exiftool-vendored 35.19.0 → 35.21.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -35,7 +35,13 @@ vendored versions of ExifTool match the version that they vendor.
|
|
|
35
35
|
|
|
36
36
|
## History
|
|
37
37
|
|
|
38
|
-
### v35.
|
|
38
|
+
### v35.20.0
|
|
39
|
+
|
|
40
|
+
- 🌱 Upgraded ExifTool to version [13.58](https://exiftool.org/history.html#13.58).
|
|
41
|
+
- ✨ Added Node.js 26 to the CI test matrix.
|
|
42
|
+
- 🐞 Restored support for the `^` write-even-if-empty modifier in tag names (e.g. `Description^`). The v35.19.0 argument-injection hardening tightened the tag-name grammar and inadvertently dropped `^`, breaking sidecar workflows that rely on ExifTool's `^=` operator to force-write empty values. Fixes [#331](https://github.com/photostructure/exiftool-vendored.js/issues/331).
|
|
43
|
+
|
|
44
|
+
### v35.19.0
|
|
39
45
|
|
|
40
46
|
- 🔥 **Security: argument injection hardening [GHSA-cw26-7653-2rp5](https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5).** ExifTool runs in `-stay_open True -@ -` mode, where arguments are read from stdin one per line. Several caller-supplied strings were previously interpolated into ExifTool arguments without rejecting line delimiters, so a `\n` inside a tag name or filename could split one argument into many. Two layers of defense have been added:
|
|
41
47
|
- **Per-site validation.** A new `validateTagName` helper rejects tag-name strings that fall outside the ExifTool tag grammar (letters, digits, `:`, `-`, `_`, and the modifiers `*`, `?`, `+`, `#`). Applied to write tag keys, `deleteAllTags({retain})`, `read({numericTags})`, and the binary-extraction tag names. `imageHashType` is now also validated against an `ImageHashTypes` allowlist at runtime.
|
|
@@ -14,14 +14,15 @@ exports.validateTagName = validateTagName;
|
|
|
14
14
|
* Orientation# (force numeric on write)
|
|
15
15
|
* History+ (list append)
|
|
16
16
|
* Versions+ (list append)
|
|
17
|
+
* Description^ (write tag even if value is empty — see #331)
|
|
17
18
|
*
|
|
18
|
-
* Allowed characters: letters, digits, `:`, `-`, `_`, `*`, `?`, `+`,
|
|
19
|
+
* Allowed characters: letters, digits, `:`, `-`, `_`, `*`, `?`, `+`, `#`, `^`.
|
|
19
20
|
* First character may not be `-` — that would be ambiguous with an exiftool
|
|
20
21
|
* flag (the interpolation site prefixes its own `-`).
|
|
21
22
|
*
|
|
22
23
|
* See https://exiftool.org/TagNames/ and https://exiftool.org/exiftool_pod.html
|
|
23
24
|
*/
|
|
24
|
-
const ValidTagNameRE = /^[A-Za-z0-9_
|
|
25
|
+
const ValidTagNameRE = /^[A-Za-z0-9_:*?+#^][A-Za-z0-9_:\-*?+#^]*$/;
|
|
25
26
|
/**
|
|
26
27
|
* Throw if `name` is not a safe ExifTool tag reference.
|
|
27
28
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TagNameValidation.js","sourceRoot":"","sources":["../src/TagNameValidation.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"TagNameValidation.js","sourceRoot":"","sources":["../src/TagNameValidation.ts"],"names":[],"mappings":";;AAkCA,0CAOC;AAzCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,cAAc,GAAG,2CAA2C,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,OAAO,GAAG,UAAU;IAChE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;YAC7C,wBAAwB,cAAc,GAAG,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -23,11 +23,16 @@ describe("TagNameValidation", () => {
|
|
|
23
23
|
"?mm",
|
|
24
24
|
"Orientation*",
|
|
25
25
|
"*:all",
|
|
26
|
-
// write modifiers — force numeric, list append
|
|
26
|
+
// write modifiers — force numeric, list append, write-even-if-empty
|
|
27
27
|
"Orientation#",
|
|
28
28
|
"History+",
|
|
29
29
|
"Versions+",
|
|
30
30
|
"XMP:History+",
|
|
31
|
+
// ^ is the "write even if empty" modifier — used to force-write empty
|
|
32
|
+
// values to sidecars (see #331).
