@nocobase/plugin-workflow-loop 2.2.16 → 2.2.18

package/dist/node_modules/joi/lib/messages.js

@@ -37,11 +37,21 @@ exports.compile = function (messages, target) {
         if (code === 'root' ||
             Template.isTemplate(message)) {
 
+            // A flat code named __proto__ triggers the legacy accessor on plain-object assignment, and
+            // what we assign is always a Template, i.e. an object the accessor accepts, so it replaces
+            // target's own prototype instead of creating an own property. That in turn makes
+            // Template.isTemplate(target) true, so every code renders that one message
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = message;
             continue;
         }
 
         if (typeof message === 'string') {
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = new Template(message);
             continue;
         }
@@ -51,20 +61,26 @@ exports.compile = function (messages, target) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Don't reuse an inherited object, otherwise a language named __proto__ or constructor writes on the prototype
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 
@@ -143,11 +159,18 @@ exports.merge = function (base, extended) {
         if (code === 'root' ||
             Template.isTemplate(message)) {
 
+            // Same as in compile(), a flat code named __proto__ replaces target's own prototype
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = message;
             continue;
         }
 
         if (typeof message === 'string') {
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = new Template(message);
             continue;
         }
@@ -157,20 +180,26 @@ exports.merge = function (base, extended) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Same as in compile(), don't reuse an inherited object
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 

package/dist/node_modules/joi/lib/types/keys.js

@@ -547,6 +547,7 @@ module.exports = Any.extend({
         'object.regex': '{{#label}} must be a RegExp object',
         'object.rename.multiple': '{{#label}} cannot rename {{:#from}} because multiple renames are disabled and another key was already renamed to {{:#to}}',
         'object.rename.override': '{{#label}} cannot rename {{:#from}} because override is disabled and target {{:#to}} exists',
+        'object.rename.proto': '{{#label}} cannot rename {{:#from}} because target {{:#to}} is a reserved key',
         'object.schema': '{{#label}} must be a Joi schema of {{#type}} type',
         'object.unknown': '{{#label}} is not allowed',
         'object.with': '{{:#mainWithLabel}} missing required peer {{:#peerWithLabel}}',
@@ -567,8 +568,15 @@ internals.clone = function (value, prefs) {
             return Clone(value, { shallow: true });
         }
 
-        const clone = Object.create(Object.getPrototypeOf(value));
+        const proto = Object.getPrototypeOf(value);
+        const clone = Object.create(proto);
         Object.assign(clone, value);
+
+        // Restore the prototype in case of pre-existing prototype pollution
+        if (Object.getPrototypeOf(clone) !== proto) {
+            Object.setPrototypeOf(clone, proto);
+        }
+
         return clone;
     }
 
@@ -867,6 +875,15 @@ internals.rename = function (schema, value, state, prefs, errors) {
                 }
             }
 
+            if (to === '__proto__') {
+                errors.push(schema.$_createError('object.rename.proto', value, { from, to, pattern }, state, prefs));
+                if (prefs.abortEarly) {
+                    return false;
+                }
+
+                continue;
+            }
+
             if (value[from] === undefined) {
                 delete value[to];
             }

package/dist/node_modules/joi/lib/types/link.js

@@ -29,13 +29,25 @@ module.exports = Any.extend({
         return schema.ref(ref);
     },
 
-    validate(value, { schema, state, prefs }) {
+    validate(value, { schema, state, prefs, error }) {
 
         Assert(schema.$_terms.link, 'Uninitialized link schema');
 
         const linked = internals.generate(schema, value, state, prefs);
         const ref = schema.$_terms.link[0].ref;
-        return linked.$_validate(value, state.nest(linked, `link:${ref.display}:${linked.type}`), prefs);
+
+        try {
+            return linked.$_validate(value, state.nest(linked, `link:${ref.display}:${linked.type}`), prefs);
+        }
+        catch (err) {
+            /* $lab:coverage:off$ */
+            if (!(err instanceof RangeError)) {
+                throw err;
+            }
+            /* $lab:coverage:on$ */
+
+            return { value, errors: error('link.depth') };
+        }
     },
 
     generate(schema, value, state, prefs) {
@@ -88,6 +100,10 @@ module.exports = Any.extend({
         }
     },
 
+    messages: {
+        'link.depth': '{{#label}} exceeds maximum recursion depth supported by the runtime'
+    },
+
     manifest: {
 
         build(obj, desc) {

package/dist/node_modules/joi/lib/types/string.js

@@ -829,8 +829,8 @@ internals.isoDate = function (value) {
         return null;
     }
 
-    if (/.*T.*[+-]\d\d$/.test(value)) {             // Add missing trailing zeros to timeshift
-        value += '00';
+    if (/T.*[+-]\d\d$/.test(value)) {                // Add missing separator and trailing zeros to timeshift
+        value += ':00';
     }
 
     const date = new Date(value);

package/dist/node_modules/joi/package.json

@@ -1 +1 @@
-{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-09-21T01:35:19.733Z"}
+{"name":"joi","description":"Object schema validation","version":"17.13.8","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-09-25T14:54:17.401Z"}

package/package.json

@@ -6,7 +6,7 @@
   "description": "Used to repeat the sub-process processing of each value in an array, and can also be used for fixed times of sub-process processing.",
   "description.zh-CN": "用于对一个数组中的每个值进行重复的子流程处理，也可用于固定次数的重复子流程处理。",
   "description.ru-RU": "Используется для повторения обработки каждого значения в массиве, а также может использоваться для фиксированного количества повторений подпроцесса.",
-  "version": "2.2.16",
+  "version": "2.2.18",
   "license": "Apache-2.0",
   "main": "./dist/server/index.js",
   "homepage": "https://docs.nocobase.com/handbook/workflow-loop",
@@ -14,7 +14,7 @@
   "homepage.zh-CN": "https://docs-cn.nocobase.com/handbook/workflow-loop",
   "devDependencies": {
     "@ant-design/icons": "5.x",
-    "joi": "^17.13.3",
+    "joi": "^17.13.6",
     "react": "18.x",
     "react-i18next": "^11.15.1"
   },
@@ -27,7 +27,7 @@
     "@nocobase/server": "2.x",
     "@nocobase/test": "2.x"
   },
-  "gitHead": "228d1d3cff60d1ef4c91cf5023b20252b7baa0bd",
+  "gitHead": "0c464cd27b2c1ccdf10b00d339bf6599b18bee22",
   "keywords": [
     "Workflow"
   ]