vm2 - npm Package Compare versions

Comparing version 3.6.0 to 3.6.1

CHANGELOG.md

@@ -0,1 +1,5 @@
+v3.6.1 (2018-06-27)
+-------------------
+[fix] Security fixes
+
 v3.6.0 (2018-05-11)
@@ -2,0 +6,0 @@ -------------------

lib/main.js

@@ -95,10 +95,2 @@ const fs = require('fs');
 	/**
-	 * Makes the object read only.
-	 *
-	 * @static
-	 * @param {*} object Object to freeze.
-	 * @return {*} Frozen object.
-	 */
-
-	/**
 	 * Create VM instance.
@@ -105,0 +97,0 @@ *

lib/sandbox.js

@@ -350,5 +350,27 @@ const {Script} = host.require('vm');
 		features: Contextify.readonly(host.process.features),
-		nextTick(callback) { return host.process.nextTick(() => callback.call(null)); },
-		hrtime() { return host.process.hrtime(); },
-		cwd() { return host.process.cwd(); },
+		nextTick(callback) {
+				if (typeof callback !== 'function') {
+					throw new Error('Callback must be a function.');
+				};
+
+				try {
+					return host.process.nextTick(() => callback.call(null));
+				} catch (e) {
+					throw Contextify.value(e);
+				}
+		},
+		hrtime() {
+			try {
+				return host.process.hrtime();
+			} catch (e) {
+				throw Contextify.value(e);
+			}
+		},
+		cwd() {
+			try {
+				return host.process.cwd();
+			} catch (e) {
+				throw Contextify.value(e);
+			}
+		},
 		on(name, handler) {
@@ -359,3 +381,8 @@ if (name !== 'beforeExit' && name !== 'exit') {
 
-			host.process.on(name, Decontextify.value(handler));
+			try {
+				host.process.on(name, Decontextify.value(handler));
+			} catch (e) {
+				throw Contextify.value(e);
+			}
+
 			return this;
@@ -369,3 +396,8 @@ },
 
-			host.process.once(name, Decontextify.value(handler));
+			try {
+				host.process.once(name, Decontextify.value(handler));
+			} catch (e) {
+				throw Contextify.value(e);
+			}
+
 			return this;
@@ -379,3 +411,8 @@ },
 		removeListener(name, handler) {
-			host.process.removeListener(name, Decontextify.value(handler));
+			try {
+				host.process.removeListener(name, Decontextify.value(handler));
+			} catch (e) {
+				throw Contextify.value(e);
+			}
+			
 			return this;
@@ -389,3 +426,7 @@ },
 
-			return host.process.umask();
+			try {
+				return host.process.umask();
+			} catch (e) {
+				throw Contextify.value(e);
+			}
 		}
@@ -392,0 +433,0 @@ };

package.json

@@ -16,3 +16,3 @@ {
   ],
-  "version": "3.6.0",
+  "version": "3.6.1",
   "main": "index.js",
@@ -19,0 +19,0 @@ "repository": {

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

86469

increased by0.61%

Number of package files

15

increased by7.14%

Lines of code

2105

increased by1.49%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes