@percy/config 1.30.8-beta.1 → 1.30.8

package/dist/defaults.js

@@ -1,4 +1,4 @@
-import { merge } from './utils/index.js';
+import { merge, sanitizeObject } from './utils/index.js';
 import { getSchema } from './validate.js';
 const {
   isArray
@@ -30,7 +30,11 @@ function getDefaultsFromSchema(schema) {
   }
 }
 export function getDefaults(overrides = {}) {
-  return merge([getDefaultsFromSchema(), overrides], (path, prev, next) => {
+  // We are sanitizing the overrides object to prevent prototype pollution.
+  // This ensures protection against attacks where a payload having Object.prototype setters
+  // to add or modify properties on the global prototype chain, which could lead to issues like denial of service (DoS) at a minimum.
+  const sanitizedOverrides = sanitizeObject(overrides);
+  return merge([getDefaultsFromSchema(), sanitizedOverrides], (path, prev, next) => {
     // override default array instead of merging
     return isArray(next) && [path, next];
   });

package/dist/utils/normalize.js

@@ -1,5 +1,8 @@
 import merge from './merge.js';
 import { getSchema } from '../validate.js';
+const {
+  isArray
+} = Array;
 
 // Edge case camelizations
 const CAMELCASE_MAP = new Map([['css', 'CSS'], ['javascript', 'JavaScript'], ['dom', 'DOM']]);
@@ -7,6 +10,9 @@ const CAMELCASE_MAP = new Map([['css', 'CSS'], ['javascript', 'JavaScript'], ['d
 // Regular expression that matches words from boundaries or consecutive casing
 const WORD_REG = /[a-z]{2,}|[A-Z]{2,}|[0-9]{2,}|[^-_\s]+?(?=[A-Z0-9-_\s]|$)/g;
 
+// Unsafe keys list
+const UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype', 'toString', 'valueOf', '__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__'];
+
 // Converts kebab-cased and snake_cased strings to camelCase.
 export function camelcase(str) {
   if (typeof str !== 'string') return str;
@@ -53,4 +59,24 @@ export function normalize(object, options) {
     return [mapped];
   });
 }
+
+// Utility function to prevent prototype pollution
+export function isSafeKey(key) {
+  return !UNSAFE_KEYS.includes(key);
+}
+export function sanitizeObject(obj) {
+  if (!obj || typeof obj !== 'object' || isArray(obj)) {
+    return obj;
+  }
+  if (obj instanceof RegExp) {
+    return obj;
+  }
+  const sanitized = {};
+  for (const key in obj) {
+    if (isSafeKey(key)) {
+      sanitized[key] = sanitizeObject(obj[key]);
+    }
+  }
+  return sanitized;
+}
 export default normalize;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@percy/config",
-  "version": "1.30.8-beta.1",
+  "version": "1.30.8",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -9,7 +9,7 @@
   },
   "publishConfig": {
     "access": "public",
-    "tag": "beta"
+    "tag": "latest"
   },
   "engines": {
     "node": ">=14"
@@ -38,7 +38,7 @@
     "test:types": "tsd"
   },
   "dependencies": {
-    "@percy/logger": "1.30.8-beta.1",
+    "@percy/logger": "1.30.8",
     "ajv": "^8.6.2",
     "cosmiconfig": "^8.0.0",
     "yaml": "^2.0.0"
@@ -46,5 +46,5 @@
   "devDependencies": {
     "json-schema-typed": "^7.0.3"
   },
-  "gitHead": "db04f87e6074b48cc3940ccffbefe59407016cf6"
+  "gitHead": "daa3c96d70488a49671e48427c9b363c68876935"
 }