Update to css-select to avoid security warnings (#1692)

nth-check has a security vulnerability and is depended on by css-select. Updates css-select to fix.
This commit is contained in:
Eric Anderson
2022-02-23 06:22:44 -05:00
committed by GitHub
parent f6ab25cfbb
commit 3bc3338d2a
3 changed files with 132 additions and 106 deletions
+108 -70
View File
@@ -1,14 +1,15 @@
{
"name": "react-native-svg",
"version": "12.1.0",
"version": "12.2.0",
"lockfileVersion": 2,
"requires": true,
"packages": {
"": {
"version": "12.1.0",
"name": "react-native-svg",
"version": "12.2.0",
"license": "MIT",
"dependencies": {
"css-select": "^2.1.0",
"css-select": "^4.2.1",
"css-tree": "^1.0.0-alpha.39"
},
"devDependencies": {
@@ -5710,8 +5711,9 @@
},
"node_modules/boolbase": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
"integrity": "sha1-aN/1++YMUes3cl6p4+0xDcwed24="
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/boolbase/-/boolbase-1.0.0.tgz",
"integrity": "sha1-aN/1++YMUes3cl6p4+0xDcwed24=",
"license": "ISC"
},
"node_modules/bottleneck": {
"version": "2.19.5",
@@ -7105,14 +7107,19 @@
}
},
"node_modules/css-select": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/css-select/-/css-select-2.1.0.tgz",
"integrity": "sha512-Dqk7LQKpwLoH3VovzZnkzegqNSuAziQyNZUcrdDM401iY+R5NkGBXGmtO05/yaXQziALuPogeG0b7UAgjnTJTQ==",
"version": "4.2.1",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/css-select/-/css-select-4.2.1.tgz",
"integrity": "sha512-/aUslKhzkTNCQUB2qTX84lVmfia9NyjP3WpDGtj/WxhwBzWBYUV3DgUpurHTme8UTPcPlAD1DJ+b0nN/t50zDQ==",
"license": "BSD-2-Clause",
"dependencies": {
"boolbase": "^1.0.0",
"css-what": "^3.2.1",
"domutils": "^1.7.0",
"nth-check": "^1.0.2"
"css-what": "^5.1.0",
"domhandler": "^4.3.0",
"domutils": "^2.8.0",
"nth-check": "^2.0.1"
},
"funding": {
"url": "https://github.com/sponsors/fb55"
}
},
"node_modules/css-tree": {
@@ -7128,9 +7135,10 @@
}
},
"node_modules/css-what": {
"version": "3.4.2",
"resolved": "https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz",
"integrity": "sha512-ACUm3L0/jiZTqfzRM3Hi9Q8eZqd6IK37mMWPLz9PJxkLWllYeRf+EHUSHYEtFop2Eqytaq1FizFVh7XfBnXCDQ==",
"version": "5.1.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/css-what/-/css-what-5.1.0.tgz",
"integrity": "sha512-arSMRWIIFY0hV8pIxZMEfmMI47Wj3R/aWpZDDxWYCPEiOMv6tfOrnpDtgxBYPEQD4V0Y/958+1TdC3iWTFcUPw==",
"license": "BSD-2-Clause",
"engines": {
"node": ">= 6"
},
@@ -7511,29 +7519,30 @@
}
},
"node_modules/dom-serializer": {
"version": "0.2.2",
"resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-0.2.2.tgz",
"integrity": "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==",
"version": "1.3.2",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/dom-serializer/-/dom-serializer-1.3.2.tgz",
"integrity": "sha512-5c54Bk5Dw4qAxNOI1pFEizPSjVsx5+bpJKmL2kPn8JhBUq2q09tTCa3mjijun2NfK78NMouDYNMBkOrPZiS+ig==",
"license": "MIT",
"dependencies": {
"domelementtype": "^2.0.1",
"domhandler": "^4.2.0",
"entities": "^2.0.0"
},
"funding": {
"url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
}
},
"node_modules/dom-serializer/node_modules/domelementtype": {
"node_modules/domelementtype": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.2.0.tgz",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domelementtype/-/domelementtype-2.2.0.tgz",
"integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/fb55"
}
]
},
"node_modules/domelementtype": {
"version": "1.3.1",
"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-1.3.1.tgz",
