Skip to content

v1.8.40

Choose a tag to compare

View all tags
@aykutkardas aykutkardas released this 03 Oct 20:57
· 30 commits to main since this release
v1.8.40
f80297c

Security fixes for the 1.x line. Published on npm with the legacy tag; latest is 2.x. Install it with npm install json-function@legacy.

Fixed

  • search passed the key to RegExp unescaped. A key such as "(" threw, and a pattern such as "(a+)+$" could hang the process (ReDoS). The key is now matched as plain text, as documented.
  • transform converted a key such as "____proto____" to "__proto__" and assigned it, so JSON input could replace the prototype of the returned object. The key is now kept as an own property.

Code that relied on search treating the key as a regular expression gets plain-text matching instead. This behavior was never documented.

Both issues are also fixed in 2.0.0.

Full changes: #36

Assets 2
Loading