fix #498: prototype pollution

* Use native promise instead of bluebird
* drop support on node<8.x
* reduce package size

Author: Keyang

browser/browser.js

@@ -244,7 +244,7 @@
       "hireable": null
     }
   ],
-  "version": "2.0.11",
+  "version": "2.0.12",
   "keywords": [
     "csv",
     "csv parser",
@@ -262,28 +262,27 @@
   },
   "license": "MIT",
   "engines": {
-    "node": ">=4.0.0"
+    "node": ">=8.0.0"
   },
   "devDependencies": {
-    "@types/bluebird": "^3.5.20",
-    "@types/mocha": "^5.2.0",
-    "@types/node": "^10.0.1",
+    "@types/lodash.set": "^4.3.6",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^24.9.1",
     "babel-plugin-syntax-dynamic-import": "^6.18.0",
     "coveralls": "^3.0.1",
     "minimist": "^1.2.0",
-    "mocha": "^5.1.1",
+    "mocha": "^11.7.4",
     "nyc": "^11.7.3",
     "sinon": "^3.2.3",
-    "ts-node": "^6.0.3",
-    "typescript": "^2.8.3",
+    "ts-jest": "^29.4.5",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.9.3",
     "uglifyjs-webpack-plugin": "^1.2.7",
     "webpack": "^4.16.4",
     "webpack-cli": "^3.1.0"
   },
   "dependencies": {
-    "bluebird": "^3.5.1",
-    "lodash": "^4.17.15",
-    "strip-bom": "^2.0.0"
+    "lodash.set": "^4.3.2"
   },
   "nyc": {
     "extension": [
@@ -311,5 +310,15 @@
     "coveralls": "cat ./coverage/lcov.info | ./node_modules/.bin/coveralls"
   },
   "browser": "./browser/browser.js",
-  "main": "./v2/index.js"
+  "main": "./v2/index.js",
+  "files": [
+    "v1",
+    "v2",
+    "browser",
+    "bin",
+    "index.d.ts",
+    "typings.d.ts",
+    "LICENSE",
+    "readme.md"
+  ]
 }

browser/csvtojson.min.js

@@ -1,6 +1,6 @@
-import CSVError from "./CSVError";
-import assert from "assert";
-describe("CSVError",()=>{
-  it ("should toString()",()=>{
-  })
-})
+// import CSVError from "./CSVError";
+// import assert from "assert";
+// describe("CSVError",()=>{
+//   it ("should toString()",()=>{
+//   })
+// })

package-lock.json

@@ -1,7 +1,6 @@
 import { Transform, TransformOptions, Readable } from "stream";
 import { CSVParseParam, mergeParams } from "./Parameters";
 import { ParseRuntime, initParseRuntime } from "./ParseRuntime";
-import P from "bluebird";
 import { Processor } from "./Processor";
 import { ProcessorLocal } from "./ProcessorLocal";
 import { Result } from "./Result";
@@ -59,7 +58,7 @@ export class Converter extends Transform implements PromiseLike<any[]> {
     return this.fromStream(read);
   }
   then<TResult1 = any[], TResult2 = never>(onfulfilled?: (value: any[]) => TResult1 | PromiseLike<TResult1>, onrejected?: (reason: any) => TResult2 | PromiseLike<TResult2>): PromiseLike<TResult1 | TResult2> {
-    return new P((resolve, reject) => {
+    return new Promise((resolve, reject) => {
       this.parseRuntime.then = {
         onfulfilled: (value: any[]) => {
           if (onfulfilled) {

package.json

@@ -125,12 +125,11 @@ export function mergeParams(params?: Partial<CSVParseParam>): CSVParseParam {
   for (let key in params) {
     if (params.hasOwnProperty(key)) {
       if (Array.isArray(params[key])) {
-        defaultParam[key] = [].concat(params[key]);
+        defaultParam[key] = [...params[key]];
       } else {
         defaultParam[key] = params[key];
       }
     }
   }
   return defaultParam;
 }
-

