     "@exodus/ethereum-meta": "^1.0.30",
-    "@exodus/locale": "^2.2.1",
+    "@exodus/locale": "^2.2.2",
     "@exodus/logger": "^1.1.0",
-    "@exodus/rates-monitor": "^4.3.2",
+    "@exodus/rates-monitor": "^4.3.3",
     "@exodus/redux-dependency-injection": "^3.2.3",
     "@exodus/storage-memory": "^2.1.1",
     "events": "^3.3.0",
@@ -55,5 +55,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/exodus-hydra.git"
   },
-  "gitHead": "a76a22c96445bcaa05e18de0e0c323cf9dd04cba"
+  "gitHead": "0899fc085ddbe0bad881ac5b868a333b250d963d"
 }

package/plugin/index.js

@@ -52,6 +52,7 @@ const marketHistoryLifecyclePluginDefinition = {
   type: 'plugin',
   factory: createMarketHistoryLifecyclePlugin,
   dependencies: ['marketHistoryMonitor', 'marketHistoryAtom', 'appProcessAtom?', 'port'],
+  public: true,
 }
 
 export default marketHistoryLifecyclePluginDefinition

package/redux/initial-state.js

@@ -1,6 +1,6 @@
 const marketHistoryInitialState = {
   loaded: false,
-  data: {},
+  data: Object.create(null),
 }
 
 export default marketHistoryInitialState

package/redux/selectors/create-asset-daily-prices-loading.js

@@ -1,4 +1,4 @@
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import { createSelector } from 'reselect'
 import assetLoadingResultFunc from './helpers/asset-loading-result-func'
 

package/redux/selectors/create-asset-hourly-prices-loading.js

@@ -1,4 +1,4 @@
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import { createSelector } from 'reselect'
 import assetLoadingResultFunc from './helpers/asset-loading-result-func'
 

package/redux/selectors/daily-prices.js

@@ -1,4 +1,4 @@
-const DEFAULT = {}
+const DEFAULT = Object.create(null)
 const resultFunction = (fiatMarketHistory) => fiatMarketHistory?.daily ?? DEFAULT
 
 const dailyPricesSelector = {

package/redux/selectors/fiat-market-history.js

@@ -1,4 +1,4 @@
-const DEFAULT = {}
+const DEFAULT = Object.create(null)
 const resultFunction = (marketHistory, fiat) =>
   marketHistory?.[fiat.defaultUnit.unitName] ?? DEFAULT
 

package/redux/selectors/get-asset-daily-price.js

@@ -1,4 +1,4 @@
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import { createSelector } from 'reselect'
 import memoizeGetAssetPrice from './helpers/memoize-get-asset-price'
 

package/redux/selectors/get-asset-hourly-price.js

@@ -1,4 +1,4 @@
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 
 import { createSelector } from 'reselect'
 import memoizeGetAssetPrices from './helpers/memoize-get-asset-price'

package/redux/selectors/get-price-with-fallback.js

@@ -1,4 +1,4 @@
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import ms from 'ms'
 
 const PERIOD_TO_MS = {

package/redux/selectors/helpers/append-prices-with-rate.js

@@ -1,6 +1,11 @@
 import { prepareTime } from './date-utils'
 
-const appendPricesWithRate = ({ historicalPrices = {}, rate, type, currentTime }) => {
+const appendPricesWithRate = ({
+  historicalPrices = Object.create(null),
+  rate,
+  type,
+  currentTime,
+}) => {
   if (historicalPrices instanceof Error) return null
   if (rate && rate.price) {
     const time = prepareTime(new Date(currentTime), type)

package/redux/selectors/helpers/memoize-get-asset-price.js

@@ -1,5 +1,5 @@
 import appendPricesWithRate from './append-prices-with-rate'
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import { prepareTime } from './date-utils'
 
 const memoizeGetAssetPrices = (historicalPrices, rate, type, currentTime) => {

package/redux/selectors/helpers/memoize-get-price.js

@@ -1,5 +1,5 @@
 import appendPricesWithRate from './append-prices-with-rate'
-import { memoize } from 'lodash'
+import { memoize } from 'lodash' // eslint-disable-line @exodus/restricted-imports/prefer-basic-utils -- TODO: fix next time we touch this file
 import { prepareTime } from './date-utils'
 
 const memoizeGetPrices = (getAssetPrices, rates, type, assets, currentTime) => {

package/redux/selectors/hourly-prices.js

@@ -1,4 +1,4 @@
-const DEFAULT = {}
+const DEFAULT = Object.create(null)
 const resultFunction = (fiatMarketHistory) => fiatMarketHistory?.hourly ?? DEFAULT
 
 const hourlyPricesSelector = {

package/utils.js

@@ -1,4 +1,4 @@
-const assetFromTickerCache = {}
+const assetFromTickerCache = Object.create(null)
 export const getAssetFromTicker = (assets, ticker) => {
   if (assetFromTickerCache[ticker]) return assetFromTickerCache[ticker]
   return Object.values(assets).find((asset) => {