Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: yahoo/serialize-javascript
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v2.1.1
Choose a base ref
...
head repository: yahoo/serialize-javascript
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.1.0
Choose a head ref
  • 20 commits
  • 7 files changed
  • 8 contributors

Commits on Dec 6, 2019

  1. Bump mocha from 6.2.0 to 6.2.2 (#62) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 6.2.0 to 6.2.2.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v6.2.0...v6.2.2)

Signed-off-by: dependabot-preview[bot] <[email protected]>
    @dependabot-preview @okuryu
    dependabot-preview[bot] authored and okuryu committed Dec 6, 2019
    Configuration menu
    Copy the full SHA
    3c46e8e View commit details
    Browse the repository at this point in the history

Commits on Dec 9, 2019

  1. Ignore .nyc_output (#64)

    @styfle @okuryu
    styfle authored and okuryu committed Dec 9, 2019
    Configuration menu
    Copy the full SHA
    3e05a3f View commit details
    Browse the repository at this point in the history

  2. v2.1.2

    @okuryu
    okuryu committed Dec 9, 2019
    Configuration menu
    Copy the full SHA
    6c43b02 View commit details
    Browse the repository at this point in the history

Commits on Dec 24, 2019

  1. Bump nyc from 14.1.1 to 15.0.0 (#68) 

    Bumps [nyc](https://github.com/istanbuljs/nyc) from 14.1.1 to 15.0.0.
- [Release notes](https://github.com/istanbuljs/nyc/releases)
- [Changelog](https://github.com/istanbuljs/nyc/blob/master/CHANGELOG.md)
- [Commits](istanbuljs/nyc@v14.1.1...v15.0.0)

Signed-off-by: dependabot-preview[bot] <[email protected]>
    @dependabot-preview @okuryu
    dependabot-preview[bot] authored and okuryu committed Dec 24, 2019
    Configuration menu
    Copy the full SHA
    35062c0 View commit details
    Browse the repository at this point in the history

Commits on Jan 7, 2020

  1. Bump mocha from 6.2.2 to 7.0.0 (#69) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 6.2.2 to 7.0.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v6.2.2...v7.0.0)

Signed-off-by: dependabot-preview[bot] <[email protected]>
    @dependabot-preview @okuryu
    dependabot-preview[bot] authored and okuryu committed Jan 7, 2020
    Configuration menu
    Copy the full SHA
    2f5f126 View commit details
    Browse the repository at this point in the history

Commits on Jan 14, 2020

  1. Test on Node.js v12 (#70)

    @okuryu
    okuryu authored Jan 14, 2020
    Configuration menu
    Copy the full SHA
    fdfb10a View commit details
    Browse the repository at this point in the history

Commits on Jan 30, 2020

  1. Bump mocha from 7.0.0 to 7.0.1 (#71) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.0.0...v7.0.1)

Signed-off-by: dependabot-preview[bot] <[email protected]>
    @dependabot-preview
    dependabot-preview[bot] authored Jan 30, 2020
    Configuration menu
    Copy the full SHA
    82bb2d2 View commit details
    Browse the repository at this point in the history

Commits on Feb 16, 2020

  1. Introduce support for Infinity (#72)

    @vthibault
    vthibault authored Feb 16, 2020
    Configuration menu
    Copy the full SHA
    eed510c View commit details
    Browse the repository at this point in the history

  2. v3.0.0

    @okuryu
    okuryu committed Feb 16, 2020
    Configuration menu
    Copy the full SHA
    f5957ee View commit details
    Browse the repository at this point in the history

Commits on Feb 18, 2020

  1. Update example in README (#73)

    @okuryu
    okuryu authored Feb 18, 2020
    Configuration menu
    Copy the full SHA
    9dbe8f6 View commit details
    Browse the repository at this point in the history

Commits on Feb 27, 2020

  1. Bump mocha from 7.0.1 to 7.1.0 (#74) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 7.0.1 to 7.1.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.0.1...v7.1.0)

Signed-off-by: dependabot-preview[bot] <[email protected]>
    @dependabot-preview
    dependabot-preview[bot] authored Feb 27, 2020
    Configuration menu
    Copy the full SHA
    3064431 View commit details
    Browse the repository at this point in the history

