@hapi/content - npm Package Compare versions

Comparing version 4.1.0 to 4.1.1

lib/index.js

@@ -99,2 +99,8 @@ 'use strict';
 
+        if ($1 === '__proto__') {
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+        }
+
+        let value;
+
         if ($2) {
@@ -106,3 +112,3 @@ if (!$3) {
             try {
-                result[$1] = decodeURIComponent($3.split('\'')[2]);
+                value = decodeURIComponent($3.split('\'')[2]);
             }
@@ -114,4 +120,12 @@ catch (err) {
         else {
-            result[$1] = $4 || $5 || '';
+            value = $4 || $5 || '';
         }
+
+        if ($1 === 'name' &&
+            value === '__proto__') {
+
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+        }
+
+        result[$1] = value;
     });
@@ -118,0 +132,0 @@

package.json

 {
   "name": "@hapi/content",
   "description": "HTTP Content-* headers parsing",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "repository": "git://github.com/hapijs/content",
@@ -6,0 +6,0 @@ "main": "lib/index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

8159

increased by4.86%

Lines of code

96

increased by10.34%

No dependency changes