set-object-value 0.0.8 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/build/cjs/src/index.js
CHANGED
|
@@ -1,31 +1,41 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
value: true
|
|
5
|
-
});
|
|
3
|
+
exports.__esModule = true;
|
|
6
4
|
exports.unsafeSet = exports["default"] = void 0;
|
|
5
|
+
// @ts-check
|
|
7
6
|
|
|
7
|
+
/**
|
|
8
|
+
* @param {string[]} arrPath
|
|
9
|
+
* @returns {boolean}
|
|
10
|
+
*/
|
|
8
11
|
var isPrototypePolluted = function isPrototypePolluted(arrPath) {
|
|
9
|
-
var joinPath = "|"
|
|
12
|
+
var joinPath = "|" + arrPath.join("|") + "|";
|
|
10
13
|
return ["__proto__", "constructor", "prototype"].some(function (key) {
|
|
11
|
-
return -1 !== joinPath.indexOf("|"
|
|
14
|
+
return -1 !== joinPath.indexOf("|" + key + "|");
|
|
12
15
|
});
|
|
13
16
|
};
|
|
14
17
|
|
|
18
|
+
/**
|
|
19
|
+
* @param {any} obj
|
|
20
|
+
* @param {string[]} arrPath
|
|
21
|
+
* @param {any} val
|
|
22
|
+
* @param {boolean} [isAppend]
|
|
23
|
+
* @param {boolean} [unSafe]
|
|
24
|
+
*/
|
|
15
25
|
var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
16
26
|
if (!unSafe && isPrototypePolluted(arrPath)) {
|
|
17
27
|
throw "Contain un-safe key.";
|
|
18
28
|
}
|
|
19
|
-
|
|
20
|
-
|
|
29
|
+
/**
|
|
30
|
+
* @type string
|
|
31
|
+
*/
|
|
32
|
+
var last = /** @type string */arrPath.pop();
|
|
21
33
|
var linkObj = obj;
|
|
22
34
|
arrPath.forEach(function (k) {
|
|
23
35
|
var _linkObj$k;
|
|
24
|
-
|
|
25
36
|
linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
|
|
26
37
|
linkObj = linkObj[k];
|
|
27
38
|
});
|
|
28
|
-
|
|
29
39
|
if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
|
|
30
40
|
if (!linkObj[last]) {
|
|
31
41
|
linkObj[last] = [val];
|
|
@@ -39,10 +49,15 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
|
39
49
|
}
|
|
40
50
|
};
|
|
41
51
|
|
|
52
|
+
/**
|
|
53
|
+
* @param {any} obj
|
|
54
|
+
* @param {string[]} arrPath
|
|
55
|
+
* @param {any} val
|
|
56
|
+
* @param {boolean} [isAppend]
|
|
57
|
+
*/
|
|
42
58
|
var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
|
|
43
59
|
return replaceValue(obj, arrPath, val, isAppend, true);
|
|
44
60
|
};
|
|
45
|
-
|
|
46
61
|
exports.unsafeSet = unsafeSet;
|
|
47
62
|
var _default = replaceValue;
|
|
48
63
|
exports["default"] = _default;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import set, { unsafeSet } from "../index.js";
|
|
2
1
|
import { expect } from "chai";
|
|
2
|
+
import set, { unsafeSet } from "../index.mjs";
|
|
3
3
|
describe("Test set", function () {
|
|
4
4
|
it("check set result", function () {
|
|
5
5
|
var obj = {};
|
|
@@ -17,31 +17,30 @@ describe("CVE-2020-28281", function () {
|
|
|
17
17
|
expect(obj.isAdmin).to.be.undefined;
|
|
18
18
|
expect(function () {
|
|
19
19
|
return set(obj, ["__proto__", "isAdmin"], true);
|
|
20
|
-
}).to
|
|
20
|
+
}).to.throw();
|
|
21
21
|
expect(function () {
|
|
22
22
|
return set(obj, ["constructor", "isAdmin"], true);
|
|
23
|
-
}).to
|
|
23
|
+
}).to.throw();
|
|
24
24
|
expect(function () {
|
|
25
25
|
return set(obj, ["prototype", "isAdmin"], true);
|
|
26
|
-
}).to
|
|
26
|
+
}).to.throw();
|
|
27
27
|
expect(obj.isAdmin).to.be.undefined;
|
|
28
28
|
expect({}.isAdmin).to.be.undefined;
|
|
29
29
|
set(obj, ["isAdmin"], true);
|
|
30
|
-
expect(obj.isAdmin).to.be
|
|
30
|
+
expect(obj.isAdmin).to.be.true;
|
|
31
31
|
});
|
|
32
32
|