Commits on Mar 19, 2020

  1. Bump mocha from 7.1.0 to 7.1.1 (#77) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 7.1.0 to 7.1.1.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.1.0...v7.1.1)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
    @dependabot-preview
    dependabot-preview[bot] authored Mar 19, 2020
    Configuration menu
    Copy the full SHA
    c795cef View commit details
    Browse the repository at this point in the history

Commits on Mar 21, 2020

  1. [Security] Bump minimist from 1.2.0 to 1.2.5 (#78) 

    Bumps [minimist](https://github.com/substack/minimist) from 1.2.0 to 1.2.5. **This update includes a security fix.**
- [Release notes](https://github.com/substack/minimist/releases)
- [Commits](https://github.com/substack/minimist/compare/1.2.0...1.2.5)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
    @dependabot-preview
    dependabot-preview[bot] authored Mar 21, 2020
    Configuration menu
    Copy the full SHA
    1ac487e View commit details
    Browse the repository at this point in the history

Commits on May 20, 2020

  1. Don't replace regex / function placeholders within string literals (#79) 

    Previously we weren't checking if the quote that started the placeholder
was escaped or not, meaning an object like

    {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}

Would be serialized as

    {"foo": /1"/, "bar": "a\/1"/}

meaning an attacker could escape out of `bar` if they controlled both
`foo` and `bar` and were able to guess the value of `<UID>`.

UID was generated once on startup, was chosen using `Math.random()` and
had a keyspace of roughly 4 billion, so within the realm of an online
attack.

Here's a simple example that will cause `console.log()` to be called when
the `serialize()`d version is `eval()`d

    eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');

Where `<UID>` is the guessed `UID`.

This fixes the issue by ensuring that placeholders are not preceded by
a backslash.

We also switch to a higher entropy `UID` to prevent people from guessing it.

Co-authored-by: Jordan Milne <[email protected]>
Co-authored-by: Ryan Siebert <[email protected]>
    @Siebes @earyans
    3 people authored May 20, 2020
    3 Configuration menu
    Copy the full SHA
    f21a6fb View commit details
    Browse the repository at this point in the history

Commits on May 21, 2020

  1. Bump nyc from 15.0.0 to 15.0.1 (#81) 

    Bumps [nyc](https://github.com/istanbuljs/nyc) from 15.0.0 to 15.0.1.
- [Release notes](https://github.com/istanbuljs/nyc/releases)
- [Changelog](https://github.com/istanbuljs/nyc/blob/master/CHANGELOG.md)
- [Commits](istanbuljs/nyc@v15.0.0...v15.0.1)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
    @dependabot-preview
    dependabot-preview[bot] authored May 21, 2020
    Configuration menu
    Copy the full SHA
    073c8d8 View commit details
    Browse the repository at this point in the history

  2. Bump mocha from 7.1.1 to 7.1.2 (#82) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 7.1.1 to 7.1.2.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.1.1...v7.1.2)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
    @dependabot-preview
    dependabot-preview[bot] authored May 21, 2020
    Configuration menu
    Copy the full SHA
    ea76b23 View commit details
    Browse the repository at this point in the history

Commits on May 24, 2020

  1. support for bigint (#80)

    @mum-never-proud
    mum-never-proud authored May 24, 2020
    Configuration menu
    Copy the full SHA
    5130a71 View commit details
    Browse the repository at this point in the history

Commits on May 26, 2020

  1. Bump mocha from 7.1.2 to 7.2.0 (#83) 

    Bumps [mocha](https://github.com/mochajs/mocha) from 7.1.2 to 7.2.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.1.2...v7.2.0)

Signed-off-by: dependabot-preview[bot] <[email protected]>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
    @dependabot-preview
    dependabot-preview[bot] authored May 26, 2020
    Configuration menu
    Copy the full SHA
    026a445 View commit details
    Browse the repository at this point in the history

Commits on May 28, 2020

  1. Revert "support for bigint (#80)" 

    This reverts commit 5130a71.
    @okuryu
    okuryu committed May 28, 2020
    Configuration menu
    Copy the full SHA
    7cee7e4 View commit details
    Browse the repository at this point in the history

  2. v3.1.0

    @okuryu
    okuryu committed May 28, 2020
    Configuration menu
    Copy the full SHA
    b54341e View commit details
    Browse the repository at this point in the history
Loading