From 25ffe44357aa8f28d00239af61b74baced7510e4 Mon Sep 17 00:00:00 2001 From: Tjatse Date: Tue, 1 Mar 2022 10:26:20 +0800 Subject: [PATCH] bump v0.0.9 fixed Regular Expression Denial of Service (ReDoS) in lodash --- package.json | 7 +++---- test/chaining.js | 26 ++++++++++++++++++++++++-- 2 files changed, 27 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 271ae93..aec5e6f 100644 --- a/package.json +++ b/package.json @@ -1,10 +1,10 @@ { "name": "ansi-html", - "version": "0.0.8", + "version": "0.0.9", "description": "An elegant lib that converts the chalked (ANSI) text to HTML.", "main": "index.js", "scripts": { - "test": "./node_modules/.bin/mocha -R spec -t 5000" + "test": "./node_modules/.bin/mocha" }, "bin": { "ansi-html": "./bin/ansi-html" @@ -33,8 +33,7 @@ "devDependencies": { "mocha": "^1.21.4", "chai": "^1.9.1", - "chalk": "^1.1.3", - "lodash": "^2.4.2" + "chalk": "^1.1.3" }, "readmeFilename": "README.md", "homepage": "https://github.com/Tjatse/ansi-html", diff --git a/test/chaining.js b/test/chaining.js index b38fe59..51a29c3 100644 --- a/test/chaining.js +++ b/test/chaining.js @@ -2,7 +2,6 @@ var ansiHTML = require('../') var chalk = require('chalk') var chai = require('chai') var expect = chai.expect -var _ = require('lodash') var fns = {} Object.keys(chalk.styles).forEach(function (key) { @@ -27,7 +26,7 @@ var txt = 'ansi-html' describe('chaining', function () { var keys = Object.keys(fns) for (var i = 0; i < keys.length * 5; i++) { - var cKeys = _.sample(keys, _.random(1, 5)) + var cKeys = _sample(keys) var ret = {} cKeys.forEach(function (key) { @@ -41,3 +40,26 @@ describe('chaining', function () { }.bind(ret)) } }) + +function _random (min, max) { + return Math.ceil(10000 * Math.random()) % max + min +} + +function _sample (arr, count) { + if (!count) { + count = _random(1, 5) + } + var len = arr.length + var ret = [] + for (var i = 0; i < count; i++) { + var seed = _random(0, len) + while (ret.indexOf(arr[seed]) >= 0) { + seed = _random(0, len) + } + const v = arr[seed] + if (v && ret.indexOf(v) < 0) { + ret.push(v) + } + } + return ret +} \ No newline at end of file