+5
-0
@@ -0,1 +1,6 @@ | ||
| 3.1.1 / 2026-04-25 | ||
| ================== | ||
| * update xmldom dep | ||
| 3.1.0 / 2023-07-06 | ||
@@ -2,0 +7,0 @@ ================== |
+56
-75
@@ -5,3 +5,3 @@ /** | ||
| const { DOMParser } = require('@xmldom/xmldom'); | ||
| const { DOMParser } = require("@xmldom/xmldom"); | ||
@@ -18,3 +18,2 @@ /** | ||
| /** | ||
@@ -29,6 +28,8 @@ * We ignore raw text (usually whitespace), <!-- xml comments -->, | ||
| function shouldIgnoreNode (node) { | ||
| return node.nodeType === TEXT_NODE | ||
| || node.nodeType === COMMENT_NODE | ||
| || node.nodeType === CDATA_NODE; | ||
| function shouldIgnoreNode(node) { | ||
| return ( | ||
| node.nodeType === TEXT_NODE || | ||
| node.nodeType === COMMENT_NODE || | ||
| node.nodeType === CDATA_NODE | ||
| ); | ||
| } | ||
@@ -46,4 +47,4 @@ | ||
| */ | ||
| function isEmptyNode(node){ | ||
| if(!node.childNodes || node.childNodes.length === 0) { | ||
| function isEmptyNode(node) { | ||
| if (!node.childNodes || node.childNodes.length === 0) { | ||
| return true; | ||
@@ -69,7 +70,7 @@ } else { | ||
| function parse (xml) { | ||
| var doc = new DOMParser().parseFromString(xml); | ||
| function parse(xml) { | ||
| var doc = new DOMParser().parseFromString(xml, "text/xml"); | ||
| invariant( | ||
| doc.documentElement.nodeName === 'plist', | ||
| 'malformed document. First element should be <plist>' | ||
| doc.documentElement.nodeName === "plist", | ||
| "malformed document. First element should be <plist>", | ||
| ); | ||
@@ -93,9 +94,8 @@ var plist = parsePlistXML(doc.documentElement); | ||
| function parsePlistXML (node) { | ||
| function parsePlistXML(node) { | ||
| var i, new_obj, key, val, new_arr, res, counter, type; | ||
| if (!node) | ||
| return null; | ||
| if (!node) return null; | ||
| if (node.nodeName === 'plist') { | ||
| if (node.nodeName === "plist") { | ||
| new_arr = []; | ||
@@ -105,9 +105,9 @@ if (isEmptyNode(node)) { | ||
| } | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| if (!shouldIgnoreNode(node.childNodes[i])) { | ||
| new_arr.push( parsePlistXML(node.childNodes[i])); | ||
| new_arr.push(parsePlistXML(node.childNodes[i])); | ||
| } | ||
| } | ||
| return new_arr; | ||
| } else if (node.nodeName === 'dict') { | ||
| } else if (node.nodeName === "dict") { | ||
| new_obj = {}; | ||
@@ -119,8 +119,8 @@ key = null; | ||
| } | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| if (shouldIgnoreNode(node.childNodes[i])) continue; | ||
| if (counter % 2 === 0) { | ||
| invariant( | ||
| node.childNodes[i].nodeName === 'key', | ||
| 'Missing key while parsing <dict/>.' | ||
| node.childNodes[i].nodeName === "key", | ||
| "Missing key while parsing <dict/>.", | ||
| ); | ||
@@ -130,6 +130,6 @@ key = parsePlistXML(node.childNodes[i]); | ||
| invariant( | ||
| node.childNodes[i].nodeName !== 'key', | ||
| 'Unexpected key "' | ||
| + parsePlistXML(node.childNodes[i]) | ||
| + '" while parsing <dict/>.' | ||
| node.childNodes[i].nodeName !== "key", | ||
| 'Unexpected key "' + | ||
| parsePlistXML(node.childNodes[i]) + | ||
| '" while parsing <dict/>.', | ||
| ); | ||
@@ -141,8 +141,7 @@ new_obj[key] = parsePlistXML(node.childNodes[i]); | ||
| if (counter % 2 === 1) { | ||
| new_obj[key] = ''; | ||
| new_obj[key] = ""; | ||
| } | ||
| return new_obj; | ||
| } else if (node.nodeName === 'array') { | ||
| } else if (node.nodeName === "array") { | ||
| new_arr = []; | ||
@@ -152,3 +151,3 @@ if (isEmptyNode(node)) { | ||
| } | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| if (!shouldIgnoreNode(node.childNodes[i])) { | ||
@@ -160,23 +159,21 @@ res = parsePlistXML(node.childNodes[i]); | ||
| return new_arr; | ||
| } else if (node.nodeName === '#text') { | ||
| } else if (node.nodeName === "#text") { | ||
| // TODO: what should we do with text types? (CDATA sections) | ||
| } else if (node.nodeName === 'key') { | ||
