plist 3.0.5 → 3.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/ci.yml +24 -0
- package/README.md +5 -5
- package/dist/plist-build.js +4130 -1651
- package/dist/plist-parse.js +13 -1
- package/dist/plist.js +4141 -1650
- package/lib/build.js +3 -0
- package/lib/parse.js +7 -1
- package/package.json +6 -6
package/dist/plist-parse.js
CHANGED
|
@@ -131,8 +131,9 @@ function parsePlistXML (node) {
|
|
|
131
131
|
counter += 1;
|
|
132
132
|
}
|
|
133
133
|
if (counter % 2 === 1) {
|
|
134
|
-
|
|
134
|
+
new_obj[key] = '';
|
|
135
135
|
}
|
|
136
|
+
|
|
136
137
|
return new_obj;
|
|
137
138
|
|
|
138
139
|
} else if (node.nodeName === 'array') {
|
|
@@ -155,6 +156,12 @@ function parsePlistXML (node) {
|
|
|
155
156
|
if (isEmptyNode(node)) {
|
|
156
157
|
return '';
|
|
157
158
|
}
|
|
159
|
+
|
|
160
|
+
invariant(
|
|
161
|
+
node.childNodes[0].nodeValue !== '__proto__',
|
|
162
|
+
'__proto__ keys can lead to prototype pollution. More details on CVE-2022-22912'
|
|
163
|
+
);
|
|
164
|
+
|
|
158
165
|
return node.childNodes[0].nodeValue;
|
|
159
166
|
} else if (node.nodeName === 'string') {
|
|
160
167
|
res = '';
|
|
@@ -208,11 +215,16 @@ function parsePlistXML (node) {
|
|
|
208
215
|
)
|
|
209
216
|
return new Date(node.childNodes[0].nodeValue);
|
|
210
217
|
|
|
218
|
+
} else if (node.nodeName === 'null') {
|
|
219
|
+
return null;
|
|
220
|
+
|
|
211
221
|
} else if (node.nodeName === 'true') {
|
|
212
222
|
return true;
|
|
213
223
|
|
|
214
224
|
} else if (node.nodeName === 'false') {
|
|
215
225
|
return false;
|
|
226
|
+
} else {
|
|
227
|
+
throw new Error('Invalid PLIST tag ' + node.nodeName);
|
|
216
228
|
}
|
|
217
229
|
}
|
|
218
230
|
|