update to latest release

[npenin]

No description provided.

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

To fix the prototype pollution issue, we should ensure that the keys used in the results object cannot be __proto__, constructor, or prototype. This can be achieved by either using a Map object or by explicitly checking and rejecting these keys.

The best way to fix this without changing existing functionality is to add a check to reject these keys. This approach is straightforward and does not require significant changes to the existing code structure.

To fix the problem, we need to modify the regular expression to remove the ambiguity that causes exponential backtracking. Specifically, we can replace the [A-Z0-9]+ pattern with a more precise pattern that avoids ambiguity. One way to achieve this is to use a non-capturing group with a negated character class to ensure that each character is matched only once.

• Modify the regular expression on line 154 to avoid exponential backtracking.
• Replace [A-Z0-9]+ with (?:[A-Z0-9]+) to ensure that the pattern matches each character only once.

To fix the problem, we need to remove the redundant 0-9 from the character class in the regular expression. The \w character class already includes digits, so we can simplify the regular expression by removing 0-9.

• In the file packages/core/src/parser/parser.ts, locate the regular expression on line 384.
• Modify the regular expression to remove the redundant 0-9 from the character class.
• Ensure that the functionality remains the same by keeping the rest of the regular expression intact.

To fix the problem, we need to ensure that any potentially dangerous characters in the tag.event keys and values are properly escaped before being inserted into the JavaScript code. We can achieve this by creating a function that escapes unsafe characters and using it to sanitize the tag.event keys and values.

1. Create a function escapeUnsafeChars that escapes potentially dangerous characters.
2. Use this function to sanitize the tag.event keys and values before inserting them into the JavaScript code.

To fix the problem, we need to ensure that any user-controlled input is properly sanitized before being included in the dynamically generated script tag. We can achieve this by escaping potentially dangerous characters in the input. We will create a function to escape unsafe characters and use it to sanitize tag.attributes.id.value before including it in the script tag.

1. Create a function escapeUnsafeChars to escape potentially dangerous characters.
2. Use this function to sanitize tag.attributes.id.value before including it in the script tag.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud

To fix the prototype pollution vulnerability, we need to ensure that the key parameter does not contain any values that could modify the Object.prototype. We can achieve this by checking if the key contains any forbidden properties like __proto__, constructor, or prototype before using it to modify the config object.

To fix the prototype pollution vulnerability, we need to ensure that the key value cannot be used to modify Object.prototype. One way to achieve this is by checking if any part of the key is __proto__, constructor, or prototype and rejecting such inputs. This can be done by adding a validation step before using the key to modify the config object.

To fix the prototype pollution vulnerability, we need to ensure that the key parameter cannot be __proto__, constructor, or prototype. This can be done by adding a check at the beginning of the delete method to reject these values. Additionally, we should use a safer data structure like Map to store the configuration, but for minimal changes, we will implement the key validation.

To fix the problem, we need to add a more robust validation for the formatter before it is used. Specifically, we should ensure that the formatter is a function and, if it is to be instantiated, that it is a valid constructor. We can achieve this by using a combination of typeof checks and instanceof checks.

1. Add a check to ensure that formatter is a function.
2. Add a check to ensure that formatter is a valid constructor if it is to be instantiated.
3. Modify the code to handle cases where the formatter is not valid by returning an appropriate error message or taking other corrective actions.

To fix the problem, we need to ensure that the formatter is a valid function and is an own property of the expression object. We can achieve this by using Object.prototype.hasOwnProperty.call to check if formatter is an own property and typeof to check if it is a function. This will prevent any unexpected method calls and runtime exceptions.

To fix the problem, we need to ensure that the formatter variable is validated more thoroughly before it is used. Specifically, we should:

1. Check if formatter is an own property of the formatters object to ensure it is a valid formatter function.
2. Verify that formatter is indeed a function before invoking it.

This can be achieved by modifying the code in packages/core/src/observables/object.ts to include these additional checks.

To fix the problem, we need to sanitize the start parameter before using it to construct the regular expression. The best way to do this is by using a sanitization function such as _.escapeRegExp from the lodash library. This function escapes special characters in the input string, making it safe to use in a regular expression.

1. Install the lodash package if it is not already installed.
2. Import the _.escapeRegExp function from lodash.
3. Use _.escapeRegExp to sanitize the start parameter before constructing the regular expression.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud