set-object-value 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/cjs/src/index.js +25 -10
- package/build/es/src/__tests__/IndexTest.mjs +8 -9
- package/build/es/src/index.mjs +25 -7
- package/package.json +7 -3
- package/types/index.d.ts +16 -0
package/build/cjs/src/index.js
CHANGED
|
@@ -1,31 +1,41 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
|
|
3
|
-
|
|
4
|
-
value: true
|
|
5
|
-
});
|
|
3
|
+
exports.__esModule = true;
|
|
6
4
|
exports.unsafeSet = exports["default"] = void 0;
|
|
5
|
+
// @ts-check
|
|
7
6
|
|
|
7
|
+
/**
|
|
8
|
+
* @param {string[]} arrPath
|
|
9
|
+
* @returns {boolean}
|
|
10
|
+
*/
|
|
8
11
|
var isPrototypePolluted = function isPrototypePolluted(arrPath) {
|
|
9
|
-
var joinPath = "|"
|
|
12
|
+
var joinPath = "|" + arrPath.join("|") + "|";
|
|
10
13
|
return ["__proto__", "constructor", "prototype"].some(function (key) {
|
|
11
|
-
return -1 !== joinPath.indexOf("|"
|
|
14
|
+
return -1 !== joinPath.indexOf("|" + key + "|");
|
|
12
15
|
});
|
|
13
16
|
};
|
|
14
17
|
|
|
18
|
+
/**
|
|
19
|
+
* @param {any} obj
|
|
20
|
+
* @param {string[]} arrPath
|
|
21
|
+
* @param {any} val
|
|
22
|
+
* @param {boolean} [isAppend]
|
|
23
|
+
* @param {boolean} [unSafe]
|
|
24
|
+
*/
|
|
15
25
|
var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
16
26
|
if (!unSafe && isPrototypePolluted(arrPath)) {
|
|
17
27
|
throw "Contain un-safe key.";
|
|
18
28
|
}
|
|
19
|
-
|
|
20
|
-
|
|
29
|
+
/**
|
|
30
|
+
* @type string
|
|
31
|
+
*/
|
|
32
|
+
var last = /** @type string */arrPath.pop();
|
|
21
33
|
var linkObj = obj;
|
|
22
34
|
arrPath.forEach(function (k) {
|
|
23
35
|
var _linkObj$k;
|
|
24
|
-
|
|
25
36
|
linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
|
|
26
37
|
linkObj = linkObj[k];
|
|
27
38
|
});
|
|
28
|
-
|
|
29
39
|
if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
|
|
30
40
|
if (!linkObj[last]) {
|
|
31
41
|
linkObj[last] = [val];
|
|
@@ -39,10 +49,15 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
|
39
49
|
}
|
|
40
50
|
};
|
|
41
51
|
|
|
52
|
+
/**
|
|
53
|
+
* @param {any} obj
|
|
54
|
+
* @param {string[]} arrPath
|
|
55
|
+
* @param {any} val
|
|
56
|
+
* @param {boolean} [isAppend]
|
|
57
|
+
*/
|
|
42
58
|
var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
|
|
43
59
|
return replaceValue(obj, arrPath, val, isAppend, true);
|
|
44
60
|
};
|
|
45
|
-
|
|
46
61
|
exports.unsafeSet = unsafeSet;
|
|
47
62
|
var _default = replaceValue;
|
|
48
63
|
exports["default"] = _default;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import set, { unsafeSet } from "../index.mjs";
|
|
2
1
|
import { expect } from "chai";
|
|
2
|
+
import set, { unsafeSet } from "../index.mjs";
|
|
3
3
|
describe("Test set", function () {
|
|
4
4
|
it("check set result", function () {
|
|
5
5
|
var obj = {};
|
|
@@ -17,31 +17,30 @@ describe("CVE-2020-28281", function () {
|
|
|
17
17
|
expect(obj.isAdmin).to.be.undefined;
|
|
18
18
|
expect(function () {
|
|
19
19
|
return set(obj, ["__proto__", "isAdmin"], true);
|
|
20
|
-
}).to
|
|
20
|
+
}).to.throw();
|
|
21
21
|
expect(function () {
|
|
22
22
|
return set(obj, ["constructor", "isAdmin"], true);
|
|
23
|
-
}).to
|
|
23
|
+
}).to.throw();
|
|
24
24
|
expect(function () {
|
|
25
25
|
return set(obj, ["prototype", "isAdmin"], true);