| } else if (node.nodeName === "key") { | ||
| if (isEmptyNode(node)) { | ||
| return ''; | ||
| return ""; | ||
| } | ||
| invariant( | ||
| node.childNodes[0].nodeValue !== '__proto__', | ||
| '__proto__ keys can lead to prototype pollution. More details on CVE-2022-22912' | ||
| node.childNodes[0].nodeValue !== "__proto__", | ||
| "__proto__ keys can lead to prototype pollution. More details on CVE-2022-22912", | ||
| ); | ||
| return node.childNodes[0].nodeValue; | ||
| } else if (node.nodeName === 'string') { | ||
| res = ''; | ||
| } else if (node.nodeName === "string") { | ||
| res = ""; | ||
| if (isEmptyNode(node)) { | ||
| return res; | ||
| } | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| var type = node.childNodes[i].nodeType; | ||
@@ -188,17 +185,9 @@ if (type === TEXT_NODE || type === CDATA_NODE) { | ||
| return res; | ||
| } else if (node.nodeName === 'integer') { | ||
| invariant( | ||
| !isEmptyNode(node), | ||
| 'Cannot parse "" as integer.' | ||
| ); | ||
| } else if (node.nodeName === "integer") { | ||
| invariant(!isEmptyNode(node), 'Cannot parse "" as integer.'); | ||
| return parseInt(node.childNodes[0].nodeValue, 10); | ||
| } else if (node.nodeName === 'real') { | ||
| invariant( | ||
| !isEmptyNode(node), | ||
| 'Cannot parse "" as real.' | ||
| ); | ||
| res = ''; | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| } else if (node.nodeName === "real") { | ||
| invariant(!isEmptyNode(node), 'Cannot parse "" as real.'); | ||
| res = ""; | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| if (node.childNodes[i].nodeType === TEXT_NODE) { | ||
@@ -209,33 +198,25 @@ res += node.childNodes[i].nodeValue; | ||
| return parseFloat(res); | ||
| } else if (node.nodeName === 'data') { | ||
| res = ''; | ||
| } else if (node.nodeName === "data") { | ||
| res = ""; | ||
| if (isEmptyNode(node)) { | ||
| return Buffer.from(res, 'base64'); | ||
| return Buffer.from(res, "base64"); | ||
| } | ||
| for (i=0; i < node.childNodes.length; i++) { | ||
| for (i = 0; i < node.childNodes.length; i++) { | ||
| if (node.childNodes[i].nodeType === TEXT_NODE) { | ||
| res += node.childNodes[i].nodeValue.replace(/\s+/g, ''); | ||
| res += node.childNodes[i].nodeValue.replace(/\s+/g, ""); | ||
| } | ||
| } | ||
| return Buffer.from(res, 'base64'); | ||
| } else if (node.nodeName === 'date') { | ||
| invariant( | ||
| !isEmptyNode(node), | ||
| 'Cannot parse "" as Date.' | ||
| ) | ||
| return Buffer.from(res, "base64"); | ||
| } else if (node.nodeName === "date") { | ||
| invariant(!isEmptyNode(node), 'Cannot parse "" as Date.'); | ||
| return new Date(node.childNodes[0].nodeValue); | ||
| } else if (node.nodeName === 'null') { | ||
| } else if (node.nodeName === "null") { | ||
| return null; | ||
| } else if (node.nodeName === 'true') { | ||
| } else if (node.nodeName === "true") { | ||
| return true; | ||
| } else if (node.nodeName === 'false') { | ||
| } else if (node.nodeName === "false") { | ||
| return false; | ||
| } else { | ||
| throw new Error('Invalid PLIST tag ' + node.nodeName); | ||
| throw new Error("Invalid PLIST tag " + node.nodeName); | ||
| } | ||
| } |
+3
-4
| { | ||
| "name": "plist", | ||
| "description": "Apple's property list parser/builder for Node.js and browsers", | ||
| "version": "3.1.0", | ||
| "version": "3.1.1", | ||
| "author": "Nathan Rajlich <nathan@tootallnate.net>", | ||
@@ -28,3 +28,3 @@ "contributors": [ | ||
| "dependencies": { | ||
| "@xmldom/xmldom": "^0.8.8", | ||
| "@xmldom/xmldom": "^0.9.10", | ||
| "base64-js": "^1.5.1", | ||
@@ -35,4 +35,3 @@ "xmlbuilder": "^15.1.1" | ||
| "browserify": "^17.0.0", | ||
| "mocha": "^9.2.2", | ||
| "multiline": "^2.0.0", | ||
| "mocha": "^10.2.0", | ||
| "zuul": "3.12.0" | ||
@@ -39,0 +38,0 @@ }, |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
1007097
46.55%3
-25%29464
43.97%+ Added
- Removed
Updated