style-dictionary 5.4.3 → 5.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/examples/advanced/assets-base64-embed/package.json +1 -1
- package/examples/advanced/create-react-app/package.json +1 -1
- package/examples/advanced/create-react-native-app/package.json +1 -1
- package/examples/advanced/custom-parser/package.json +1 -1
- package/examples/advanced/custom-transforms/package.json +1 -1
- package/examples/advanced/font-face-rules/package.json +1 -1
- package/examples/advanced/format-helpers/package.json +1 -1
- package/examples/advanced/matching-build-files/package.json +1 -1
- package/examples/advanced/multi-brand-multi-platform/package.json +1 -1
- package/examples/advanced/node-modules-as-config-and-properties/package.json +1 -1
- package/examples/advanced/npm-module/package.json +1 -1
- package/examples/advanced/referencing_aliasing/package.json +1 -1
- package/examples/advanced/s3/package.json +1 -1
- package/examples/advanced/tailwind-preset/package.json +1 -1
- package/examples/advanced/tokens-deprecation/package.json +1 -1
- package/examples/advanced/transitive-transforms/package.json +1 -1
- package/examples/advanced/variables-in-outputs/package.json +1 -1
- package/examples/advanced/yaml-tokens/package.json +1 -1
- package/lib/StyleDictionary.js +1 -1
- package/lib/utils/convertTokenData.js +4 -0
- package/package.json +1 -1
package/lib/StyleDictionary.js
CHANGED
|
@@ -67,7 +67,7 @@ export default class StyleDictionary extends Register {
|
|
|
67
67
|
// Placeholder is transformed on prepublish -> see scripts/inject-version.js
|
|
68
68
|
// Another option might be import pkg from './package.json' with { "type": "json" } which would work in both browser and node, but support is not there yet.
|
|
69
69
|
// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/import#browser_compatibility
|
|
70
|
-
static VERSION = '5.4.
|
|
70
|
+
static VERSION = '5.4.4';
|
|
71
71
|
|
|
72
72
|
/** @returns {Config} */
|
|
73
73
|
get options() {
|
|
@@ -33,6 +33,10 @@ function convertToTokenObject(tokenArray) {
|
|
|
33
33
|
const obj = /** @type {Tokens} */ ({});
|
|
34
34
|
tokenArray.forEach((token) => {
|
|
35
35
|
const { key } = token;
|
|
36
|
+
// prototype pollution guard -> move to next token if key is malicious
|
|
37
|
+
if (key?.includes('__proto__')) {
|
|
38
|
+
return;
|
|
39
|
+
}
|
|
36
40
|
const keyArr = /** @type {string} */ (key).replace('{', '').replace('}', '').split('.');
|
|
37
41
|
let slice = obj;
|
|
38
42
|
keyArr.forEach((k, i, arr) => {
|