Skip to content

Commit

Permalink
🔒 Upgrade fast-xml-parser to 4.2.5 to fix regex vulnerability securit…
Browse files Browse the repository at this point in the history
…y issue.
  • Loading branch information
bojieyang committed Jun 25, 2023
1 parent 06f7d27 commit 054229e
Show file tree
Hide file tree
Showing 5 changed files with 18 additions and 14 deletions.
6 changes: 6 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

## [Unreleased]

## [1.1.2] - 2023-06-25

### Security

- Upgrade fast-xml-parser to 4.2.5 to fix regex vulnerability security issue.

## [1.1.1] - 2023-06-07

### Security
Expand Down
18 changes: 8 additions & 10 deletions dist/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -2733,7 +2733,9 @@ module.exports = toXml;
/***/ }),

/***/ 6072:
/***/ ((module) => {
/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

const util = __nccwpck_require__(8280);

//TODO: handle comments
function readDocType(xmlData, i){
Expand Down Expand Up @@ -2877,20 +2879,16 @@ function isNotation(xmlData, i){
return false
}

//an entity name should not contains special characters that may be used in regex
//Eg !?\\\/[]$%{}^&*()<>
const specialChar = "!?\\\/[]$%{}^&*()<>|+";

function validateEntityName(name){
for (let i = 0; i < specialChar.length; i++) {
const ch = specialChar[i];
if(name.indexOf(ch) !== -1) throw new Error(`Invalid character ${ch} in entity name`);
}
return name;
if (util.isName(name))
return name;
else
throw new Error(`Invalid entity name ${name}`);
}

module.exports = readDocType;


/***/ }),

/***/ 6993:
Expand Down
2 changes: 1 addition & 1 deletion dist/index.js.map

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "indexnow-action",
"version": "1.1.1",
"version": "1.1.2",
"description": "Automatically submit URLs through the IndexNow protocol.",
"main": "index.js",
"engines": {
Expand Down

0 comments on commit 054229e

Please sign in to comment.