npm - @noir-lang/noir_wasm - Versions diffs - 1.0.0-beta.10-3052aa0.nightly → 1.0.0-beta.10-18f8faf.nightly - Mend

@noir-lang/noir_wasm 1.0.0-beta.10-3052aa0.nightly → 1.0.0-beta.10-18f8faf.nightly

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/node/index_bg.wasm CHANGED Viewed

Binary file

package/dist/node/main.js CHANGED Viewed

@@ -12140,6 +12140,12 @@ function resolveGithubCodeArchive(dependency, format) {
     if (!owner || !repo || gitUrl.hostname !== 'github.com') {
         throw new Error('Invalid Github repository URL');
     }
+    // Validate ref to prevent path traversal attacks
+    // First decode any URL encoding to catch encoded path traversal attempts
+    const decodedRef = decodeURIComponent(ref);
+    if (decodedRef.includes('..') || decodedRef.includes('/') || decodedRef.includes('\\')) {
+        throw new Error('Invalid git reference. Git references cannot contain path traversal characters');
+    }
     return new URL(`https://github.com/${owner}/${repo}/archive/${ref}.${extension}`);
 }