Package: node-loader-utils / 2.0.0-1+deb11u1

CVE-2022-37601.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Description: fix prototype pollution
Author: Mike Cebrian <michael.cebrian@gmail.com>
Origin: upstream, https://github.com/webpack/loader-utils/commit/a93cf6f4
Forwarded: not-needed
Reviewed-By: Yadd <yadd@debian.org>
Last-Update: 2022-11-10

--- node-loader-utils-2.0.0.orig/lib/parseQuery.js
+++ node-loader-utils-2.0.0/lib/parseQuery.js
@@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');