"integrity": "sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w=="
],
"license": "BSD-2-Clause"
},
"node_modules/domexception": {
"version": "1.0.1",
@@ -7544,13 +7553,33 @@
"webidl-conversions": "^4.0.2"
}
},
"node_modules/domutils": {
"version": "1.7.0",
"resolved": "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz",
"integrity": "sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==",
"node_modules/domhandler": {
"version": "4.3.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domhandler/-/domhandler-4.3.0.tgz",
"integrity": "sha512-fC0aXNQXqKSFTr2wDNZDhsEYjCiYsDWl3D01kwt25hm1YIPyDGHvvi3rw+PLqHAl/m71MaiF7d5zvBr0p5UB2g==",
"license": "BSD-2-Clause",
"dependencies": {
"dom-serializer": "0",
"domelementtype": "1"
"domelementtype": "^2.2.0"
},
"engines": {
"node": ">= 4"
},
"funding": {
"url": "https://github.com/fb55/domhandler?sponsor=1"
}
},
"node_modules/domutils": {
"version": "2.8.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domutils/-/domutils-2.8.0.tgz",
"integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
"license": "BSD-2-Clause",
"dependencies": {
"dom-serializer": "^1.0.1",
"domelementtype": "^2.2.0",
"domhandler": "^4.2.0"
},
"funding": {
"url": "https://github.com/fb55/domutils?sponsor=1"
}
},
"node_modules/dot-prop": {
@@ -7676,8 +7705,9 @@
},
"node_modules/entities": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/entities/-/entities-2.2.0.tgz",
"integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
"license": "BSD-2-Clause",
"funding": {
"url": "https://github.com/fb55/entities?sponsor=1"
}
@@ -18632,11 +18662,15 @@
}
},
"node_modules/nth-check": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz",
"integrity": "sha512-WeBOdju8SnzPN5vTUJYxYUxLeXpCaVP5i5e0LF8fg7WORF2Wd7wFX/pk0tYZk7s8T+J7VLy0Da6J1+wCT0AtHg==",
"version": "2.0.1",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/nth-check/-/nth-check-2.0.1.tgz",
"integrity": "sha512-it1vE95zF6dTT9lBsYbxvqh0Soy4SPowchj0UBGj/V6cTPnXXtQOPUbhZ6CmGzAD/rW22LQK6E96pcdJXk4A4w==",
"license": "BSD-2-Clause",
"dependencies": {
"boolbase": "~1.0.0"
"boolbase": "^1.0.0"
},
"funding": {
"url": "https://github.com/fb55/nth-check?sponsor=1"
}
},
"node_modules/nullthrows": {
@@ -33709,7 +33743,7 @@
},
"boolbase": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/boolbase/-/boolbase-1.0.0.tgz",
"integrity": "sha1-aN/1++YMUes3cl6p4+0xDcwed24="
},
"bottleneck": {
@@ -34858,14 +34892,15 @@
"dev": true
},
"css-select": {
"version": "2.1.0",
"resolved": "https://registry.npmjs.org/css-select/-/css-select-2.1.0.tgz",
"integrity": "sha512-Dqk7LQKpwLoH3VovzZnkzegqNSuAziQyNZUcrdDM401iY+R5NkGBXGmtO05/yaXQziALuPogeG0b7UAgjnTJTQ==",
"version": "4.2.1",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/css-select/-/css-select-4.2.1.tgz",
"integrity": "sha512-/aUslKhzkTNCQUB2qTX84lVmfia9NyjP3WpDGtj/WxhwBzWBYUV3DgUpurHTme8UTPcPlAD1DJ+b0nN/t50zDQ==",
"requires": {
"boolbase": "^1.0.0",
"css-what": "^3.2.1",
"domutils": "^1.7.0",
"nth-check": "^1.0.2"
"css-what": "^5.1.0",
"domhandler": "^4.3.0",
"domutils": "^2.8.0",
"nth-check": "^2.0.1"
}
},
"css-tree": {
@@ -34878,9 +34913,9 @@
}
},
"css-what": {
"version": "3.4.2",
"resolved": "https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz",
"integrity": "sha512-ACUm3L0/jiZTqfzRM3Hi9Q8eZqd6IK37mMWPLz9PJxkLWllYeRf+EHUSHYEtFop2Eqytaq1FizFVh7XfBnXCDQ=="
"version": "5.1.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/css-what/-/css-what-5.1.0.tgz",
