Update align docs build remove security vulnerability in underscore

palaeoware · May 10, 2021 · a9d27b3 · a9d27b3
1 parent fc4d4b1
commit a9d27b3
Show file tree

Hide file tree

Showing 23 changed files with 40 additions and 25 deletions.
diff --git a/SPIERSalign/docs_build/.buildinfo b/SPIERSalign/docs_build/.buildinfo
@@ -1,4 +1,4 @@
 # Sphinx build info version 1
 # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done.
-config: 7ddc7654171152e1ccffbd9c5b6c5291
+config: d926fb26d0ac3f42a96d60104a7c7f8d
 tags: 645f666f9bcd5a90fca523b33c5a78b7
diff --git a/SPIERSalign/docs_build/.doctrees/environment.pickle b/SPIERSalign/docs_build/.doctrees/environment.pickle
diff --git a/SPIERSalign/docs_build/_static/underscore.js b/SPIERSalign/docs_build/_static/underscore.js
@@ -1550,6 +1550,13 @@
     return '\\' + escapes[match];
   };
 
+  // In order to prevent third-party code injection through
+  // `_.templateSettings.variable`, we test it against the following regular
+  // expression. It is intentionally a bit more liberal than just matching valid
+  // identifiers, but still prevents possible loopholes through defaults or
+  // destructuring assignment.
+  var bareIdentifier = /^\s*(\w|\$)+\s*$/;
+
   // JavaScript micro-templating, similar to John Resig's implementation.
   // Underscore templating handles arbitrary delimiters, preserves whitespace,
   // and correctly escapes quotes within interpolated code.
@@ -1585,16 +1592,25 @@
     });
     source += "';\n";
 
-    // If a variable is not specified, place data values in local scope.
-    if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
+    var argument = settings.variable;
+    if (argument) {
+      // Insure against third-party code injection.
+      if (!bareIdentifier.test(argument)) throw new Error(
+        'variable is not a bare identifier: ' + argument
+      );
+    } else {
+      // If a variable is not specified, place data values in local scope.
+      source = 'with(obj||{}){\n' + source + '}\n';
+      argument = 'obj';
+    }
 
     source = "var __t,__p='',__j=Array.prototype.join," +
       "print=function(){__p+=__j.call(arguments,'');};\n" +
       source + 'return __p;\n';
 
     var render;
     try {
-      render = new Function(settings.variable || 'obj', '_', source);
+      render = new Function(argument, '_', source);
     } catch (e) {
       e.source = source;
       throw e;
@@ -1605,7 +1621,6 @@
     };
 
     // Provide the compiled source as a convenience for precompilation.
-    var argument = settings.variable || 'obj';
     template.source = 'function(' + argument + '){\n' + source + '}';
 
     return template;

diff --git a/SPIERSalign/docs_build/advancednavigation.html b/SPIERSalign/docs_build/advancednavigation.html
@@ -221,7 +221,7 @@ <h2>14.4. Swapping Files<a class="headerlink" href="#swapping-files" title="Perm
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/advancedsettings.html b/SPIERSalign/docs_build/advancedsettings.html
@@ -209,7 +209,7 @@ <h2>15.2. Constant Autosave<a class="headerlink" href="#constant-autosave" title
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/automatedalignment.html b/SPIERSalign/docs_build/automatedalignment.html
@@ -221,7 +221,7 @@ <h2>13.2. True Automated Align (Auto Align)<a class="headerlink" href="#true-aut
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/basicaligningprocedure.html b/SPIERSalign/docs_build/basicaligningprocedure.html
@@ -207,7 +207,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/genindex.html b/SPIERSalign/docs_build/genindex.html
@@ -188,7 +188,7 @@ <h1 id="index">Index</h1>
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/index.html b/SPIERSalign/docs_build/index.html
@@ -264,7 +264,7 @@ <h1>Table of Contents<a class="headerlink" href="#table-of-contents" title="Perm
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/interface.html b/SPIERSalign/docs_build/interface.html
@@ -205,7 +205,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/introduction.html b/SPIERSalign/docs_build/introduction.html
@@ -202,7 +202,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/keyboardreference.html b/SPIERSalign/docs_build/keyboardreference.html
@@ -312,7 +312,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/navigatingdatasets.html b/SPIERSalign/docs_build/navigatingdatasets.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/panels.html b/SPIERSalign/docs_build/panels.html
@@ -226,7 +226,7 @@ <h2>12.4. Auto Align Panel<a class="headerlink" href="#auto-align-panel" title="
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/requirements.html b/SPIERSalign/docs_build/requirements.html
@@ -209,7 +209,7 @@ <h2>2.2. Data<a class="headerlink" href="#data" title="Permalink to this headlin
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/savingexitingrestarting.html b/SPIERSalign/docs_build/savingexitingrestarting.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/search.html b/SPIERSalign/docs_build/search.html
@@ -194,7 +194,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/shiftingrotatingscaling.html b/SPIERSalign/docs_build/shiftingrotatingscaling.html
@@ -221,7 +221,7 @@ <h2>11.4. Reset<a class="headerlink" href="#reset" title="Permalink to this head
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/startingspiersalign.html b/SPIERSalign/docs_build/startingspiersalign.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/updatesystem.html b/SPIERSalign/docs_build/updatesystem.html
@@ -205,7 +205,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/usingctdata.html b/SPIERSalign/docs_build/usingctdata.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/whatspiersalignproduces.html b/SPIERSalign/docs_build/whatspiersalignproduces.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>

diff --git a/SPIERSalign/docs_build/zooming.html b/SPIERSalign/docs_build/zooming.html
@@ -198,7 +198,7 @@
   <div role="contentinfo">
     <p>
 
-        &copy; Copyright 2018-2021, Russell Garwood, Mark Sutton, Alan R.T. Spencer
+        &copy; Copyright 2018-2021, Russell J. Garwood, Mark Sutton, Alan R.T. Spencer
 
     </p>
   </div>