Conversation
feat: merge spec of vchart
Feat/vchart editor merge spec
chore: update jest to 0.29
test: update test case of bar
…into feat/vchart_editor
[Auto Sync] Sync the code from branch main to branch develop after release 2.0.3
fix: fix error of `set`
feat: add umd package to build
feat: add CustomRequest options in Vmind
Feat/vchart editor:Add VChartSpec Atom and demo of vchart editor
Fix: fix some chart generation bugs
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| .map(item => { | ||
| // 使用正则表达式解析字符串 | ||
| const match = item.match(/\('(.+)', ([\d.]+)\)/); | ||
| const match = item.match(/\("(.+?)", ([\d.]+)\)/); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
| if (match) { | ||
| return [match[1], parseFloat(match[2])]; | ||
| } | ||
| const oldMatch = item.match(/\('(.+)', ([\d.]+)\)/); |
Check failure
Code scanning / CodeQL
Polynomial regular expression used on uncontrolled data High
| if (isValid(nested[key])) { | ||
| merge(nested, { [key]: newValue }); | ||
| } else { | ||
| nested[key] = newValue; |
Check warning
Code scanning / CodeQL
Prototype-polluting function Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the prototype pollution issue, we need to ensure that the baseSet function does not allow setting properties like __proto__ or constructor. This can be achieved by adding a check to block these properties before performing the assignment or merge.
- Modify the
baseSetfunction to include a check that skips any keys that are__proto__orconstructor. - This change should be made in the
baseSetfunction, specifically around the lines where the assignment or merge is performed.
| @@ -65,2 +65,5 @@ | ||
| const key = path[index]; | ||
| if (key === "__proto__" || key === "constructor") { | ||
| continue; | ||
| } | ||
| let newValue = value; |
3 participants
🆕 feat