"integrity": "sha512-arSMRWIIFY0hV8pIxZMEfmMI47Wj3R/aWpZDDxWYCPEiOMv6tfOrnpDtgxBYPEQD4V0Y/958+1TdC3iWTFcUPw=="
},
"cssom": {
"version": "0.4.4",
@@ -35184,25 +35219,19 @@
}
},
"dom-serializer": {
"version": "0.2.2",
"resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-0.2.2.tgz",
"integrity": "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==",
"version": "1.3.2",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/dom-serializer/-/dom-serializer-1.3.2.tgz",
"integrity": "sha512-5c54Bk5Dw4qAxNOI1pFEizPSjVsx5+bpJKmL2kPn8JhBUq2q09tTCa3mjijun2NfK78NMouDYNMBkOrPZiS+ig==",
"requires": {
"domelementtype": "^2.0.1",
"domhandler": "^4.2.0",
"entities": "^2.0.0"
},
"dependencies": {
"domelementtype": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.2.0.tgz",
"integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A=="
}
}
},
"domelementtype": {
"version": "1.3.1",
"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-1.3.1.tgz",
"integrity": "sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w=="
"version": "2.2.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domelementtype/-/domelementtype-2.2.0.tgz",
"integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A=="
},
"domexception": {
"version": "1.0.1",
@@ -35213,13 +35242,22 @@
"webidl-conversions": "^4.0.2"
}
},
"domutils": {
"version": "1.7.0",
"resolved": "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz",
"integrity": "sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==",
"domhandler": {
"version": "4.3.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domhandler/-/domhandler-4.3.0.tgz",
"integrity": "sha512-fC0aXNQXqKSFTr2wDNZDhsEYjCiYsDWl3D01kwt25hm1YIPyDGHvvi3rw+PLqHAl/m71MaiF7d5zvBr0p5UB2g==",
"requires": {
"dom-serializer": "0",
"domelementtype": "1"
"domelementtype": "^2.2.0"
}
},
"domutils": {
"version": "2.8.0",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/domutils/-/domutils-2.8.0.tgz",
"integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
"requires": {
"dom-serializer": "^1.0.1",
"domelementtype": "^2.2.0",
"domhandler": "^4.2.0"
}
},
"dot-prop": {
@@ -35332,7 +35370,7 @@
},
"entities": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/entities/-/entities-2.2.0.tgz",
"integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A=="
},
"env-ci": {
@@ -43855,11 +43893,11 @@
}
},
"nth-check": {
"version": "1.0.2",
"resolved": "https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz",
"integrity": "sha512-WeBOdju8SnzPN5vTUJYxYUxLeXpCaVP5i5e0LF8fg7WORF2Wd7wFX/pk0tYZk7s8T+J7VLy0Da6J1+wCT0AtHg==",
"version": "2.0.1",
"resolved": "https://artifactory.palantir.build/artifactory/api/npm/all-npm/nth-check/-/nth-check-2.0.1.tgz",
"integrity": "sha512-it1vE95zF6dTT9lBsYbxvqh0Soy4SPowchj0UBGj/V6cTPnXXtQOPUbhZ6CmGzAD/rW22LQK6E96pcdJXk4A4w==",
"requires": {
"boolbase": "~1.0.0"
"boolbase": "^1.0.0"
}
},
"nullthrows": {
+1 -1
View File
@@ -59,7 +59,7 @@
"react-native": ">=0.50.0"
},
"dependencies": {
"css-select": "^2.1.0",
"css-select": "^4.2.1",
"css-tree": "^1.0.0-alpha.39"
},
"devDependencies": {
+23 -35
View File
@@ -27,7 +27,7 @@ import csstree, {
Selector,
SelectorList,
} from 'css-tree';
import cssSelect, { Adapter, Options, Predicate, Query } from 'css-select';
import cssSelect, { Options } from 'css-select';
/*
* Style element inlining experiment based on SVGO
@@ -113,7 +113,7 @@ function removeSubsets(nodes: Array<XmlAST | string>): Array<XmlAST | string> {
// does at least one of passed element nodes pass the test predicate?
