Cameron Perera
bd857836ee
* fix: 🐛 add patch for lodash.template ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-14208 * chore: 🤖 add patch-package and postinstall-postinstall ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-14208 * fix: 🐛 add patch for lodash.template ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-14208 * chore: 🤖 add patch-package and postinstall-postinstall ✅ Closes: https://hashicorp.atlassian.net/browse/ICU-14208
46 lines
1.8 KiB
Diff
46 lines
1.8 KiB
Diff
diff --git a/node_modules/lodash.template/index.js b/node_modules/lodash.template/index.js
|
|
index f051141..0c45a8d 100644
|
|
--- a/node_modules/lodash.template/index.js
|
|
+++ b/node_modules/lodash.template/index.js
|
|
@@ -17,6 +17,9 @@ var HOT_COUNT = 800,
|
|
var INFINITY = 1 / 0,
|
|
MAX_SAFE_INTEGER = 9007199254740991;
|
|
|
|
+/** Error message constants. */
|
|
+var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
|
|
+
|
|
/** `Object#toString` result references. */
|
|
var argsTag = '[object Arguments]',
|
|
arrayTag = '[object Array]',
|
|
@@ -1343,6 +1346,18 @@ function keysIn(object) {
|
|
return isArrayLike(object) ? arrayLikeKeys(object, true) : baseKeysIn(object);
|
|
}
|
|
|
|
+/**
|
|
+ * Used to validate the `validate` option in `_.template` variable.
|
|
+ *
|
|
+ * Forbids characters which could potentially change the meaning of the function argument definition:
|
|
+ * - "()," (modification of function parameters)
|
|
+ * - "=" (default value)
|
|
+ * - "[]{}" (destructuring of function parameters)
|
|
+ * - "/" (beginning of a comment)
|
|
+ * - whitespace
|
|
+ */
|
|
+var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
|
|
+
|
|
/**
|
|
* Creates a compiled template function that can interpolate data properties
|
|
* in "interpolate" delimiters, HTML-escape interpolated data properties in
|
|
@@ -1522,6 +1537,11 @@ function template(string, options, guard) {
|
|
if (!variable) {
|
|
source = 'with (obj) {\n' + source + '\n}\n';
|
|
}
|
|
+ // Throw an error if a forbidden character was found in `variable`, to prevent
|
|
+ // potential command injection attacks.
|
|
+ else if (reForbiddenIdentifierChars.test(variable)) {
|
|
+ throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
|
|
+ }
|
|
// Cleanup code by stripping empty strings.
|
|
source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
|
|
.replace(reEmptyStringMiddle, '$1')
|