import nodejs-12.18.4-1.module+el8.3.0+8211+e8eb6580
This commit is contained in:
CentOS Sources
parent
c08522f4b4
commit
50d49cd886
|
|
@ -1,2 +1,2 @@
|
|||
SOURCES/icu4c-67_1-src.tgz
|
||||
SOURCES/node-v12.18.2-stripped.tar.gz
|
||||
SOURCES/node-v12.18.4-stripped.tar.gz
|
||||
|
|
|
|||
|
|
@ -1,2 +1,2 @@
|
|||
6822a4a94324d1ba591b3e8ef084e4491af253c1 SOURCES/icu4c-67_1-src.tgz
|
||||
b8955ce8e33b4c1cfdd4c5be22f70f3419ce63df SOURCES/node-v12.18.2-stripped.tar.gz
|
||||
31bb163dc0d11a30767ce9b71f1283d9b8d93903 SOURCES/node-v12.18.4-stripped.tar.gz
|
||||
|
|
|
|||
|
|
@ -1,25 +1,26 @@
|
|||
From 4509b10cbe5d22216a7880cc7fb6bd5f92b18018 Mon Sep 17 00:00:00 2001
|
||||
From 641730c7d1322dacd8e1020ec0753795d01200f0 Mon Sep 17 00:00:00 2001
|
||||
From: Zuzana Svetlikova <zsvetlik@redhat.com>
|
||||
Date: Thu, 27 Apr 2017 14:25:42 +0200
|
||||
Subject: [PATCH 1/5] Disable running gyp on shared deps
|
||||
Subject: [PATCH] Disable running gyp on shared deps
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
Makefile | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Makefile b/Makefile
|
||||
index 56f5358..f289f25 100644
|
||||
index 32a8a6c..f44f88a 100644
|
||||
--- a/Makefile
|
||||
+++ b/Makefile
|
||||
@@ -141,7 +141,7 @@ test-code-cache: with-code-cache
|
||||
echo "'test-code-cache' target is a noop"
|
||||
|
||||
|
||||
out/Makefile: config.gypi common.gypi node.gyp \
|
||||
- deps/uv/uv.gyp deps/http_parser/http_parser.gyp deps/zlib/zlib.gyp \
|
||||
+ deps/http_parser/http_parser.gyp \
|
||||
tools/v8_gypfiles/toolchain.gypi tools/v8_gypfiles/features.gypi \
|
||||
tools/v8_gypfiles/inspector.gypi tools/v8_gypfiles/v8.gyp
|
||||
$(PYTHON) tools/gyp_node.py -f make
|
||||
--
|
||||
2.24.1
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,106 @@
|
|||
From 9473adba9cba6767e8e506f8f19e0ff8f66920be Mon Sep 17 00:00:00 2001
|
||||
From: Marco Carini <cmdcarini@gmail.com>
|
||||
Date: Mon, 3 Aug 2020 17:16:07 -0500
|
||||
Subject: [PATCH] dot-prop: patch 4.2.0 with fixes for CVE-2020-8116
|
||||
|
||||
Adjusted from
|
||||
https://github.com/sindresorhus/dot-prop/commit/c914124f418f55edea27928e89c94d931babe587.patch
|
||||
|
||||
Signed-off-by: rpm-build <rpm-build>
|
||||
---
|
||||
deps/npm/node_modules/dot-prop/index.js | 18 ++++++++++++++++++
|
||||
deps/npm/node_modules/dot-prop/package.json | 6 +++---
|
||||
deps/npm/node_modules/dot-prop/readme.md | 2 ++
|
||||
3 files changed, 23 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/deps/npm/node_modules/dot-prop/index.js b/deps/npm/node_modules/dot-prop/index.js
|
||||
index 15282bb..189831c 100644
|
||||
--- a/deps/npm/node_modules/dot-prop/index.js
|
||||
+++ b/deps/npm/node_modules/dot-prop/index.js
|
||||
@@ -1,6 +1,14 @@
|
||||
'use strict';
|
||||
const isObj = require('is-obj');
|
||||
|
||||
+const disallowedKeys = [
|
||||
+ '__proto__',
|
||||
+ 'prototype',
|
||||
+ 'constructor'
|
||||
+];
|
||||
+
|
||||
+const isValidPath = pathSegments => !pathSegments.some(segment => disallowedKeys.includes(segment));
|
||||
+
|
||||
function getPathSegments(path) {
|
||||
const pathArr = path.split('.');
|
||||
const parts = [];
|
||||
@@ -16,6 +24,10 @@ function getPathSegments(path) {
|
||||
parts.push(p);
|
||||
}
|
||||
|
||||
+ if (!isValidPath(parts)) {
|
||||
+ return [];
|
||||
+ }
|
||||
+
|
||||
return parts;
|
||||
}
|
||||
|
||||
@@ -26,6 +38,9 @@ module.exports = {
|
||||
}
|
||||
|
||||
const pathArr = getPathSegments(path);
|
||||
+ if (pathArr.length === 0) {
|
||||
+ return;
|
||||
+ }
|
||||