it("should force overwrite prototype with unsafe mode", function () {
|
|
33
33
|
var obj = {};
|
|
34
34
|
unsafeSet(obj, ["__proto__", "fake"], true);
|
|
35
|
-
expect(obj.fake).to.be
|
|
35
|
+
expect(obj.fake).to.be.true;
|
|
36
36
|
});
|
|
37
37
|
it("safe way with unsafe set", function () {
|
|
38
38
|
var obj = Object.create(null);
|
|
39
39
|
unsafeSet(obj, ["__proto__", "fake"], true);
|
|
40
40
|
expect(obj.fake).to.be.undefined;
|
|
41
|
-
expect(obj.__proto__.fake).to.be
|
|
41
|
+
expect(obj.__proto__.fake).to.be.true;
|
|
42
42
|
var obj2 = Object.create(null);
|
|
43
|
-
expect({}.fake).to.be
|
|
44
|
-
|
|
43
|
+
expect({}.fake).to.be.true; // bad case
|
|
45
44
|
expect(obj2.fake).to.be.undefined;
|
|
46
45
|
});
|
|
47
46
|
});
|
|
@@ -1,24 +1,37 @@
|
|
|
1
|
+
// @ts-check
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* @param {string[]} arrPath
|
|
5
|
+
* @returns {boolean}
|
|
6
|
+
*/
|
|
1
7
|
var isPrototypePolluted = function isPrototypePolluted(arrPath) {
|
|
2
|
-
var joinPath = "|"
|
|
8
|
+
var joinPath = "|" + arrPath.join("|") + "|";
|
|
3
9
|
return ["__proto__", "constructor", "prototype"].some(function (key) {
|
|
4
|
-
return -1 !== joinPath.indexOf("|"
|
|
10
|
+
return -1 !== joinPath.indexOf("|" + key + "|");
|
|
5
11
|
});
|
|
6
12
|
};
|
|
7
13
|
|
|
14
|
+
/**
|
|
15
|
+
* @param {any} obj
|
|
16
|
+
* @param {string[]} arrPath
|
|
17
|
+
* @param {any} val
|
|
18
|
+
* @param {boolean} [isAppend]
|
|
19
|
+
* @param {boolean} [unSafe]
|
|
20
|
+
*/
|
|
8
21
|
var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
9
22
|
if (!unSafe && isPrototypePolluted(arrPath)) {
|
|
10
23
|
throw "Contain un-safe key.";
|
|
11
24
|
}
|
|
12
|
-
|
|
13
|
-
|
|
25
|
+
/**
|
|
26
|
+
* @type string
|
|
27
|
+
*/
|
|
28
|
+
var last = /** @type string */arrPath.pop();
|
|
14
29
|
var linkObj = obj;
|
|
15
30
|
arrPath.forEach(function (k) {
|
|
16
31
|
var _linkObj$k;
|
|
17
|
-
|
|
18
32
|
linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
|
|
19
33
|
linkObj = linkObj[k];
|
|
20
34
|
});
|
|
21
|
-
|
|
22
35
|
if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
|
|
23
36
|
if (!linkObj[last]) {
|
|
24
37
|
linkObj[last] = [val];
|
|
@@ -32,9 +45,14 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
|
32
45
|
}
|
|
33
46
|
};
|
|
34
47
|
|
|
48
|
+
/**
|
|
49
|
+
* @param {any} obj
|
|
50
|
+
* @param {string[]} arrPath
|
|
51
|
+
* @param {any} val
|
|
52
|
+
* @param {boolean} [isAppend]
|
|
53
|
+
*/
|
|
35
54
|
var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
|
|
36
55
|
return replaceValue(obj, arrPath, val, isAppend, true);
|
|
37
56
|
};
|
|
38
|
-
|
|
39
57
|
export default replaceValue;
|
|
40
58
|
export { unsafeSet };
|
package/package.json
CHANGED
|
@@ -1,10 +1,19 @@
|
|
|
1
1
|
{
|
|
2
|
+
"version": "0.2.0",
|
|
2
3
|
"name": "set-object-value",
|
|
3
|
-
"
|
|
4
|
+
"repository": {
|
|
5
|
+
"type": "git",
|
|
6
|
+
"url": "https://github.com/react-atomic/react-atomic-organism",
|
|
7
|
+
"directory": "packages/lib/set-object-value"
|
|
8
|
+
},
|
|
9
|
+
"homepage": "https://github.com/react-atomic/react-atomic-organism/tree/main/packages/lib/set-object-value",
|
|
4
10
|
"description": "set object nested value",
|
|
5
|
-
"repository": "react-atomic/react-atomic-organism",
|
|
6
11
|
"main": "./build/cjs/src/index.js",
|
|
7
|
-
"module": "./build/es/src/index.
