@auth0/angular-jwt - npm Package Compare versions

Comparing version 1.0.0 to 1.1.0

package.json

 {
   "name": "@auth0/angular-jwt",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "JSON Web Token helper library for Angular",
@@ -13,8 +13,3 @@ "scripts": {
   },
-  "keywords": [
-    "angular",
-    "angular 2",
-    "authentication",
-    "jwt"
-  ],
+  "keywords": ["angular", "angular 2", "authentication", "jwt"],
   "author": "Ryan Chenkie",
@@ -63,3 +58,6 @@ "license": "MIT",
     "zone.js": "^0.8.11"
+  },
+  "dependencies": {
+    "url": "^0.11.0"
   }
 }

src/jwt.interceptor.js

@@ -7,2 +7,3 @@ import { Injectable, Inject } from '@angular/core';
 import 'rxjs/add/operator/mergeMap';
+var URL = require('url');
 var JwtInterceptor = (function () {
@@ -23,3 +24,3 @@ function JwtInterceptor(config, jwtHelper) {
     JwtInterceptor.prototype.isWhitelistedDomain = function (request) {
-        var requestUrl = new URL(request.url);
+        var requestUrl = URL.parse(request.url, false, true);
         return (this.whitelistedDomains.findIndex(function (domain) {
@@ -26,0 +27,0 @@ return typeof domain === 'string'

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 2 instances in 1 package

Improved metrics

Total package byte prevSize

203175

increased by146.24%

Lines of code

2172

increased by163.91%

Worsened metrics

Dependency count

2

increased by100%

Number of medium supply chain risk alerts

2

increased byInfinity%

Dependency changes

• + Addedurl@^0.11.0

• + Addedcall-bind-apply-helpers@1.0.2(transitive)

• + Addedcall-bound@1.0.3(transitive)

• + Addeddunder-proto@1.0.1(transitive)

• + Addedes-define-property@1.0.1(transitive)

• + Addedes-errors@1.3.0(transitive)

• + Addedes-object-atoms@1.1.1(transitive)

• + Addedfunction-bind@1.1.2(transitive)

• + Addedget-intrinsic@1.3.0(transitive)

• + Addedget-proto@1.0.1(transitive)

• + Addedgopd@1.2.0(transitive)

• + Addedhas-symbols@1.1.0(transitive)

• + Addedhasown@2.0.2(transitive)

• + Addedmath-intrinsics@1.1.0(transitive)

• + Addedobject-inspect@1.13.4(transitive)

• + Addedpunycode@1.4.1(transitive)

• + Addedqs@6.14.0(transitive)

• + Addedside-channel@1.1.0(transitive)

• + Addedside-channel-list@1.0.0(transitive)

• + Addedside-channel-map@1.0.1(transitive)

• + Addedside-channel-weakmap@1.0.2(transitive)

• + Addedurl@0.11.4(transitive)