Skip to content

Track upstream to solve CVE-2021-3803 #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joshuanapoli wants to merge 3 commits into
base: scoped-package-master
Choose a base branch
from
Open

Track upstream to solve CVE-2021-3803 #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad6b562
chore: update svgo to 1.1.1, fix svgo incompatibilities and release a…
rpl Dec 15, 2018
6421633
fix: update svgo to non-vulnerable version (older version relied on b…
brettz9 Jun 26, 2021
943fe0e
Merge branch 'scoped-package-master' into svgo
joshuanapoli Sep 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
# This is a forked version of the original [badge-up npm package](https://www.npmjs.com/package/badge-up)

The only changes applied to the original npm package are:

- updated npm dependencies (to fix some known vulnerabilities detected by npm audit)
- adapt sources to the changes introduced in the new `svgo` library

------

# badge-up

[![npm](https://img.shields.io/npm/v/badge-up.svg?maxAge=2592000)](https://www.npmjs.com/package/badge-up)
Expand Down
17 changes: 10 additions & 7 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@ Copyrights licensed under the New BSD License. See the accompanying LICENSE file

var fs = require('fs'),
path = require('path'),
SVGO = require('svgo'),
svgo = new SVGO(),
{optimize} = require('svgo'),
dot = require('dot'),
template = dot.template(fs.readFileSync(path.join(__dirname, 'templates', 'basic.svg'), 'utf-8')),
v2 = require('./v2'),
Expand All @@ -21,7 +20,7 @@ var fs = require('fs'),
* @param {String} color Color text to pick
* @param {Function} callback Function to call when done (error, SVG)
*/
module.exports = function badge (field1, field2, color, callback) {
module.exports = async function badge (field1, field2, color, callback) {
var data = {
text: [
utils.escapeXml(field1),
Expand All @@ -37,10 +36,14 @@ module.exports = function badge (field1, field2, color, callback) {
};

// Run the SVG through SVGO.
return svgo.optimize(template(data)).then(function (object) {
if (callback) callback(null, object.data);
return object.data;
});
const object = optimize(
template(data)
// Due to https://github.com/svg/svgo/issues/1498
.replace(/&#(x3c|60);/gi, '<')
.replace(/&#(x26|38);/gi, '&')
);
if (callback) callback(null, object.data);
return object.data;
};

/**
Expand Down
20 changes: 10 additions & 10 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"name": "badge-up",
"name": "@rpl/badge-up",
"version": "2.3.0",
"description": "A module that produces hot badges without the need of Cairo",
"description": "A module that produces hot badges without the need of Cairo (forked from the original badge-up package to update vulnerable npm deps)",
"main": "index.js",
"nyc": {
"reporter": [
Expand All @@ -16,7 +16,7 @@
},
"repository": {
"type": "git",
"url": "git@github.com:yahoo/badge-up.git"
"url": "git@github.com:rpl/badge-up.git"
},
"homepage": "https://github.com/yahoo/badge-up",
"engines": {
Expand All @@ -43,16 +43,16 @@
}
},
"devDependencies": {
"chai": "^4.2.0",
"coveralls": "^3.0.11",
"eslint": "^6.8.0",
"mocha": "^7.1.1",
"nyc": "^15.0.0",
"sinon": "^9.0.1"
"chai": "^4.3.4",
"coveralls": "^3.1.0",
"eslint": "^7.29.0",
"mocha": "^9.0.1",
"nyc": "^15.1.0",
"sinon": "^11.1.1"
},
"dependencies": {
"css-color-names": "~1.0.1",
"dot": "^1.1.3",
"svgo": "^1.3.2"
"svgo": "^2.3.1"
}
}
25 changes: 14 additions & 11 deletions v2.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,7 @@ var colors = require('css-color-names'),
fs = require('fs'),
path = require('path'),
utils = require('./utils'),
SVGO = require('svgo'),
svgo = new SVGO({
plugins: [{
sortDefsChildren: false
}]
}),
{optimize, extendDefaultPlugins} = require('svgo'),
TEMPLATE = dot.template(fs.readFileSync(path.join(__dirname, 'templates', 'v2.svg'), 'utf-8')),
COLOR_REGEX = /^[0-9a-f]{6}$/i,
STROKE_REGEX = /^s\{(.+?)\}$/i,
Expand Down Expand Up @@ -100,12 +95,20 @@ function sectionsToData(sections) {
}


module.exports = function badge_v2(sections, callback) {
var raw = TEMPLATE(sectionsToData(sections));
return svgo.optimize(raw).then(function(optimized) {
if (callback) callback(undefined, optimized.data);
return optimized.data;
module.exports = async function badge_v2(sections, callback) {
var raw = TEMPLATE(sectionsToData(sections))
// Due to https://github.com/svg/svgo/issues/1498
.replace(/&#(x3c|60);/gi, '<')
.replace(/&#(x26|38);/gi, '&');

const optimized = optimize(raw, {
plugins: extendDefaultPlugins([{
name: 'sortDefsChildren',
active: false
}])
});
if (callback) callback(undefined, optimized.data);
return optimized.data;
};


Expand Down