function existsOne(
predicate: Predicate<XmlAST>,
predicate: (v: XmlAST) => boolean,
elems: Array<XmlAST | string>,
): boolean {
return elems.some(
@@ -140,10 +140,10 @@ function hasAttrib(elem: XmlAST, name: string): boolean {
// finds the first node in the array that matches the test predicate, or one
// of its children
function findOne(
predicate: Predicate<XmlAST>,
predicate: (v: XmlAST)=> boolean,
elems: Array<XmlAST | string>,
): XmlAST | undefined {
let elem: XmlAST | undefined;
): XmlAST | null {
let elem: XmlAST | null = null;
for (let i = 0, l = elems.length; i < l && !elem; i++) {
const node = elems[i];
@@ -164,7 +164,7 @@ function findOne(
// finds all of the element nodes in the array that match the test predicate,
// as well as any of their children that match it
function findAll(
predicate: Predicate<XmlAST>,
predicate: (v: XmlAST) => boolean,
nodes: Array<XmlAST | string>,
result: Array<XmlAST> = [],
): Array<XmlAST> {
@@ -185,37 +185,24 @@ function findAll(
return result;
}
const adapter: Adapter<XmlAST | string, XmlAST> = {
removeSubsets,
existsOne,
getSiblings,
hasAttrib,
findOne,
findAll,
isTag,
getParent,
getChildren,
getName,
getText,
getAttributeValue,
};
const cssSelectOpts: Options<XmlAST | string, XmlAST> = {
xmlMode: true,
adapter,
adapter: {
removeSubsets,
existsOne,
getSiblings,
hasAttrib,
findOne,
findAll,
isTag,
getParent,
getChildren,
getName,
getText,
getAttributeValue,
},
};
/**
* Evaluate a string of CSS selectors against the element and returns matched elements.
*
* @param {Query} query can be either a CSS selector string or a compiled query function.
* @param {Array<XmlAST> | XmlAST} elems Elements to query. If it is an element, its children will be queried.
* @return {Array<XmlAST>} All matching elements.
*/
function querySelectorAll(query: Query, elems: XmlAST | XmlAST[]): XmlAST[] {
return cssSelect(query, elems, cssSelectOpts);
}
type FlatPseudoSelector = {
item: ListItem<CssNode>;
list: List<CssNode>;
@@ -602,7 +589,7 @@ export const inlineStyles: Middleware = function inlineStyles(
document: XmlAST,
) {
// collect <style/>s
const styleElements = querySelectorAll('style', document);
const styleElements = cssSelect('style', document, cssSelectOpts);
//no <styles/>s, nothing to do
if (styleElements.length === 0) {
@@ -650,7 +637,8 @@ export const inlineStyles: Middleware = function inlineStyles(
const selectorStr = csstree.generate(item.data);
try {
// apply <style/> to matched elements
const matched = querySelectorAll(selectorStr, document).map(initStyle);
const matched = cssSelect(selectorStr, document, cssSelectOpts).map(initStyle);
if (matched.length === 0) {
continue;
}