From d6fc3793606166d03ea50a2712a554a3a8c1524d Mon Sep 17 00:00:00 2001 From: Edoardo Pirovano Date: Wed, 21 Jul 2021 14:20:10 +0100 Subject: [PATCH] Update outdated Node package. --- node_modules/glob-parent/CHANGELOG.md | 7 +++++++ node_modules/glob-parent/index.js | 26 ++++++++++++++++++++++++-- node_modules/glob-parent/package.json | 2 +- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/node_modules/glob-parent/CHANGELOG.md b/node_modules/glob-parent/CHANGELOG.md index 4f1cacbb1..9014c0ed4 100644 --- a/node_modules/glob-parent/CHANGELOG.md +++ b/node_modules/glob-parent/CHANGELOG.md @@ -4,6 +4,13 @@ - eliminate ReDoS ([#36](https://github.com/gulpjs/glob-parent/issues/36)) ([f923116](https://github.com/gulpjs/glob-parent/commit/f9231168b0041fea3f8f954b3cceb56269fc6366)) +### [6.0.1](https://www.github.com/gulpjs/glob-parent/compare/v6.0.0...v6.0.1) (2021-07-20) + + +### Bug Fixes + +* Resolve ReDoS vulnerability from CVE-2021-35065 ([#49](https://www.github.com/gulpjs/glob-parent/issues/49)) ([3e9f04a](https://www.github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339)) + ## [6.0.0](https://www.github.com/gulpjs/glob-parent/compare/v5.1.2...v6.0.0) (2021-05-03) ### ⚠ BREAKING CHANGES diff --git a/node_modules/glob-parent/index.js b/node_modules/glob-parent/index.js index f861468f1..292d24f88 100644 --- a/node_modules/glob-parent/index.js +++ b/node_modules/glob-parent/index.js @@ -6,7 +6,6 @@ var isWin32 = require('os').platform() === 'win32'; var slash = '/'; var backslash = /\\/g; -var enclosure = /[{[].*\/.*[}\]]$/; var globby = /(^|[^\\])([{[]|\([^)]+$)/; var escaped = /\\([!*?|[\](){}])/g; @@ -24,7 +23,7 @@ module.exports = function globParent(str, opts) { } // special case for strings ending in enclosure containing path separator - if (enclosure.test(str)) { + if (isEnclosure(str)) { str += slash; } @@ -39,3 +38,26 @@ module.exports = function globParent(str, opts) { // remove escape chars and return result return str.replace(escaped, '$1'); }; + +function isEnclosure(str) { + var lastChar = str.slice(-1); + + var enclosureStart; + switch (lastChar) { + case '}': + enclosureStart = '{'; + break; + case ']': + enclosureStart = '['; + break; + default: + return false; + } + + var foundIndex = str.indexOf(enclosureStart); + if (foundIndex < 0) { + return false; + } + + return str.slice(foundIndex + 1, -1).includes(slash); +} diff --git a/node_modules/glob-parent/package.json b/node_modules/glob-parent/package.json index a86748c67..c191a73bc 100644 --- a/node_modules/glob-parent/package.json +++ b/node_modules/glob-parent/package.json @@ -1,6 +1,6 @@ { "name": "glob-parent", - "version": "6.0.0", + "version": "6.0.1", "description": "Extract the non-magic parent path from a glob string.", "author": "Gulp Team (https://gulpjs.com/)", "contributors": [