File: CVE-2022-37601.patch

package info (click to toggle)
node-loader-utils 2.0.0-1%2Bdeb11u1
  • links: PTS, VCS
  • area: main
  • in suites: bullseye
  • size: 452 kB
  • sloc: javascript: 1,484; makefile: 2
file content (18 lines) | stat: -rw-r--r-- 567 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Description: fix prototype pollution
Author: Mike Cebrian <michael.cebrian@gmail.com>
Origin: upstream, https://github.com/webpack/loader-utils/commit/a93cf6f4
Forwarded: not-needed
Reviewed-By: Yadd <yadd@debian.org>
Last-Update: 2022-11-10

--- node-loader-utils-2.0.0.orig/lib/parseQuery.js
+++ node-loader-utils-2.0.0/lib/parseQuery.js
@@ -26,7 +26,7 @@ function parseQuery(query) {
   }
 
   const queryArgs = query.split(/[,&]/g);
-  const result = {};
+  const result = Object.create(null);
 
   queryArgs.forEach((arg) => {
     const idx = arg.indexOf('=');