|
|
12
|
+
"module": "./build/es/src/index.mjs",
|
|
13
|
+
"exports": {
|
|
14
|
+
"require": "./build/cjs/src/index.js",
|
|
15
|
+
"import": "./build/es/src/index.mjs"
|
|
16
|
+
},
|
|
8
17
|
"keywords": [],
|
|
9
18
|
"author": "Hill <hill@kimo.com>",
|
|
10
19
|
"license": "MIT",
|
|
@@ -15,14 +24,22 @@
|
|
|
15
24
|
"mocha": "*"
|
|
16
25
|
},
|
|
17
26
|
"scripts": {
|
|
18
|
-
"clean": "find ./build -name '*.*' | xargs rm -rf",
|
|
19
|
-
"build": "
|
|
20
|
-
"build:
|
|
21
|
-
"build:
|
|
27
|
+
"clean": "find ./build ./types -name '*.*' | xargs rm -rf",
|
|
28
|
+
"build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --ignore /**/__tests__ --root-mode upward",
|
|
29
|
+
"build:es": "BABEL_ENV=es babel src -d build/es/src --out-file-extension .mjs --root-mode upward",
|
|
30
|
+
"build:type": "npx -p typescript tsc src/*.js --declaration --allowJs --emitDeclarationOnly --skipLibCheck --declarationDir types",
|
|
31
|
+
"build": "npm run clean && npm run build:cjs && npm run build:es && npm run build:type",
|
|
22
32
|
"mochaFor": "mocha",
|
|
23
|
-
"mocha": "npm run mochaFor -- 'build/
|
|
33
|
+
"mocha": "npm run mochaFor -- 'build/es/**/__tests__/*.mjs'",
|
|
34
|
+
"test:report": "npm run build && npm run mochaFor -- --reporter mocha-junit-reporter --reporter-options mochaFile=./test_output/mocha.xml 'build/es/**/__tests__/*.mjs'",
|
|
24
35
|
"test": "npm run build && npm run mocha",
|
|
25
36
|
"prepublishOnly": "npm run test"
|
|
26
37
|
},
|
|
27
|
-
"
|
|
38
|
+
"types": "./types/index.d.ts",
|
|
39
|
+
"files": [
|
|
40
|
+
"types",
|
|
41
|
+
"build",
|
|
42
|
+
"package.json",
|
|
43
|
+
"README.md"
|
|
44
|
+
]
|
|
28
45
|
}
|
package/types/index.d.ts
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
export default replaceValue;
|
|
2
|
+
/**
|
|
3
|
+
* @param {any} obj
|
|
4
|
+
* @param {string[]} arrPath
|
|
5
|
+
* @param {any} val
|
|
6
|
+
* @param {boolean} [isAppend]
|
|
7
|
+
* @param {boolean} [unSafe]
|
|
8
|
+
*/
|
|
9
|
+
declare function replaceValue(obj: any, arrPath: string[], val: any, isAppend?: boolean, unSafe?: boolean): void;
|
|
10
|
+
/**
|
|
11
|
+
* @param {any} obj
|
|
12
|
+
* @param {string[]} arrPath
|
|
13
|
+
* @param {any} val
|
|
14
|
+
* @param {boolean} [isAppend]
|
|
15
|
+
*/
|
|
16
|
+
export function unsafeSet(obj: any, arrPath: string[], val: any, isAppend?: boolean): void;
|
|
@@ -1,80 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
|
|
3
|
-
var _interopRequireWildcard = require("reshow-runtime/helpers/interopRequireWildcard");
|
|
4
|
-
|
|
5
|
-
var _index = _interopRequireWildcard(require("../index.js"));
|
|
6
|
-
|
|
7
|
-
var _chai = require("chai");
|
|
8
|
-
|
|
9
|
-
describe("Test set", function () {
|
|
10
|
-
it("check set result", function () {
|
|
11
|
