Comparing version 3.0.0 to 3.1.0
@@ -7,2 +7,10 @@ --- | ||
### v3.1.0 2016-08-03 | ||
- utils.delay: use macro tasks instead of micro tasks (see [#288](https://github.com/Stuk/jszip/pull/288)). | ||
- Harden base64 decode (see [#316](https://github.com/Stuk/jszip/pull/316)). | ||
- Add JSZip.version and the version in the header (see [#317](https://github.com/Stuk/jszip/pull/317)). | ||
- Support Promise(Blob) (see [#318](https://github.com/Stuk/jszip/pull/318)). | ||
- Change JSZip.external.Promise implementation (see [#321](https://github.com/Stuk/jszip/pull/321)). | ||
- Update pako to v1.0.2 to fix a DEFLATE bug (see [#322](https://github.com/Stuk/jszip/pull/322)). | ||
### v3.0.0 2016-04-13 | ||
@@ -9,0 +17,0 @@ This release changes a lot of methods, please see [the upgrade guide](http://stuk.github.io/jszip/documentation/upgrade_guide.html). |
@@ -46,2 +46,14 @@ 'use strict'; | ||
var dataUrlPrefix = "data:"; | ||
if (input.substr(dataUrlPrefix.length) === dataUrlPrefix) { | ||
// This is a common error: people give a data url | ||
// (data:image/png;base64,iVBOR...) with a {base64: true} and | ||
// wonders why things don't work. | ||
// We can detect that the string input looks like a data url but we | ||
// *can't* be sure it is one: removing everything up to the comma would | ||
// be too dangerous. | ||
throw new Error("Invalid base64 input, it looks like a data url."); | ||
} | ||
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); | ||
@@ -56,7 +68,16 @@ | ||
} | ||
if (totalLength % 1 !== 0) { | ||
// totalLength is not an integer, the length does not match a valid | ||
// base64 content. That can happen if: | ||
// - the input is not a base64 content | ||
// - the input is *almost* a base64 content, with a extra chars at the | ||
// beginning or at the end | ||
// - the input uses a base64 variant (base64url for example) | ||
throw new Error("Invalid base64 input, bad content length."); | ||
} | ||
var output; | ||
if (support.uint8array) { | ||
output = new Uint8Array(totalLength); | ||
output = new Uint8Array(totalLength|0); | ||
} else { | ||
output = new Array(totalLength); | ||
output = new Array(totalLength|0); | ||
} | ||
@@ -63,0 +84,0 @@ |
'use strict'; | ||
var ES6Promise = require("es6-promise").Promise; | ||
// load the global object first: | ||
// - it should be better integrated in the system (unhandledRejection in node) | ||
// - the environment may have a custom Promise implementation (see zone.js) | ||
var ES6Promise = global.Promise || require("lie"); | ||
@@ -5,0 +8,0 @@ /** |
@@ -42,2 +42,3 @@ 'use strict'; | ||
JSZip.defaults = require('./defaults'); | ||
JSZip.version = require('../package.json').version; | ||
@@ -44,0 +45,0 @@ JSZip.loadAsync = function (content, options) { |
/*! | ||
JSZip - A Javascript class for generating and reading zip files | ||
JSZip v__VERSION__ - A Javascript class for generating and reading zip files | ||
<http://stuartk.com/jszip> | ||
(c) 2009-2014 Stuart Knightley <stuart [at] stuartk.com> | ||
(c) 2009-2016 Stuart Knightley <stuart [at] stuartk.com> | ||
Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/master/LICENSE.markdown. | ||
@@ -8,0 +8,0 @@ |
@@ -6,3 +6,3 @@ 'use strict'; | ||
var nodejsUtils = require('./nodejsUtils'); | ||
var asap = require('asap'); | ||
var setImmediate = require('core-js/library/fn/set-immediate'); | ||
var external = require("./external"); | ||
@@ -376,3 +376,3 @@ | ||
exports.delay = function(callback, args, self) { | ||
asap(function () { | ||
setImmediate(function () { | ||
callback.apply(self || null, args || []); | ||
@@ -423,19 +423,20 @@ }); | ||
var promise = null; | ||
if (support.blob && inputData instanceof Blob && typeof FileReader !== "undefined") { | ||
promise = new external.Promise(function (resolve, reject) { | ||
var reader = new FileReader(); | ||
// if inputData is already a promise, this flatten it. | ||
var promise = external.Promise.resolve(inputData).then(function(data) { | ||
if (support.blob && data instanceof Blob && typeof FileReader !== "undefined") { | ||
return new external.Promise(function (resolve, reject) { | ||
var reader = new FileReader(); | ||
reader.onload = function(e) { | ||
resolve(e.target.result); | ||
}; | ||
reader.onerror = function(e) { | ||
reject(e.target.error); | ||
}; | ||
reader.readAsArrayBuffer(inputData); | ||
}); | ||
} else { | ||
// if data is already a promise, this flatten it. | ||
promise = external.Promise.resolve(inputData); | ||
} | ||
reader.onload = function(e) { | ||
resolve(e.target.result); | ||
}; | ||
reader.onerror = function(e) { | ||
reject(e.target.error); | ||
}; | ||
reader.readAsArrayBuffer(data); | ||
}); | ||
} else { | ||
return data; | ||
} | ||
}); | ||
@@ -442,0 +443,0 @@ return promise.then(function(data) { |
{ | ||
"name": "jszip", | ||
"version": "3.0.0", | ||
"version": "3.1.0", | ||
"author": "Stuart Knightley <stuart@stuartk.com>", | ||
@@ -45,4 +45,6 @@ "description": "Create, read and edit .zip files with Javascript http://stuartk.com/jszip", | ||
"grunt-contrib-jshint": "~1.0.0", | ||
"grunt-contrib-qunit": "~1.2.0", | ||
"grunt-contrib-uglify": "~1.0.0", | ||
"jszip-utils": "~0.0.2", | ||
"package-json-versionify": "~1.0.2", | ||
"qunit-cli": "~0.2.0", | ||
@@ -53,8 +55,9 @@ "qunitjs": "~1.23.0", | ||
"dependencies": { | ||
"core-js": "~2.3.0", | ||
"es6-promise": "~3.0.2", | ||
"pako": "~1.0.0", | ||
"readable-stream": "~2.0.6", | ||
"asap": "~2.0.3" | ||
"lie": "~3.1.0", | ||
"pako": "~1.0.2", | ||
"readable-stream": "~2.0.6" | ||
}, | ||
"license": "(MIT OR GPL-3.0)" | ||
} |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is not supported yet
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 1 instance in 1 package
4
644151
5
15
14172
4
+ Addedcore-js@~2.3.0
+ Addedlie@~3.1.0
+ Addedcore-js@2.3.0(transitive)
+ Addedimmediate@3.0.6(transitive)
+ Addedlie@3.1.1(transitive)
- Removedasap@~2.0.3
- Removedasap@2.0.6(transitive)
Updatedpako@~1.0.2