|
|
33
|
+
"Description^",
|
|
34
|
+
"XMP-dc:Description^",
|
|
35
|
+
"XMP:Title^",
|
|
31
36
|
];
|
|
32
37
|
for (const name of valid) {
|
|
33
38
|
it(`accepts ${JSON.stringify(name)}`, () => {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"TagNameValidation.spec.js","sourceRoot":"","sources":["../src/TagNameValidation.spec.ts"],"names":[],"mappings":";;AAAA,6CAAsC;AACtC,2DAAsD;AAEtD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG;gBACZ,QAAQ;gBACR,aAAa;gBACb,cAAc;gBACd,uBAAuB;gBACvB,cAAc;gBACd,iCAAiC;gBACjC,eAAe;gBACf,gBAAgB;gBAChB,aAAa;gBACb,aAAa;gBACb,UAAU;gBACV,qBAAqB;gBACrB,kDAAkD;gBAClD,YAAY;gBACZ,KAAK;gBACL,cAAc;gBACd,OAAO;gBACP
|
|
1
|
+
{"version":3,"file":"TagNameValidation.spec.js","sourceRoot":"","sources":["../src/TagNameValidation.spec.ts"],"names":[],"mappings":";;AAAA,6CAAsC;AACtC,2DAAsD;AAEtD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;YAC5C,MAAM,KAAK,GAAG;gBACZ,QAAQ;gBACR,aAAa;gBACb,cAAc;gBACd,uBAAuB;gBACvB,cAAc;gBACd,iCAAiC;gBACjC,eAAe;gBACf,gBAAgB;gBAChB,aAAa;gBACb,aAAa;gBACb,UAAU;gBACV,qBAAqB;gBACrB,kDAAkD;gBAClD,YAAY;gBACZ,KAAK;gBACL,cAAc;gBACd,OAAO;gBACP,oEAAoE;gBACpE,cAAc;gBACd,UAAU;gBACV,WAAW;gBACX,cAAc;gBACd,sEAAsE;gBACtE,iCAAiC;gBACjC,cAAc;gBACd,qBAAqB;gBACrB,YAAY;aACb,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,EAAE,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;oBACzC,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;gBACrD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;YACnD,6DAA6D;YAC7D,MAAM,IAAI,GAAG,6CAA6C,CAAC;YAC3D,4DAA4D;YAC5D,MAAM,IAAI,GACR,wEAAwE,CAAC;YAE3E,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;gBAC1D,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;gBACtE,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;YAC7D,MAAM,OAAO,GAAuB;gBAClC,CAAC,EAAE,EAAE,cAAc,CAAC;gBACpB,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC5B,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAC7B,CAAC,SAAS,EAAE,gBAAgB,CAAC;gBAC7B,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAChC,CAAC,UAAU,EAAE,aAAa,CAAC;gBAC3B,CAAC,UAAU,EAAE,UAAU,CAAC;gBACxB,CAAC,UAAU,EAAE,KAAK,CAAC;gBACnB,CAAC,cAAc,EAAE,aAAa,CAAC;gBAC/B,CAAC,cAAc,EAAE,WAAW,CAAC;gBAC7B,CAAC,cAAc,EAAE,cAAc,CAAC;gBAChC,CAAC,WAAW,EAAE,WAAW,CAAC;gBAC1B,CAAC,WAAW,EAAE,MAAM,CAAC;gBACrB,CAAC,WAAW,EAAE,WAAW,CAAC;gBAC1B,CAAC,WAAW,EAAE,aAAa,CAAC;gBAC5B,CAAC,WAAW,EAAE,cAAc,CAAC;gBAC7B,CAAC,WAAW,EAAE,cAAc,CAAC;gBAC7B,CAAC,SAAS,EAAE,cAAc,CAAC;aAC5B,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;gBACnC,EAAE,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;oBACjD,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1D,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC5D,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACnE,yBAAyB,CAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,SAA8B,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CACpE,SAAS,CACV,CAAC;YACF,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,IAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC/D,SAAS,CACV,CAAC;YACF,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,IAAA,mCAAe,EAAC,GAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAC9D,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,6DAA6D;QAC7D,EAAE;QACF,kEAAkE;QAClE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,oBAAoB;QACpB,SAAS,qBAAqB,CAAC,CAAS;YACtC,iHAAiH;YACjH,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,KAAK,MAAM,CAAC,IAAI;gBACd,wBAAwB;gBACxB,wBAAwB;gBACxB,wBAAwB;gBACxB,YAAY;gBACZ,cAAc;gBACd,cAAc;gBACd,cAAc;aACf,EAAE,CAAC;gBACF,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;gBACtE,IAAA,mBAAM,EAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACxD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "exiftool-vendored",
|
|
3
|
-
"version": "35.