|
|
26
|
-
}).to
|
|
26
|
+
}).to.throw();
|
|
27
27
|
expect(obj.isAdmin).to.be.undefined;
|
|
28
28
|
expect({}.isAdmin).to.be.undefined;
|
|
29
29
|
set(obj, ["isAdmin"], true);
|
|
30
|
-
expect(obj.isAdmin).to.be
|
|
30
|
+
expect(obj.isAdmin).to.be.true;
|
|
31
31
|
});
|
|
32
32
|
it("should force overwrite prototype with unsafe mode", function () {
|
|
33
33
|
var obj = {};
|
|
34
34
|
unsafeSet(obj, ["__proto__", "fake"], true);
|
|
35
|
-
expect(obj.fake).to.be
|
|
35
|
+
expect(obj.fake).to.be.true;
|
|
36
36
|
});
|
|
37
37
|
it("safe way with unsafe set", function () {
|
|
38
38
|
var obj = Object.create(null);
|
|
39
39
|
unsafeSet(obj, ["__proto__", "fake"], true);
|
|
40
40
|
expect(obj.fake).to.be.undefined;
|
|
41
|
-
expect(obj.__proto__.fake).to.be
|
|
41
|
+
expect(obj.__proto__.fake).to.be.true;
|
|
42
42
|
var obj2 = Object.create(null);
|
|
43
|
-
expect({}.fake).to.be
|
|
44
|
-
|
|
43
|
+
expect({}.fake).to.be.true; // bad case
|
|
45
44
|
expect(obj2.fake).to.be.undefined;
|
|
46
45
|
});
|
|
47
46
|
});
|
package/build/es/src/index.mjs
CHANGED
|
@@ -1,24 +1,37 @@
|
|
|
1
|
+
// @ts-check
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* @param {string[]} arrPath
|
|
5
|
+
* @returns {boolean}
|
|
6
|
+
*/
|
|
1
7
|
var isPrototypePolluted = function isPrototypePolluted(arrPath) {
|
|
2
|
-
var joinPath = "|"
|
|
8
|
+
var joinPath = "|" + arrPath.join("|") + "|";
|
|
3
9
|
return ["__proto__", "constructor", "prototype"].some(function (key) {
|
|
4
|
-
return -1 !== joinPath.indexOf("|"
|
|
10
|
+
return -1 !== joinPath.indexOf("|" + key + "|");
|
|
5
11
|
});
|
|
6
12
|
};
|
|
7
13
|
|
|
14
|
+
/**
|
|
15
|
+
* @param {any} obj
|
|
16
|
+
* @param {string[]} arrPath
|
|
17
|
+
* @param {any} val
|
|
18
|
+
* @param {boolean} [isAppend]
|
|
19
|
+
* @param {boolean} [unSafe]
|
|
20
|
+
*/
|
|
8
21
|
var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
9
22
|
if (!unSafe && isPrototypePolluted(arrPath)) {
|
|
10
23
|
throw "Contain un-safe key.";
|
|
11
24
|
}
|
|
12
|
-
|
|
13
|
-
|
|
25
|
+
/**
|
|
26
|
+
* @type string
|
|
27
|
+
*/
|
|
28
|
+
var last = /** @type string */arrPath.pop();
|
|
14
29
|
var linkObj = obj;
|
|
15
30
|
arrPath.forEach(function (k) {
|
|
16
31
|
var _linkObj$k;
|
|
17
|
-
|
|
18
32
|
linkObj[k] = (_linkObj$k = linkObj[k]) !== null && _linkObj$k !== void 0 ? _linkObj$k : Object.create(null);
|
|
19
33
|
linkObj = linkObj[k];
|
|
20
34
|
});
|
|
21
|
-
|
|
22
35
|
if (isAppend && (!linkObj[last] || !linkObj[last].push)) {
|
|
23
36
|
if (!linkObj[last]) {
|
|
24
37
|
linkObj[last] = [val];
|
|
@@ -32,9 +45,14 @@ var replaceValue = function replaceValue(obj, arrPath, val, isAppend, unSafe) {
|
|
|
32
45
|
}
|
|
33
46
|
};
|
|
34
47
|
|
|
48
|
+
/**
|
|
49
|
+
* @param {any} obj
|
|
50
|
+
* @param {string[]} arrPath
|
|
51
|
+
* @param {any} val
|
|
52
|
+
* @param {boolean} [isAppend]
|
|
53
|
+
*/
|
|
35
54
|
var unsafeSet = function unsafeSet(obj, arrPath, val, isAppend) {
|
|
36
55
|
return replaceValue(obj, arrPath, val, isAppend, true);
|
|
37
56
|
};
|
|
38
|
-
|
|
39
57
|
export default replaceValue;
|
|
40
58
|
export { unsafeSet };
|
package/package.json
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
|
-
"version": "0.
