Skip to content

Commit 6ad7c29

Browse files
aforismesenfacebook-github-bot
authored andcommitted
Update fbjs to 1.0.0 to fix ReDos Vulnerability (#1978)
Summary: **Summary** draft-js was using older version of fbjs that uses older version ua-parser-js what has a vulnerability. https://app.snyk.io/vuln/npm:ua-parser-js:20180227 **Test Plan** 1. Run npm test and it passes 2. Run npm build and it passes Pull Request resolved: facebookarchive/draft-js#1978 Differential Revision: D13746429 fbshipit-source-id: 636e9ad795f97781f6dc8a88125dcea0be005987
1 parent a1d5b62 commit 6ad7c29

File tree

5 files changed

+34
-4
lines changed

5 files changed

+34
-4
lines changed

meta/bundle-size-stats/Draft.js.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

meta/bundle-size-stats/Draft.min.js.json

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
"test-ci": "cross-env NODE_ENV=test npm run lint && npm run flow && npm run test"
3333
},
3434
"dependencies": {
35-
"fbjs": "^0.8.15",
35+
"fbjs": "^1.0.0",
3636
"immutable": "~3.7.4",
3737
"object-assign": "^4.1.0"
3838
},

src/component/contents/DraftEditorContents-core.react.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,11 @@ class DraftEditorContents extends React.Component<Props> {
197197
lastWrapperTemplate !== wrapperTemplate ||
198198
currentDepth === null ||
199199
depth > currentDepth;
200+
/* $FlowFixMe(>=0.70.0 site=www) This comment suppresses an error found
201+
* when Upgradng to FBJS 1.0.0 as the flow type for joinClasses is incorrect
202+
* as it's joinClasses(className: mixed): string and it needs to be
203+
* the correct type joinClasses(...className: Array<string>)
204+
* run Flow. */
200205
className = joinClasses(
201206
className,
202207
getListItemClasses(blockType, depth, shouldResetCount, direction),

yarn.lock

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2476,6 +2476,11 @@ fb-watchman@^2.0.0:
24762476
dependencies:
24772477
bser "^2.0.0"
24782478

2479+
fbjs-css-vars@^1.0.0:
2480+
version "1.0.2"
2481+
resolved "https://registry.yarnpkg.com/fbjs-css-vars/-/fbjs-css-vars-1.0.2.tgz#216551136ae02fe255932c3ec8775f18e2c078b8"
2482+
integrity sha512-b2XGFAFdWZWg0phtAWLHCk836A1Xann+I+Dgd3Gk64MHKZO44FfoD1KxyvbSh0qZsIoXQGGlVztIY+oitJPpRQ==
2483+
24792484
fbjs-scripts@^0.8.0:
24802485
version "0.8.1"
24812486
resolved "https://registry.yarnpkg.com/fbjs-scripts/-/fbjs-scripts-0.8.1.tgz#c1c6efbecb7f008478468976b783880c2f669765"
@@ -2489,7 +2494,7 @@ fbjs-scripts@^0.8.0:
24892494
semver "^5.1.0"
24902495
through2 "^2.0.0"
24912496

2492-
fbjs@^0.8.15, fbjs@^0.8.16:
2497+
fbjs@^0.8.16:
24932498
version "0.8.16"
24942499
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-0.8.16.tgz#5e67432f550dc41b572bf55847b8aca64e5337db"
24952500
dependencies:
@@ -2501,6 +2506,20 @@ fbjs@^0.8.15, fbjs@^0.8.16:
25012506
setimmediate "^1.0.5"
25022507
ua-parser-js "^0.7.9"
25032508

2509+
fbjs@^1.0.0:
2510+
version "1.0.0"
2511+
resolved "https://registry.yarnpkg.com/fbjs/-/fbjs-1.0.0.tgz#52c215e0883a3c86af2a7a776ed51525ae8e0a5a"
2512+
integrity sha512-MUgcMEJaFhCaF1QtWGnmq9ZDRAzECTCRAF7O6UZIlAlkTs1SasiX9aP0Iw7wfD2mJ7wDTNfg2w7u5fSCwJk1OA==
2513+
dependencies:
2514+
core-js "^2.4.1"
2515+
fbjs-css-vars "^1.0.0"
2516+
isomorphic-fetch "^2.1.1"
2517+
loose-envify "^1.0.0"
2518+
object-assign "^4.1.0"
2519+
promise "^7.1.1"
2520+
setimmediate "^1.0.5"
2521+
ua-parser-js "^0.7.18"
2522+
25042523
figures@^2.0.0:
25052524
version "2.0.0"
25062525
resolved "https://registry.yarnpkg.com/figures/-/figures-2.0.0.tgz#3ab1a2d2a62c8bfb431a0c94cb797a2fce27c962"
@@ -2603,6 +2622,7 @@ flat-cache@^1.2.1:
26032622
flow-bin@^0.70.0:
26042623
version "0.70.0"
26052624
resolved "https://registry.yarnpkg.com/flow-bin/-/flow-bin-0.70.0.tgz#080ae83a997f2b4ddb3dc2649bf13336825292b5"
2625+
integrity sha1-CAroOpl/K03bPcJkm/EzNoJSkrU=
26062626

26072627
flush-write-stream@^1.0.0:
26082628
version "1.0.2"
@@ -6835,6 +6855,11 @@ typedarray@^0.0.6, typedarray@~0.0.5:
68356855
version "0.0.6"
68366856
resolved "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz#867ac74e3864187b1d3d47d996a78ec5c8830777"
68376857

6858+
ua-parser-js@^0.7.18:
6859+
version "0.7.19"
6860+
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.19.tgz#94151be4c0a7fb1d001af7022fdaca4642659e4b"
6861+
integrity sha512-T3PVJ6uz8i0HzPxOF9SWzWAlfN/DavlpQqepn22xgve/5QecC+XMCAtmUNnY7C9StehaV6exjUCI801lOI7QlQ==
6862+
68386863
ua-parser-js@^0.7.9:
68396864
version "0.7.17"
68406865
resolved "https://registry.yarnpkg.com/ua-parser-js/-/ua-parser-js-0.7.17.tgz#e9ec5f9498b9ec910e7ae3ac626a805c4d09ecac"

0 commit comments

Comments
 (0)