Skip to content

Commit

Permalink
Add upper bound for coffeescript (for now)
Browse files Browse the repository at this point in the history
  • Loading branch information
@Leonidas-from-XIV
Leonidas-from-XIV committed Apr 9, 2023
1 parent bd0f780 commit b856cb8
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 6 deletions.
9 changes: 4 additions & 5 deletions package-lock.json
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
"xmlbuilder": "~11.0.0"
},
"devDependencies": {
"coffee-script": ">=1.10.0",
"coffeescript": ">=1.10.0 <2",
"coveralls": "^3.0.1",
"diff": ">=1.0.8",
"docco": ">=0.6.2",
Expand Down

4 comments on commit b856cb8

@bonjonbovi87
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI this upper limit change has parseString returning [Object: null prototype] which breaks anyone using .hasOwnProperty() and other inherited object functions.

@mariosteinbacher
Copy link

@mariosteinbacher mariosteinbacher commented on b856cb8 Apr 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was looking into the tests.
A way to check hasOwnProperty is:

{}.hasOwnProperty.call(xmlObjectHere, 'propertyname')

so you can't inject protos as I have seen in the discussions

@Leonidas-from-XIV
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bonjonbovi87 No, this has nothing to do with it. The reason why it doesn't work is because #603 was merged to avoid a security issue.

@bonjonbovi87
Copy link

@bonjonbovi87 bonjonbovi87 commented on b856cb8 Apr 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops, I see, thanks. Missed it because the file date is 2 years ago due to the original commit.

Please sign in to comment.