|
|
3
|
+
"version": "35.21.0",
|
|
4
4
|
"description": "Efficient, cross-platform access to ExifTool",
|
|
5
5
|
"main": "./dist/ExifTool.js",
|
|
6
6
|
"types": "./dist/ExifTool.d.ts",
|
|
@@ -104,12 +104,12 @@
|
|
|
104
104
|
"@types/globule": "^1.1.10",
|
|
105
105
|
"@types/he": "^1.2.3",
|
|
106
106
|
"@types/mocha": "^10.0.10",
|
|
107
|
-
"@types/node": "^25.
|
|
107
|
+
"@types/node": "^25.9.1",
|
|
108
108
|
"@types/progress": "^2.0.7",
|
|
109
109
|
"@types/source-map-support": "^0.5.10",
|
|
110
110
|
"@types/tmp": "^0.2.6",
|
|
111
111
|
"@types/xmldom": "^0.1.34",
|
|
112
|
-
"@xmldom/xmldom": "^0.9.
|
|
112
|
+
"@xmldom/xmldom": "^0.9.10",
|
|
113
113
|
"chai": "^6.2.2",
|
|
114
114
|
"chai-as-promised": "^8.0.2",
|
|
115
115
|
"deep-eql": "^5.0.2",
|
|
@@ -119,8 +119,8 @@
|
|
|
119
119
|
"eslint-plugin-redos": "^4.5.0",
|
|
120
120
|
"eslint-plugin-regexp": "^3.1.0",
|
|
121
121
|
"extract-zip": "^2.0.1",
|
|
122
|
-
"geo-tz": "^8.1.
|
|
123
|
-
"globals": "^17.
|
|
122
|
+
"geo-tz": "^8.1.7",
|
|
123
|
+
"globals": "^17.6.0",
|
|
124
124
|
"globule": "^1.3.4",
|
|
125
125
|
"mocha": "^11.7.5",
|
|
126
126
|
"npm-check-updates": "^20.0.0",
|
|
@@ -128,7 +128,7 @@
|
|
|
128
128
|
"prettier": "^3.8.3",
|
|
129
129
|
"prettier-plugin-organize-imports": "^4.3.0",
|
|
130
130
|
"progress": "^2.0.3",
|
|
131
|
-
"release-it": "^
|
|
131
|
+
"release-it": "^20.0.1",
|
|
132
132
|
"rimraf": "^6.1.3",
|
|
133
133
|
"serve": "^14.2.6",
|
|
134
134
|
"source-map-support": "^0.5.21",
|
|
@@ -148,7 +148,7 @@
|
|
|
148
148
|
"luxon": "^3.7.2"
|
|
149
149
|
},
|
|
150
150
|
"optionalDependencies": {
|
|
151
|
-
"exiftool-vendored.exe": "13.
|
|
152
|
-
"exiftool-vendored.pl": "13.
|
|
151
|
+
"exiftool-vendored.exe": "13.59.0",
|
|
152
|
+
"exiftool-vendored.pl": "13.59.0"
|
|
153
153
|
}
|
|
154
154
|
}
|