@scalar/json-magic 0.15.1 → 0.15.2

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @scalar/json-magic
 
+## 0.15.2
+
+### Patch Changes
+
+- [#10342](https://github.com/scalar/scalar/pull/10342): Prevent prototype pollution when merging documents and writing nested values or JSON references, while preserving prototype-named JSON data properties.
+
+  Dot-separated mutations now reject new `constructor` and `prototype` keys, as well as `__proto__`, instead of creating these keys through inherited properties.
+
+- [#10345](https://github.com/scalar/scalar/pull/10345): Update undici to 7.29.0 to address security vulnerabilities in HTTP requests, proxies, WebSockets, cookies, and caching.
+
 ## 0.15.1
 
 ## 0.15.0

package/dist/helpers/get-value-by-path.js

@@ -25,7 +25,7 @@ export function getValueByPath(target, segments) {
             return { context: '', value: undefined };
         }
         // If the accumulator is not an object or is null, stop traversal
-        if (typeof acc.value !== 'object' || acc.value === null) {
+        if (typeof acc.value !== 'object' || acc.value === null || !Object.hasOwn(acc.value, key)) {
             return { context: '', value: undefined };
         }
         // Attempt to get the id from the current value for context tracking

package/dist/helpers/json-path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-path-utils.d.ts","sourceRoot":"","sources":["../../src/helpers/json-path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAWlE"}
+{"version":3,"file":"json-path-utils.d.ts","sourceRoot":"","sources":["../../src/helpers/json-path-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAalE"}

package/dist/helpers/json-path-utils.js

@@ -18,12 +18,14 @@
  */
 export function createPathFromSegments(obj, segments) {
     return segments.reduce((acc, part) => {
-        if (acc[part] === undefined) {
-            if (isNaN(Number(part))) {
-                acc[part] = {};
+        if (!Object.hasOwn(acc, part) || acc[part] === undefined) {
+            const value = isNaN(Number(part)) ? {} : [];
+            if (part === '__proto__') {
+                // Avoid the prototype setter while preserving ordinary proxy set notifications.
+                Object.defineProperty(acc, part, { value, enumerable: true, configurable: true, writable: true });
             }
             else {
-                acc[part] = [];
+                acc[part] = value;
             }
         }
         return acc[part];

package/dist/magic-proxy/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/magic-proxy/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,aAAa,EACnG,QAAQ,CAAC,EACT,UAAU,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAA;IACrB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,EACF,OAAM;IACJ;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;IACX;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC9B;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3B;;OAEG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CAOvB,KACA,CAkNF,CAAA;AAMD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAUnC"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/magic-proxy/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,aAAa,EACnG,QAAQ,CAAC,EACT,UAAU,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAA;IACrB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,EACF,OAAM;IACJ;;OAEG;IACH,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;IACX;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC9B;;OAEG;IACH,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3B;;OAEG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CAOvB,KACA,CAwNF,CAAA;AAMD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAUnC"}

package/dist/magic-proxy/proxy.js

@@ -150,7 +150,14 @@ export const createMagicProxy = (target, options, args = {
                     console.warn(`Trying to set $ref-value for invalid reference: ${ref}\n\nPlease fix your input file to fix this issue.`);
                 }
                 // Set the value on the parent node
-                getParentNode()[segments.at(-1)] = newValue;
+                const parent = getParentNode();
+                const key = segments.at(-1);
+                if (key === '__proto__') {
+                    Object.defineProperty(parent, key, { value: newValue, enumerable: true, configurable: true, writable: true });
+                }
+                else {
+                    parent[key] = newValue;
+                }
                 return true;
             }
             return Reflect.set(target, prop, newValue, receiver);

package/package.json

@@ -10,7 +10,7 @@
     "url": "git+https://github.com/scalar/scalar.git",
     "directory": "packages/json-magic"
   },
-  "version": "0.15.1",
+  "version": "0.15.2",
   "engines": {
     "node": ">=22"
   },
@@ -122,9 +122,9 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@scalar/helpers": "0.14.0",
+    "@scalar/helpers": "0.15.0",
     "pathe": "^2.0.3",
-    "undici": "7.24.4",
+    "undici": "7.29.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {