@nodecraft/ini - npm Package Compare versions

Comparing version 2.1.0 to 2.1.1

ini.js

 'use strict';
+/* eslint-disable no-use-before-define */
 exports.parse = exports.decode = decode;
@@ -23,3 +24,3 @@
 	}else{
-		opt = opt || {};
+		opt = opt || Object.create(null);
 		opt.whitespace = opt.whitespace === true;
@@ -79,3 +80,3 @@ }
 
-	const out = {};
+	const out = Object.create(null);
 	let ref = out;
@@ -93,6 +94,13 @@ let section = null;
 			section = unsafe(match[1]);
-			ref = out[section] = out[section] || {};
+			if(section === '__proto__'){
+				// not allowed
+				// keep parsing the section, but don't attach it.
+				ref = Object.create(null);
+				return;
+			}
+			ref = out[section] = out[section] || Object.create(null);
 			return;
 		}
 		let key = unsafe(match[2]);
+		if(key === '__proto__'){ return; }
 		let value = match[3] ? unsafe(match[3]) : defaultValue;
@@ -112,2 +120,3 @@ switch(value){
 			key = key.substring(0, key.length - 2);
+			if(key === '__proto__'){ return; }
 			if(!ref[key]){
@@ -144,4 +153,5 @@ ref[key] = [];
 		parts.forEach(function(part){
+			if(part === '__proto__'){ return; }
 			if(!p[part] || typeof p[part] !== 'object'){
-				p[part] = {};
+				p[part] = Object.create(null);
 			}
@@ -179,4 +189,4 @@ p = p[part];
 function unsafe(val){
-	const escapableChars = '\\;#',
-		commentChars = ';#';
+	const escapableChars = '\\;#';
+	const commentChars = ';#';
 
@@ -183,0 +193,0 @@ val = (val || '').trim();

package.json

 {
 	"name": "@nodecraft/ini",
-	"version": "2.1.0",
+	"version": "2.1.1",
 	"description": "An ini encoder/decoder for node",
@@ -24,6 +24,6 @@ "repository": {
 	"devDependencies": {
-		"eslint": "^6.5.1",
-		"eslint-config-nodecraft": "^1.7.3",
-		"eslint-plugin-json": "^1.4.0",
-		"eslint-plugin-node": "^10.0.0",
+		"eslint": "^7.15.0",
+		"eslint-config-nodecraft": "^6.2.0",
+		"eslint-plugin-json": "^2.1.2",
+		"eslint-plugin-node": "^11.1.0",
 		"tap": "^14"
@@ -30,0 +30,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

12153

increased by3.34%

Lines of code

206

increased by5.1%

No dependency changes