...**/!(*.map|*.min.js)Size
Gzip
Dependencies
Publish
Install
Publish
Install
@@ -20,7 +20,10 @@ | ||
| 20 | 20 | function baseUnset(object, path) { |
| 21 | 21 | path = castPath(path, object); |
| 22 | 22 | |
| 23 | // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg | |
| 23 | // Prevent prototype pollution: | |
| 24 | // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg | |
| 25 | // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh | |
| 26 | // https://github.com/lodash/lodash/security/advisories/GHSA-w36w-cm3g-pc62 | |
| 24 | 27 | var index = -1, |
| 25 | 28 | length = path.length; |
| 26 | 29 | |
@@ -28,32 +31,17 @@ | ||
| 28 | 31 | return true; |
| 29 | 32 | } |
| 30 | 33 | |
| 31 | var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function'); | |
| 32 | ||
| 33 | 34 | while (++index < length) { |
| 34 | var key = path[index]; | |
| 35 | var key = toKey(path[index]); | |
| 35 | 36 | |
| 36 | // skip non-string keys (e.g., Symbols, numbers) | |
| 37 | if (typeof key !== 'string') { | |
| 38 | continue; | |
| 39 | } | |
| 40 | ||
| 41 | 37 | // Always block "__proto__" anywhere in the path if it's not expected |
| 42 | 38 | if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) { |
| 43 | 39 | return false; |
| 44 | 40 | } |
| 45 | 41 | |
| 46 | // Block "constructor.prototype" chains | |
| 47 | if (key === 'constructor' && | |
| 48 | (index + 1) < length && | |
| 49 | typeof path[index + 1] === 'string' && | |
| 50 | path[index + 1] === 'prototype') { | |
| 51 | ||
| 52 | // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a') | |
| 53 | if (isRootPrimitive && index === 0) { | |
| 54 | continue; | |
| 55 | } | |
| 56 | ||
| 42 | // Block constructor/prototype as non-terminal traversal keys to prevent | |
| 43 | // escaping the object graph into built-in constructors and prototypes. | |
| 44 | if ((key === 'constructor' || key === 'prototype') && index < length - 1) { | |
| 57 | 45 | return false; |
| 58 | 46 | } |
| 59 | 47 | } |
@@ -5,7 +5,7 @@ | ||
| 5 | 5 | * @name has |
| 6 | 6 | * @memberOf SetCache |
| 7 | 7 | * @param {*} value The value to search for. |
| 8 | * @returns {number} Returns `true` if `value` is found, else `false`. | |
| 8 | * @returns {boolean} Returns `true` if `value` is found, else `false`. | |
| 9 | 9 | */ |
| 10 | 10 | function setCacheHas(value) { |
| 11 | 11 | return this.__data__.has(value); |
@@ -1,7 +1,7 @@ | ||
| 1 | 1 | /** |
| 2 | 2 | * @license |
| 3 | 3 | * Lodash (Custom Build) <https://lodash.com/> |
| 4 | * Build: `lodash core -o ./dist/lodash.core.js` | |
| 4 | * Build: `lodash core -o ./core.js` | |
| 5 | 5 | * Copyright OpenJS Foundation and other contributors <https://openjsf.org/> |
| 6 | 6 | * Released under MIT license <https://lodash.com/license> |
| 7 | 7 | * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE> |
@@ -13,7 +13,7 @@ | ||
| 13 | 13 | var undefined; |
| 14 | 14 | |
| 15 | 15 | /** Used as the semantic version number. */ |
| 16 | var VERSION = '4.17.23'; | |
| 16 | var VERSION = '4.18.0'; | |
| 17 | 17 | |
| 18 | 18 | /** Error message constants. */ |
| 19 | 19 | var FUNC_ERROR_TEXT = 'Expected a function'; |
@@ -1477,7 +1477,7 @@ | ||
| 1477 | 1477 | |
| 1478 | 1478 | /** |
| 1479 | 1479 | * Creates an array with all falsey values removed. The values `false`, `null`, |
| 1480 | * `0`, `""`, `undefined`, and `NaN` are falsey. | |
| 1480 | * `0`, `-0`, `0n`, `""`, `undefined`, and `NaN` are falsy. | |
| 1481 | 1481 | * |
| 1482 | 1482 | * @static |
| 1483 | 1483 | * @memberOf _ |
@@ -18,6 +18,8 @@ | ||
| 18 | 18 | * **Note:** JavaScript follows the IEEE-754 standard for resolving |
| 19 | 19 | * floating-point values which can produce unexpected results. |
| 20 | 20 | * |
| 21 | * **Note:** If `lower` is greater than `upper`, the values are swapped. | |
| 22 | * | |
| 21 | 23 | * @static |
| 22 | 24 | * @memberOf _ |
| 23 | 25 | * @since 0.7.0 |
@@ -31,9 +33,16 @@ | ||
| 31 | 33 | * _.random(0, 5); |
| 32 | 34 | * // => an integer between 0 and 5 |
| 33 | 35 | * |