src/CSVError.test.ts

@@ -1,5 +1,4 @@
 import { Processor, ProcessLineResult } from "./Processor";
-import P from "bluebird"
 import { Converter } from "./Converter";
 import { ChildProcess } from "child_process";
 import { CSVParseParam, mergeParams } from "./Parameters";
@@ -9,21 +8,21 @@ import { bufFromString, emptyBuffer } from "./util";
 import CSVError from "./CSVError";
 
 export class ProcessorFork extends Processor {
-  flush(): P<ProcessLineResult[]> {
-    return new P((resolve, reject) => {
+  flush(): Promise<ProcessLineResult[]> {
+    return new Promise((resolve, reject) => {
       // console.log("flush");
       this.finalChunk = true;
       this.next = resolve;
-      this.childProcess.stdin.end();
+      this.childProcess.stdin?.end();
       // this.childProcess.stdout.on("end",()=>{
       //   // console.log("!!!!");
       //   this.flushResult();
       // })
     });
   }
-  destroy(): P<void> {
+  destroy(): Promise<void> {
     this.childProcess.kill();
-    return P.resolve();
+    return Promise.resolve();
   }
   childProcess: ChildProcess;
   inited: boolean = false;
@@ -79,14 +78,14 @@ export class ProcessorFork extends Processor {
       }
 
     });
-    this.childProcess.stdout.on("data", (data) => {
+    this.childProcess.stdout?.on("data", (data) => {
       // console.log("stdout", data.toString());
       const res = data.toString();
       // console.log(res);
       this.appendBuf(res);
 
     });
-    this.childProcess.stderr.on("data", (data) => {
+    this.childProcess.stderr?.on("data", (data) => {
       // console.log("stderr", data.toString());
       this.converter.emit("error", CSVError.fromJSON(JSON.parse(data.toString())));
     });
@@ -124,12 +123,12 @@ export class ProcessorFork extends Processor {
     // console.log("buf length",this.resultBuf.length);
   }
 
-  process(chunk: Buffer): P<ProcessLineResult[]> {
-    return new P((resolve, reject) => {
+  process(chunk: Buffer): Promise<ProcessLineResult[]> {
+    return new Promise((resolve, reject) => {
       // console.log("chunk", chunk.length);
       this.next = resolve;
       // this.appendReadBuf(chunk);
-      this.childProcess.stdin.write(chunk, () => {
+      this.childProcess.stdin?.write(chunk, () => {
         // console.log("chunk callback");
         this.flushResult();
       });
@@ -147,4 +146,4 @@ export interface InitMessage extends Message {
 export interface StringMessage extends Message {
   value: string
 }
-export const EOM = "\x03";
+export const EOM = "\x03";

src/Converter.ts

@@ -1,5 +1,4 @@
 import { Converter } from "./Converter";
-import P from "bluebird";
 import { JSONResult } from "./lineToJson";
 import { CSVParseParam } from "./Parameters";
 import { ParseRuntime } from "./ParseRuntime";
@@ -11,8 +10,8 @@ export abstract class Processor {
     this.params = converter.parseParam;
     this.runtime = converter.parseRuntime;
   }
-  abstract process(chunk: Buffer,finalChunk?:boolean): P<ProcessLineResult[]>
-  abstract destroy():P<void>;
-  abstract flush(): P<ProcessLineResult[]>;
+  abstract process(chunk: Buffer,finalChunk?:boolean): Promise<ProcessLineResult[]>
+  abstract destroy():Promise<void>;
+  abstract flush(): Promise<ProcessLineResult[]>;
 }
 export type ProcessLineResult = string | string[] | JSONResult;

src/Parameters.ts

@@ -1,9 +1,8 @@
 import {ProcessorLocal} from "./ProcessorLocal";
 import { Converter } from "./Converter";
-import P from "bluebird";
 import {readFileSync} from "fs";
-import path from "path";
-import assert from "assert";
+import * as path from "path";
+import assert = require("assert");
 import { JSONResult } from "./lineToJson";
 const dataDir=path.join(__dirname,"../test/data/");
 describe("ProcessLocal",()=>{
@@ -37,4 +36,3 @@ describe("ProcessLocal",()=>{
     })
   })
 })
-