|
||||
for (let i = 0; i < pathArr.length; i++) {
|
||||
if (!Object.prototype.propertyIsEnumerable.call(obj, pathArr[i])) {
|
||||
@@ -58,6 +73,9 @@ module.exports = {
|
||||
|
||||
const root = obj;
|
||||
const pathArr = getPathSegments(path);
|
||||
+ if (pathArr.length === 0) {
|
||||
+ return;
|
||||
+ }
|
||||
|
||||
for (let i = 0; i < pathArr.length; i++) {
|
||||
const p = pathArr[i];
|
||||
diff --git a/deps/npm/node_modules/dot-prop/package.json b/deps/npm/node_modules/dot-prop/package.json
|
||||
index 40fefa3..93daf7d 100644
|
||||
--- a/deps/npm/node_modules/dot-prop/package.json
|
||||
+++ b/deps/npm/node_modules/dot-prop/package.json
|
||||
@@ -37,9 +37,9 @@
|
||||
"deprecated": false,
|
||||
"description": "Get, set, or delete a property from a nested object using a dot path",
|
||||
"devDependencies": {
|
||||
- "ava": "*",
|
||||
+ "ava": "1.4.1",
|
||||
"matcha": "^0.7.0",
|
||||
- "xo": "*"
|
||||
+ "xo": "0.24.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=4"
|
||||
@@ -73,7 +73,7 @@
|
||||
"bench": "matcha bench.js",
|
||||
"test": "xo && ava"
|
||||
},
|
||||
- "version": "4.2.0",
|
||||
+ "version": "4.2.1",
|
||||
"xo": {
|
||||
"esnext": true
|
||||
}
|
||||
diff --git a/deps/npm/node_modules/dot-prop/readme.md b/deps/npm/node_modules/dot-prop/readme.md
|
||||
index fab3b7a..0e18f78 100644
|
||||
--- a/deps/npm/node_modules/dot-prop/readme.md
|
||||
+++ b/deps/npm/node_modules/dot-prop/readme.md
|
||||
@@ -85,6 +85,8 @@ Path of the property in the object, using `.` to separate each nested key.
|
||||
|
||||
Use `\\.` if you have a `.` in the key.
|
||||
|
||||
+The following path components are invalid and results in `undefined` being returned: `__proto__`, `prototype`, `constructor`.
|
||||
+
|
||||
#### value
|
||||
|
||||
Type: `any`
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
|
@ -26,7 +26,7 @@
|
|||
%global nodejs_epoch 1
|
||||
%global nodejs_major 12
|
||||
%global nodejs_minor 18
|
||||
%global nodejs_patch 2
|
||||
%global nodejs_patch 4
|
||||
%global nodejs_abi %{nodejs_major}.%{nodejs_minor}
|
||||
%if %{?with_libs} == 1
|
||||
# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
|
||||
|
|
@ -65,8 +65,8 @@
|
|||
|
||||
# llhttp - from deps/llhttp/include/llhttp.h
|
||||
%global llhttp_major 2
|
||||
%global llhttp_minor 0
|
||||
%global llhttp_patch 4
|
||||
%global llhttp_minor 1
|
||||
%global llhttp_patch 2
|
||||
%global llhttp_version %{llhttp_major}.%{llhttp_minor}.%{llhttp_patch}
|
||||
|
||||
# libuv - from deps/uv/include/uv/version.h
|
||||
|
|
@ -102,7 +102,7 @@
|
|||
%global npm_epoch 1
|
||||
%global npm_major 6
|
||||
%global npm_minor 14
|
||||
%global npm_patch 5
|
||||
%global npm_patch 6
|
||||
%global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
|
||||
|
||||
# uvwasi - from deps/uvwasi/include/uvwasi.h
|
||||
|
|
@ -157,6 +157,9 @@ Patch1: 0001-Disable-running-gyp-on-shared-deps.patch
|
|||
Patch2: 0002-Install-both-binaries-and-use-libdir.patch
|
||||
%endif
|
||||
|
||||
# Fix for CVE-2020-8116
|
||||
Patch3: 0003-dot-prop-patch-4.2.0-with-fixes-for-CVE-2020-8116.patch
|
||||
|
||||
BuildRequires: python2-devel
|
||||
BuildRequires: python3-devel
|
||||
BuildRequires: zlib-devel
|
||||
|
|
@ -817,6 +820,9 @@ end
|
|||
|
||||
|
||||
%changelog
|
||||
* Tue Sep 22 2020 Jan Staněk <jstanek@redhat.com> - 12.18.4-1
|
||||
- Rebase to 12.18.4
|
||||
|
||||
* Tue Jun 30 2020 Jan Staněk <jstanek@redhat.com> - 12.18.2-1
|
||||
- Rebase to 12.18.2
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue