Skip to content
This repository has been archived by the owner on Feb 6, 2023. It is now read-only.

Update fbjs to 1.0.0 to fix ReDos Vulnerability #1978

Closed
wants to merge 3 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion meta/bundle-size-stats/Draft.js.json

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion meta/bundle-size-stats/Draft.min.js.json

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"test-ci": "cross-env NODE_ENV=test npm run lint && npm run flow && npm run test"
},
"dependencies": {
"fbjs": "^0.8.15",
"fbjs": "^1.0.0",
"immutable": "~3.7.4",
"object-assign": "^4.1.0"
},
Expand Down
5 changes: 5 additions & 0 deletions src/component/contents/DraftEditorContents-core.react.js
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,11 @@ class DraftEditorContents extends React.Component<Props> {
lastWrapperTemplate !== wrapperTemplate ||
currentDepth === null ||
depth > currentDepth;
/* $FlowFixMe(>=0.70.0 site=www) This comment suppresses an error found
* when Upgradng to FBJS 1.0.0 as the flow type for joinClasses is incorrect
* as it's joinClasses(className: mixed): string and it needs to be
* the correct type joinClasses(...className: Array<string>)
* run Flow. */
className = joinClasses(
className,
getListItemClasses(blockType, depth, shouldResetCount, direction),
Expand Down
27 changes: 26 additions & 1 deletion yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -2476,6 +2476,11 @@ fb-watchman@^2.0.0:
dependencies:
bser "^2.0.0"

fbjs-css-vars@^1.0.0:
version "1.0.2"
resolved "https://registry.yarnpkg.com/fbjs-css-vars/-/fbjs-css-vars-1.0.2.tgz#216551136ae02fe255932c3ec8775f18e2c078b8"
integrity sha512-b2XGFAFdWZWg0phtAWLHCk836A1Xann+I+Dgd3Gk64MHKZO44FfoD1KxyvbSh0qZsIoXQGGlVztIY+oitJPpRQ==

fbjs-scripts@^0.8.0:
version "0.8.1"
resolved "https://registry.yarnpkg.com/fbjs-scripts/-/fbjs-scripts-0.8.1.tgz#c1c6efbecb7f008478468976b783880c2f669765"
Expand All @@ -2489,7 +2494,7 @@ fbjs-scripts@^0.8.0:
semver "^5.1.0"
through2 "^2.0.0"

fbjs@^0.8.15, fbjs@^0.8.16:
fbjs@^0.8.16:
version "0.8.16"
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-0.8.16.tgz#5e67432f550dc41b572bf55847b8aca64e5337db"
dependencies:
Expand All @@ -2501,6 +2506,20 @@ fbjs@^0.8.15, fbjs@^0.8.16:
setimmediate "^1.0.5"
ua-parser-js "^0.7.9"

fbjs@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-1.0.0.tgz#52c215e0883a3c86af2a7a776ed51525ae8e0a5a"
integrity sha512-MUgcMEJaFhCaF1QtWGnmq9ZDRAzECTCRAF7O6UZIlAlkTs1SasiX9aP0Iw7wfD2mJ7wDTNfg2w7u5fSCwJk1OA==
dependencies:
core-js "^2.4.1"
fbjs-css-vars "^1.0.0"
isomorphic-fetch "^2.1.1"
loose-envify "^1.0.0"
object-assign "^4.1.0"
promise "^7.1.1"
setimmediate "^1.0.5"
ua-parser-js "^0.7.18"

figures@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/figures/-/figures-2.0.0.tgz#3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962"
Expand Down Expand Up @@ -2603,6 +2622,7 @@ flat-cache@^1.2.1:
flow-bin@^0.70.0:
version "0.70.0"
resolved "https://registry.yarnpkg.com/flow-bin/-/flow-bin-0.70.0.tgz#080ae83a997f2b4ddb3dc2649bf13336825292b5"
integrity sha1-CAroOpl/K03bPcJkm/EzNoJSkrU=

flush-write-stream@^1.0.0:
version "1.0.2"
Expand Down Expand Up @@ -6835,6 +6855,11 @@ typedarray@^0.0.6, typedarray@~0.0.5:
version "0.0.6"
resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"

ua-parser-js@^0.7.18:
version "0.7.19"
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.19.tgz#94151be4c0a7fb1d001af7022fdaca4642659e4b"
integrity sha512-T3PVJ6uz8i0HzPxOF9SWzWAlfN/DavlpQqepn22xgve/5QecC+XMCAtmUNnY7C9StehaV6exjUCI801lOI7QlQ==

ua-parser-js@^0.7.9:
version "0.7.17"
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.17.tgz#e9ec5f9498b9ec910e7ae3ac626a805c4d09ecac"
Expand Down