csv-parser - npm Package Compare versions

Comparing version 3.2.0 to 3.2.1

index.js

@@ -21,2 +21,16 @@ const { Transform } = require('stream')
 
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
+
+function sanitizeHeader(header) {
+  if (typeof header !== 'string') {
+    return null
+  }
+
+  if (DANGEROUS_KEYS.has(header)) {
+    return null
+  }
+
+  return header
+}
+
 class CsvParser extends Transform {
@@ -159,4 +173,12 @@ constructor (opts = {}) {
       this.state.first = false
-      this.headers = cells.map((header, index) => mapHeaders({ header, index }))
+      this.headers = cells.map((header, index) => {
+        const mapped = mapHeaders({ header, index })
 
+        if (mapped === null) {
+          return null
+        }
+
+        return sanitizeHeader(mapped)
+      })
+
       this.emit('headers', this.headers)
@@ -163,0 +185,0 @@ return

package.json

 {
   "name": "csv-parser",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Streaming CSV parser that aims for maximum speed as well as compatibility with the csv-spectrum test suite",
@@ -5,0 +5,0 @@ "license": "MIT",

No alert changes

Improved metrics

Total package byte prevSize

29926

1.28%

Lines of code

387

4.31%

No dependency changes