ueberdb2 2.0.4 → 2.1.1

package/.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    versioning-strategy: "increase"

package/.github/workflows/npmpublish.yml

@@ -52,8 +52,8 @@ jobs:
           - 6379:6379
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
         with:
           node-version: 12
       - run: npm ci
@@ -78,16 +78,34 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      -
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      -
+        uses: actions/setup-node@v3
         with:
           node-version: 12
           registry-url: https://registry.npmjs.org/
-      - run: git config user.name 'github-actions[bot]'
-      - run: git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-      - run: npm ci
-      - run: npm version patch
-      - run: git push --follow-tags
+          cache: 'npm'
+      # This is required if the package has a prepare script that uses something
+      # in dependencies or devDependencies. This is also needed for bumping the
+      # version.
+      -
+        run: npm ci
+      -
+        name: Bump version (patch)
+        run: |
+          LATEST_TAG=$(git describe --tags --abbrev=0) || exit 1
+          NEW_COMMITS=$(git rev-list --count "${LATEST_TAG}"..) || exit 1
+          [ "${NEW_COMMITS}" -gt 0 ] || exit 0
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          npm version patch
+          # Update the branch before pushing the tag in case the branch can't be
+          # fast-forwarded.
+          git push
+          git push --follow-tags
       # `npm publish` must come after `git push` otherwise there is a race
       # condition: If two PRs are merged back-to-back then master/main will be
       # updated with the commits from the second PR before the first PR's
@@ -98,6 +116,12 @@ jobs:
       # already-used version number. By running `npm publish` after `git push`,
       # back-to-back merges will cause the first merge's workflow to fail but
       # the second's will succeed.
-      - run: npm publish
+      -
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      -
+        name: Add package to etherpad organization
+        run: npm access grant read-write etherpad:developers
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Notable Changes
 
+## v2.1.1
+
+Security fix:
+
+  * Fix `setSub()` prototype pollution vulnerability.
+
+## v2.1.0
+
+  * `memory`: New `data` setting that allows users to supply the backing Map
+    object (rather than create a new Map).
+
+Updated database dependencies:
+
+  * `dirty_git`: Updated `simple-git` to 3.6.0.
+  * `mssql`: Updated `mssql` to 8.1.0.
+
 ## v2.0.0
 
 * When saving an object that has a `.toJSON()` method, the value returned from

package/databases/memory_db.js

@@ -28,7 +28,7 @@ exports.Database = class extends AbstractDatabase {
   }
 
   init() {
-    this._data = new Map();
+    this._data = this.settings.data || new Map();
   }
 
   remove(key) {

package/lib/CacheAndBufferLayer.js

@@ -419,6 +419,9 @@ exports.Database = class {
         // Emulate a pointer to the property that should be set to `value`.
         const ptr = {obj: base, prop: 'fullValue'};
         for (let i = 0; i < sub.length; i++) {
+          if (sub[i] === '__proto__') {
+            throw new Error('Modifying object prototype is not supported for security reasons');
+          }
           let o = ptr.obj[ptr.prop];
           if (o == null) ptr.obj[ptr.prop] = o = {};
           // If o is a primitive (string, number, etc.), then setting `o.foo` has no effect because

package/package.json

@@ -26,13 +26,13 @@
     "dirty": "^1.1.3",
     "elasticsearch": "^16.7.2",
     "mongodb": "^3.7.3",
-    "mssql": "^7.3.0",
+    "mssql": "^8.1.0",
     "mysql": "2.18.1",
     "nano": "^9.0.5",
     "pg": "^8.7.1",
     "redis": "^3.1.2",
     "rethinkdb": "^2.4.2",
-    "simple-git": "^3.3.0"
+    "simple-git": "^3.6.0"
   },
   "optionalDependencies": {
     "sqlite3": "github:mapbox/node-sqlite3#593c9d498be2510d286349134537e3bf89401c4a"
@@ -40,7 +40,7 @@
   "devDependencies": {
     "cli-table": "^0.3.8",
     "eslint": "^7.32.0",
-    "eslint-config-etherpad": "^2.0.2",
+    "eslint-config-etherpad": "^2.0.3",
     "eslint-plugin-cypress": "^2.12.1",
     "eslint-plugin-eslint-comments": "^3.2.0",
     "eslint-plugin-mocha": "^9.0.0",
@@ -48,7 +48,7 @@
     "eslint-plugin-prefer-arrow": "^1.2.3",
     "eslint-plugin-promise": "^5.1.1",
     "eslint-plugin-you-dont-need-lodash-underscore": "^6.12.0",
-    "mocha": "^9.1.3",
+    "mocha": "^9.2.2",
     "randexp": "^0.5.3",
     "wtfnode": "^0.9.1"
   },
@@ -57,7 +57,7 @@
     "url": "https://github.com/ether/ueberDB.git"
   },
   "main": "./index",
-  "version": "2.0.4",
+  "version": "2.1.1",
   "bugs": {
     "url": "https://github.com/ether/ueberDB/issues"
   },

package/test/test_memory.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const assert = require('assert').strict;
+const memory = require('../databases/memory_db');
+
+describe(__filename, function () {
+  describe('data option', function () {
+    it('uses existing records from data option', async function () {
+      const db = new memory.Database({data: new Map([['foo', 'bar']])});
+      await db.init();
+      assert.equal(await db.get('foo'), 'bar');
+    });
+
+    it('updates existing map', async function () {
+      const data = new Map();
+      const db = new memory.Database({data});
+      await db.init();
+      await db.set('foo', 'bar');
+      assert.equal(data.get('foo'), 'bar');
+    });
+
+    it('does not clear map on close', async function () {
+      const data = new Map();
+      const db = new memory.Database({data});
+      await db.init();
+      await db.set('foo', 'bar');
+      await db.close();
+      assert.equal(data.get('foo'), 'bar');
+    });
+  });
+});

package/test/test_setSub.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const assert = require('assert').strict;
+const ueberdb = require('../index');
+const util = require('util');
+
+describe(__filename, function () {
+  it('setSub rejects __proto__', async function () {
+    const db = new ueberdb.Database('memory', {}, {});
+    await util.promisify(db.init).call(db);
+    await util.promisify(db.set).call(db, 'k', {});
+    await assert.rejects(util.promisify(db.setSub).call(db, 'k', ['__proto__'], 'v'));
+  });
+});