yargs-parser - npm Package Compare versions

Comparing version 5.0.0 to 5.0.1

CHANGELOG.md

@@ -21,2 +21,9 @@ # Change Log
 <a name="4.2.1"></a>
+### [5.0.1](https://www.github.com/yargs/yargs-parser/compare/v5.0.0...v5.0.1) (2021-03-10)
+
+
+### Bug Fixes
+
+* **security:** address GHSA-p9pc-299p-vxgp ([#362](https://www.github.com/yargs/yargs-parser/issues/362)) ([1c417bd](https://www.github.com/yargs/yargs-parser/commit/1c417bd0b42b09c475ee881e36d292af4fa2cc36))
+
 ## [4.2.1](https://github.com/yargs/yargs-parser/compare/v4.2.0...v4.2.1) (2017-01-02)
@@ -23,0 +30,0 @@

index.js

@@ -5,5 +5,6 @@ var camelCase = require('camelcase')
 var util = require('util')
+var assign = require('object.assign')
 
 function parse (args, opts) {
-  if (!opts) opts = {}
+  if (!opts) opts = Object.create(null)
   // allow a string argument to be passed in rather
@@ -13,3 +14,3 @@ // than an argv array.
   // aliases might have transitive relationships, normalize this.
-  var aliases = combineAliases(opts.alias || {})
+  var aliases = combineAliases(opts.alias || Object.create(null))
   var configuration = assign({
@@ -24,6 +25,6 @@ 'short-option-groups': true,
   }, opts.configuration)
-  var defaults = opts.default || {}
+  var defaults = opts.default || Object.create(null)
   var configObjects = opts.configObjects || []
   var envPrefix = opts.envPrefix
-  var newAliases = {}
+  var newAliases = Object.create(null)
   // allow a i18n handler to be passed in, default to a fake one (util.format).
@@ -35,13 +36,13 @@ var __ = opts.__ || function (str) {
   var flags = {
-    aliases: {},
-    arrays: {},
-    bools: {},
-    strings: {},
-    numbers: {},
-    counts: {},
-    normalize: {},
-    configs: {},
-    defaulted: {},
-    nargs: {},
-    coercions: {}
+    aliases: Object.create(null),
+    arrays: Object.create(null),
+    bools: Object.create(null),
+    strings: Object.create(null),
+    numbers: Object.create(null),
+    counts: Object.create(null),
+    normalize: Object.create(null),
+    configs: Object.create(null),
+    defaulted: Object.create(null),
+    nargs: Object.create(null),
+    coercions: Object.create(null)
   }
@@ -74,7 +75,7 @@ var negative = /^-[0-9]+(\.[0-9]+)?/
 
-  Object.keys(opts.narg || {}).forEach(function (k) {
+  Object.keys(opts.narg || Object.create(null)).forEach(function (k) {
     flags.nargs[k] = opts.narg[k]
   })
 
-  Object.keys(opts.coerce || {}).forEach(function (k) {
+  Object.keys(opts.coerce || Object.create(null)).forEach(function (k) {
     flags.coercions[k] = opts.coerce[k]
@@ -88,3 +89,3 @@ })
   } else {
-    Object.keys(opts.config || {}).forEach(function (k) {
+    Object.keys(opts.config || Object.create(null)).forEach(function (k) {
       flags.configs[k] = opts.config[k]
@@ -426,3 +427,3 @@ })
   function setConfig (argv) {
-    var configLookup = {}
+    var configLookup = Object.create(null)
 
@@ -547,3 +548,3 @@ // expand defaults/aliases, in-case any happen to reference
     keys.slice(0, -1).forEach(function (key) {
-      o = (o[key] || {})
+      o = (o[key] || Object.create(null))
     })
@@ -562,4 +563,6 @@
 
+    keys = keys.map(sanitizeKey)
+
     keys.slice(0, -1).forEach(function (key) {
-      if (o[key] === undefined) o[key] = {}
+      if (o[key] === undefined) o[key] = Object.create(null)
       o = o[key]
@@ -596,3 +599,3 @@ })
     Array.prototype.slice.call(arguments).forEach(function (obj) {
-      Object.keys(obj || {}).forEach(function (key) {
+      Object.keys(obj || Object.create(null)).forEach(function (key) {
         // short-circuit if we've already added a key
@@ -694,3 +697,3 @@ // to the aliases array, for example it might
   var change = true
-  var combined = {}
+  var combined = Object.create(null)
 
@@ -737,16 +740,2 @@ // turn alias lookup hash {key: ['alias1', 'alias2']} into
 
-function assign (defaults, configuration) {
-  var o = {}
-  configuration = configuration || {}
-
-  Object.keys(defaults).forEach(function (k) {
-    o[k] = defaults[k]
-  })
-  Object.keys(configuration).forEach(function (k) {
-    o[k] = configuration[k]
-  })
-
-  return o
-}
-
 // this function should only be called when a count is given as an arg
@@ -759,2 +748,7 @@ // it is NOT called to set a default value
 
+function sanitizeKey (key) {
+  if (key === '__proto__') return '___proto___'
+  return key
+}
+
 function Parser (args, opts) {
@@ -761,0 +755,0 @@ var result = parse(args.slice(), opts)

package.json

 {
   "name": "yargs-parser",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "the mighty option parser used by yargs",
@@ -37,3 +37,4 @@ "main": "index.js",
   "dependencies": {
-    "camelcase": "^3.0.0"
+    "camelcase": "^3.0.0",
+    "object.assign": "^4.1.0"
   },
@@ -40,0 +41,0 @@ "files": [

No alert changes

Improved metrics

Total package byte prevSize

38524

increased by1.68%

Worsened metrics

Dependency count

2

increased by100%

Lines of code

671

decreased by-0.74%

Dependency changes

• + Addedobject.assign@^4.1.0

• + Addedcall-bind@1.0.7(transitive)

• + Addeddefine-data-property@1.1.4(transitive)

• + Addeddefine-properties@1.2.1(transitive)

• + Addedes-define-property@1.0.0(transitive)

• + Addedes-errors@1.3.0(transitive)

• + Addedfunction-bind@1.1.2(transitive)

• + Addedget-intrinsic@1.2.4(transitive)

• + Addedgopd@1.0.1(transitive)

• + Addedhas-property-descriptors@1.0.2(transitive)

• + Addedhas-proto@1.0.3(transitive)

• + Addedhas-symbols@1.0.3(transitive)

• + Addedhasown@2.0.2(transitive)

• + Addedobject-keys@1.1.1(transitive)

• + Addedobject.assign@4.1.5(transitive)

• + Addedset-function-length@1.2.2(transitive)