robojerk/codeql-action

Require xml2js >=0.5.0 to address CVE-2023-0842

Browse source
This commit is contained in:
Henry Mercer 2023-04-11 13:33:36 +01:00
parent 9c13316a15
commit c2b5d643fd
6 changed files with 45 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

16
node_modules/xml2js/lib/parser.js generated vendored
View file

@ -141,14 +141,14 @@
this.saxParser.onopentag = (function(_this) {
return function(node) {
var key, newValue, obj, processedKey, ref;
obj = {};
obj = Object.create(null);
obj[charkey] = "";
if (!_this.options.ignoreAttrs) {
ref = node.attributes;
for (key in ref) {
if (!hasProp.call(ref, key)) continue;
if (!(attrkey in obj) && !_this.options.mergeAttrs) {
obj[attrkey] = {};
obj[attrkey] = Object.create(null);
}
newValue = _this.options.attrValueProcessors ? processItem(_this.options.attrValueProcessors, node.attributes[key], key) : node.attributes[key];
processedKey = _this.options.attrNameProcessors ? processItem(_this.options.attrNameProcessors, key) : key;
@ -198,7 +198,11 @@
}
}
if (isEmpty(obj)) {
obj = _this.options.emptyTag !== '' ? _this.options.emptyTag : emptyStr;
if (typeof _this.options.emptyTag === 'function') {
obj = _this.options.emptyTag();
} else {
obj = _this.options.emptyTag !== '' ? _this.options.emptyTag : emptyStr;
}
}
if (_this.options.validator != null) {
xpath = "/" + ((function() {
@ -222,7 +226,7 @@
}
if (_this.options.explicitChildren && !_this.options.mergeAttrs && typeof obj === 'object') {
if (!_this.options.preserveChildrenOrder) {
node = {};
node = Object.create(null);
if (_this.options.attrkey in obj) {
node[_this.options.attrkey] = obj[_this.options.attrkey];
delete obj[_this.options.attrkey];
@ -237,7 +241,7 @@
obj = node;
} else if (s) {
s[_this.options.childkey] = s[_this.options.childkey] || [];
objClone = {};
objClone = Object.create(null);
for (key in obj) {
if (!hasProp.call(obj, key)) continue;
objClone[key] = obj[key];
@ -254,7 +258,7 @@
} else {
if (_this.options.explicitRoot) {
old = obj;
obj = {};
obj = Object.create(null);
obj[nodeName] = old;
}
_this.resultObject = obj;