Don't allow nested module hash

npm · Nov 15, 2010 · 3994064 · 3994064
1 parent 3411a8c
commit 3994064
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/lib/utils/read-json.js b/lib/utils/read-json.js
@@ -96,6 +96,21 @@ function processObject (opts, cb) { return function (er, json) {
   //   json.modules.index = json.main
   //   delete json.main
   // }
+  if (json.modules) {
+    if (typeof json.modules !== "object") {
+      var e = new Error("Invalid modules object")
+      if (cb) return cb(e)
+      throw e
+    }
+    Object.keys(json.modules).forEach(function (mod) {
+      if (typeof json.modules[mod] !== "string") {
+        var e = new Error("Invalid module "+mod+", not a string: "
+                         +JSON.stringify(json.modules[mod]))
+        if (cb) return cb(e)
+        throw e
+      }
+    })
+  }
 
   if (opts.wscript) {
     var scripts = json.scripts = json.scripts || {}