-
var obj = {};
|
|
12
|
-
(0, _index["default"])(obj, ["a", "b"], "c");
|
|
13
|
-
(0, _chai.expect)(obj).to.deep.equal({
|
|
14
|
-
a: {
|
|
15
|
-
b: "c"
|
|
16
|
-
}
|
|
17
|
-
});
|
|
18
|
-
});
|
|
19
|
-
});
|
|
20
|
-
describe("CVE-2020-28281", function () {
|
|
21
|
-
it("should not overwrite prototype", function () {
|
|
22
|
-
var obj = {};
|
|
23
|
-
(0, _chai.expect)(obj.isAdmin).to.be.undefined;
|
|
24
|
-
(0, _chai.expect)(function () {
|
|
25
|
-
return (0, _index["default"])(obj, ["__proto__", "isAdmin"], true);
|
|
26
|
-
}).to["throw"]();
|
|
27
|
-
(0, _chai.expect)(function () {
|
|
28
|
-
return (0, _index["default"])(obj, ["constructor", "isAdmin"], true);
|
|
29
|
-
}).to["throw"]();
|
|
30
|
-
(0, _chai.expect)(function () {
|
|
31
|
-
return (0, _index["default"])(obj, ["prototype", "isAdmin"], true);
|
|
32
|
-
}).to["throw"]();
|
|
33
|
-
(0, _chai.expect)(obj.isAdmin).to.be.undefined;
|
|
34
|
-
(0, _chai.expect)({}.isAdmin).to.be.undefined;
|
|
35
|
-
(0, _index["default"])(obj, ["isAdmin"], true);
|
|
36
|
-
(0, _chai.expect)(obj.isAdmin).to.be["true"];
|
|
37
|
-
});
|
|
38
|
-
it("should force overwrite prototype with unsafe mode", function () {
|
|
39
|
-
var obj = {};
|
|
40
|
-
(0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
|
|
41
|
-
(0, _chai.expect)(obj.fake).to.be["true"];
|
|
42
|
-
});
|
|
43
|
-
it("safe way with unsafe set", function () {
|
|
44
|
-
var obj = Object.create(null);
|
|
45
|
-
(0, _index.unsafeSet)(obj, ["__proto__", "fake"], true);
|
|
46
|
-
(0, _chai.expect)(obj.fake).to.be.undefined;
|
|
47
|
-
(0, _chai.expect)(obj.__proto__.fake).to.be["true"];
|
|
48
|
-
var obj2 = Object.create(null);
|
|
49
|
-
(0, _chai.expect)({}.fake).to.be["true"]; // bad case
|
|
50
|
-
|
|
51
|
-
(0, _chai.expect)(obj2.fake).to.be.undefined;
|
|
52
|
-
});
|
|
53
|
-
});
|
|
54
|
-
describe("Test append", function () {
|
|
55
|
-
it("test simple append", function () {
|
|
56
|
-
var obj = {};
|
|
57
|
-
(0, _index["default"])(obj, ["a"], "a1", true);
|
|
58
|
-
(0, _index["default"])(obj, ["a"], "a2", true);
|
|
59
|
-
(0, _chai.expect)(obj).to.deep.equal({
|
|
60
|
-
a: ["a1", "a2"]
|
|
61
|
-
});
|
|
62
|
-
});
|
|
63
|
-
it("should keep origin value", function () {
|
|
64
|
-
var obj = {};
|
|
65
|
-
(0, _index["default"])(obj, ["a"], "a3");
|
|
66
|
-
(0, _index["default"])(obj, ["a"], "a4", true);
|
|
67
|
-
(0, _chai.expect)(obj).to.deep.equal({
|
|
68
|
-
a: ["a3", "a4"]
|
|
69
|
-
});
|
|
70
|
-
});
|
|
71
|
-
it("last is not array", function () {
|
|
72
|
-
var obj = {
|
|
73
|
-
a: {
|
|
74
|
-
b: "foo"
|
|
75
|
-
}
|
|
76
|
-
};
|
|
77
|
-
(0, _index["default"])(obj, ["a", "b"], "bar", true);
|
|
78
|
-
(0, _chai.expect)(obj.a.b).to.deep.equal(["foo", "bar"]);
|
|
79
|
-
});
|
|
80
|
-
});
|