|
|
2
|
+
"version": "0.2.0",
|
|
3
3
|
"name": "set-object-value",
|
|
4
4
|
"repository": {
|
|
5
5
|
"type": "git",
|
|
@@ -24,16 +24,20 @@
|
|
|
24
24
|
"mocha": "*"
|
|
25
25
|
},
|
|
26
26
|
"scripts": {
|
|
27
|
-
"clean": "find ./build -name '*.*' | xargs rm -rf",
|
|
27
|
+
"clean": "find ./build ./types -name '*.*' | xargs rm -rf",
|
|
28
28
|
"build:cjs": "BABEL_ENV=cjs babel src -d build/cjs/src --ignore /**/__tests__ --root-mode upward",
|
|
29
29
|
"build:es": "BABEL_ENV=es babel src -d build/es/src --out-file-extension .mjs --root-mode upward",
|
|
30
|
-
"build": "
|
|
30
|
+
"build:type": "npx -p typescript tsc src/*.js --declaration --allowJs --emitDeclarationOnly --skipLibCheck --declarationDir types",
|
|
31
|
+
"build": "npm run clean && npm run build:cjs && npm run build:es && npm run build:type",
|
|
31
32
|
"mochaFor": "mocha",
|
|
32
33
|
"mocha": "npm run mochaFor -- 'build/es/**/__tests__/*.mjs'",
|
|
34
|
+
"test:report": "npm run build && npm run mochaFor -- --reporter mocha-junit-reporter --reporter-options mochaFile=./test_output/mocha.xml 'build/es/**/__tests__/*.mjs'",
|
|
33
35
|
"test": "npm run build && npm run mocha",
|
|
34
36
|
"prepublishOnly": "npm run test"
|
|
35
37
|
},
|
|
38
|
+
"types": "./types/index.d.ts",
|
|
36
39
|
"files": [
|
|
40
|
+
"types",
|
|
37
41
|
"build",
|
|
38
42
|
"package.json",
|
|
39
43
|
"README.md"
|
package/types/index.d.ts
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
export default replaceValue;
|
|
2
|
+
/**
|
|
3
|
+
* @param {any} obj
|
|
4
|
+
* @param {string[]} arrPath
|
|
5
|
+
* @param {any} val
|
|
6
|
+
* @param {boolean} [isAppend]
|
|
7
|
+
* @param {boolean} [unSafe]
|
|
8
|
+
*/
|
|
9
|
+
declare function replaceValue(obj: any, arrPath: string[], val: any, isAppend?: boolean, unSafe?: boolean): void;
|
|
10
|
+
/**
|
|
11
|
+
* @param {any} obj
|
|
12
|
+
* @param {string[]} arrPath
|
|
13
|
+
* @param {any} val
|
|
14
|
+
* @param {boolean} [isAppend]
|
|
15
|
+
*/
|
|
16
|
+
export function unsafeSet(obj: any, arrPath: string[], val: any, isAppend?: boolean): void;
|