From 06dc148515d7782181445208ea44263db0ab9c4a Mon Sep 17 00:00:00 2001 From: Rinjae Date: Fri, 14 Aug 2026 17:48:45 +0900 Subject: [PATCH] =?UTF-8?q?Lodash=20=EC=97=85=EB=8D=B0=EC=9D=B4=ED=8A=B8?= =?UTF-8?q?=20=EB=B0=8F=20=EB=B3=B4=EC=95=88=20=EA=B0=95=ED=99=94=20-=20Lo?= =?UTF-8?q?dash=20=EB=B2=84=EC=A0=84=204.17.21=20=E2=86=92=204.18.1?= =?UTF-8?q?=EB=A1=9C=20=EC=97=85=EB=8D=B0=EC=9D=B4=ED=8A=B8=20-=20prototyp?= =?UTF-8?q?e=20pollution=20=EB=B0=A9=EC=A7=80=20=EB=A1=9C=EC=A7=81=20?= =?UTF-8?q?=EC=B6=94=EA=B0=80=20-=20`=5F.template`=20=EA=B4=80=EB=A0=A8=20?= =?UTF-8?q?=EB=B3=B4=EC=95=88=20=EA=B2=BD=EA=B3=A0=20=EB=B0=8F=20=EB=AC=B8?= =?UTF-8?q?=EC=84=9C=20=EA=B0=B1=EC=8B=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/main/resources/static/js/lodash.js | 70 ++++++++++++++++++++++---- 1 file changed, 60 insertions(+), 10 deletions(-) diff --git a/src/main/resources/static/js/lodash.js b/src/main/resources/static/js/lodash.js index 4131e93..8634cab 100644 --- a/src/main/resources/static/js/lodash.js +++ b/src/main/resources/static/js/lodash.js @@ -12,7 +12,7 @@ var undefined; /** Used as the semantic version number. */ - var VERSION = '4.17.21'; + var VERSION = '4.18.1'; /** Used as the size to enable large array optimizations. */ var LARGE_ARRAY_SIZE = 200; @@ -20,7 +20,8 @@ /** Error message constants. */ var CORE_ERROR_TEXT = 'Unsupported core-js use. Try https://npms.io/search?q=ponyfill.', FUNC_ERROR_TEXT = 'Expected a function', - INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`'; + INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`', + INVALID_TEMPL_IMPORTS_ERROR_TEXT = 'Invalid `imports` option passed into `_.template`'; /** Used to stand-in for `undefined` hash values. */ var HASH_UNDEFINED = '__lodash_hash_undefined__'; @@ -1752,6 +1753,10 @@ * embedded Ruby (ERB) as well as ES2015 template strings. Change the * following template settings to use alternative delimiters. * + * **Security:** See + * [threat model](https://github.com/lodash/lodash/blob/main/threat-model.md) + * — `_.template` is insecure and will be removed in v5. + * * @static * @memberOf _ * @type {Object} @@ -2300,7 +2305,7 @@ * @name has * @memberOf SetCache * @param {*} value The value to search for. - * @returns {number} Returns `true` if `value` is found, else `false`. + * @returns {boolean} Returns `true` if `value` is found, else `false`. */ function setCacheHas(value) { return this.__data__.has(value); @@ -3766,7 +3771,7 @@ if (isArray(iteratee)) { return function(value) { return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee); - } + }; } return iteratee; }); @@ -4370,8 +4375,34 @@ */ function baseUnset(object, path) { path = castPath(path, object); - object = parent(object, path); - return object == null || delete object[toKey(last(path))]; + + // Prevent prototype pollution: + // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg + // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh + var index = -1, + length = path.length; + + if (!length) { + return true; + } + + while (++index < length) { + var key = toKey(path[index]); + + // Always block "__proto__" anywhere in the path if it's not expected + if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) { + return false; + } + + // Block constructor/prototype as non-terminal traversal keys to prevent + // escaping the object graph into built-in constructors and prototypes. + if ((key === 'constructor' || key === 'prototype') && index < length - 1) { + return false; + } + } + + var obj = parent(object, path); + return obj == null || delete obj[toKey(last(path))]; } /** @@ -6922,7 +6953,7 @@ /** * Creates an array with all falsey values removed. The values `false`, `null`, - * `0`, `""`, `undefined`, and `NaN` are falsey. + * `0`, `-0`, `0n`, `""`, `undefined`, and `NaN` are falsy. * * @static * @memberOf _ @@ -7461,7 +7492,7 @@ while (++index < length) { var pair = pairs[index]; - result[pair[0]] = pair[1]; + baseAssignValue(result, pair[0], pair[1]); } return result; } @@ -14121,6 +14152,8 @@ * **Note:** JavaScript follows the IEEE-754 standard for resolving * floating-point values which can produce unexpected results. * + * **Note:** If `lower` is greater than `upper`, the values are swapped. + * * @static * @memberOf _ * @since 0.7.0 @@ -14134,9 +14167,16 @@ * _.random(0, 5); * // => an integer between 0 and 5 * + * // when lower is greater than upper the values are swapped + * _.random(5, 0); + * // => an integer between 0 and 5 + * * _.random(5); * // => also an integer between 0 and 5 * + * _.random(-5); + * // => an integer between -5 and 0 + * * _.random(5, true); * // => a floating-point number between 0 and 5 * @@ -14738,6 +14778,10 @@ * properties may be accessed as free variables in the template. If a setting * object is given, it takes precedence over `_.templateSettings` values. * + * **Security:** `_.template` is insecure and should not be used. It will be + * removed in Lodash v5. Avoid untrusted input. See + * [threat model](https://github.com/lodash/lodash/blob/main/threat-model.md). + * * **Note:** In the development build `_.template` utilizes * [sourceURLs](http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl) * for easier debugging. @@ -14845,12 +14889,18 @@ options = undefined; } string = toString(string); - options = assignInWith({}, options, settings, customDefaultsAssignIn); + options = assignWith({}, options, settings, customDefaultsAssignIn); - var imports = assignInWith({}, options.imports, settings.imports, customDefaultsAssignIn), + var imports = assignWith({}, options.imports, settings.imports, customDefaultsAssignIn), importsKeys = keys(imports), importsValues = baseValues(imports, importsKeys); + arrayEach(importsKeys, function(key) { + if (reForbiddenIdentifierChars.test(key)) { + throw new Error(INVALID_TEMPL_IMPORTS_ERROR_TEXT); + } + }); + var isEscaping, isEvaluating, index = 0,