@hapi/content - npm Package Compare versions

Comparing version 5.0.1 to 5.0.2

lib/index.js

@@ -103,2 +103,4 @@ 'use strict';
 
+        let value;
+
         if ($2) {
@@ -110,3 +112,3 @@ if (!$3) {
             try {
-                result[$1] = decodeURIComponent($3.split('\'')[2]);
+                value = decodeURIComponent($3.split('\'')[2]);
             }
@@ -118,4 +120,12 @@ catch (err) {
         else {
-            result[$1] = $4 || $5 || '';
+            value = $4 || $5 || '';
         }
+
+        if ($1 === 'name' &&
+            value === '__proto__') {
+
+            throw Boom.badRequest('Invalid content-disposition header format includes invalid parameters');
+        }
+
+        result[$1] = value;
     });
@@ -122,0 +132,0 @@

package.json

 {
   "name": "@hapi/content",
   "description": "HTTP Content-* headers parsing",
-  "version": "5.0.1",
+  "version": "5.0.2",
   "repository": "git://github.com/hapijs/content",
@@ -6,0 +6,0 @@ "main": "lib/index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

7314

increased by3.17%

Lines of code

96

increased by6.67%

Number of medium maintenance alerts

0

decreased by-100%

No dependency changes