Skip to content

Commit 879aaa9

Browse files
UlisesGasconjonchurch
UlisesGascon
and
jonchurch
committed
fix: validate imports keys in _.template
Fixes an incomplete patch for CVE-2021-23337. The `variable` option was validated against `reForbiddenIdentifierChars` but `importsKeys` was left unguarded, allowing code injection via the same `Function()` constructor sink. This patch: 1. Validates `importsKeys` against `reForbiddenIdentifierChars` 2. Replaces `assignInWith` with `assignWith` when merging imports Ref: GHSA-r5fr-rjxr-66jc Ref: CVE-2026-4800 --------- Co-authored-by: Jon Church <[email protected]>
1 parent fe8d32e commit 879aaa9

4 files changed

Lines changed: 192 additions & 132 deletions

File tree

‎dist/lodash.js‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@
2020
/** Error message constants. */
2121
var CORE_ERROR_TEXT = 'Unsupported core-js use. Try https://npms.io/search?q=ponyfill.',
2222
FUNC_ERROR_TEXT = 'Expected a function',
23-
INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
23+
INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`',
24+
INVALID_TEMPL_IMPORTS_ERROR_TEXT = 'Invalid `imports` option passed into `_.template`';
2425

2526
/** Used to stand-in for `undefined` hash values. */
2627
var HASH_UNDEFINED = '__lodash_hash_undefined__';
@@ -14889,12 +14890,18 @@
1488914890
options = undefined;
1489014891
}
1489114892
string = toString(string);
14892-
options = assignInWith({}, options, settings, customDefaultsAssignIn);
14893+
options = assignWith({}, options, settings, customDefaultsAssignIn);
1489314894

14894-
var imports = assignInWith({}, options.imports, settings.imports, customDefaultsAssignIn),
14895+
var imports = assignWith({}, options.imports, settings.imports, customDefaultsAssignIn),
1489514896
importsKeys = keys(imports),
1489614897
importsValues = baseValues(imports, importsKeys);
1489714898

14899+
arrayEach(importsKeys, function(key) {
14900+
if (reForbiddenIdentifierChars.test(key)) {
14901+
throw new Error(INVALID_TEMPL_IMPORTS_ERROR_TEXT);
14902+
}
14903+
});
14904+
1489814905
var isEscaping,
1489914906
isEvaluating,
1490014907
index = 0,

0 commit comments

Comments
 (0)