| 36 | * // when lower is greater than upper the values are swapped | |
| 37 | * _.random(5, 0); | |
| 38 | * // => an integer between 0 and 5 | |
| 39 | * | |
| 34 | 40 | * _.random(5); |
| 35 | 41 | * // => also an integer between 0 and 5 |
| 36 | 42 | * |
| 43 | * _.random(-5); | |
| 44 | * // => an integer between -5 and 0 | |
| 45 | * | |
| 37 | 46 | * _.random(5, true); |
| 38 | 47 | * // => a floating-point number between 0 and 5 |
| 39 | 48 | * |
@@ -1,5 +1,4 @@ | ||
| 1 | var assignInWith = require('./assignInWith'), | |
| 2 | attempt = require('./attempt'), | |
| 1 | var attempt = require('./attempt'), | |
| 3 | 2 | baseValues = require('./_baseValues'), |
| 4 | 3 | customDefaultsAssignIn = require('./_customDefaultsAssignIn'), |
| 5 | 4 | escapeStringChar = require('./_escapeStringChar'), |
@@ -11,7 +10,8 @@ | ||
| 11 | 10 | toString = require('./toString'); |
| 12 | 11 | |
| 13 | 12 | /** Error message constants. */ |
| 14 | var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`'; | |
| 13 | var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`', | |
| 14 | INVALID_TEMPL_IMPORTS_ERROR_TEXT = 'Invalid `imports` option passed into `_.template`'; | |
| 15 | 15 | |
| 16 | 16 | /** Used to match empty string literals in compiled template source. */ |
| 17 | 17 | var reEmptyStringLeading = /\b__p \+= '';/g, |
@@ -55,6 +55,10 @@ | ||
| 55 | 55 | * properties may be accessed as free variables in the template. If a setting |
| 56 | 56 | * object is given, it takes precedence over `_.templateSettings` values. |
| 57 | 57 | * |
| 58 | * **Security:** `_.template` is insecure and should not be used. It will be | |
| 59 | * removed in Lodash v5. Avoid untrusted input. See | |
| 60 | * [threat model](https://github.com/lodash/lodash/blob/main/threat-model.md). | |
| 61 | * | |
| 58 | 62 | * **Note:** In the development build `_.template` utilizes |
| 59 | 63 | * [sourceURLs](http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl) |
| 60 | 64 | * for easier debugging. |
@@ -162,12 +166,18 @@ | ||
| 162 | 166 | options = undefined; |
| 163 | 167 | } |
| 164 | 168 | string = toString(string); |
| 165 | options = assignInWith({}, options, settings, customDefaultsAssignIn); | |
| 169 | options = assignWith({}, options, settings, customDefaultsAssignIn); | |
| 166 | 170 | |
| 167 | var imports = assignInWith({}, options.imports, settings.imports, customDefaultsAssignIn), | |
| 171 | var imports = assignWith({}, options.imports, settings.imports, customDefaultsAssignIn), | |
| 168 | 172 | importsKeys = keys(imports), |
| 169 | 173 | importsValues = baseValues(imports, importsKeys); |
| 170 | 174 | |
| 175 | arrayEach(importsKeys, function(key) { | |
| 176 | if (reForbiddenIdentifierChars.test(key)) { | |
| 177 | throw new Error(INVALID_TEMPL_IMPORTS_ERROR_TEXT); | |
| 178 | } | |
| 179 | }); | |
| 180 | ||
| 171 | 181 | var isEscaping, |
| 172 | 182 | isEvaluating, |
| 173 | 183 | index = 0, |
@@ -8,6 +8,10 @@ | ||
| 8 | 8 | * embedded Ruby (ERB) as well as ES2015 template strings. Change the |
| 9 | 9 | * following template settings to use alternative delimiters. |
| 10 | 10 | * |
| 11 | * **Security:** See | |
| 12 | * [threat model](https://github.com/lodash/lodash/blob/main/threat-model.md) | |
| 13 | * — `_.template` is insecure and will be removed in v5. | |
| 14 | * | |
| 11 | 15 | * @static |
| 12 | 16 | * @memberOf _ |
| 13 | 17 | * @type {Object} |
@@ -1,4 +1,4 @@ | ||
| 1 | # lodash v4.17.23 | |
| 1 | # lodash v4.18.0 | |
| 2 | 2 | |
| 3 | 3 | The [Lodash](https://lodash.com/) library exported as [Node.js](https://nodejs.org/) modules. |
| 4 | 4 | |
@@ -28,7 +28,7 @@ | ||
| 28 | 28 | var curryN = require('lodash/fp/curryN'); |
| 29 | 29 | ``` |
| 30 | 30 | |
| 31 | See the [package source](https://github.com/lodash/lodash/tree/4.17.23-npm) for more details. | |
| 31 | See the [package source](https://github.com/lodash/lodash/tree/4.18.0-npm) for more details. | |
| 32 | 32 | |
| 33 | 33 | **Note:**<br> |
| 34 | 34 | Install [n_](https://www.npmjs.com/package/n_) for Lodash use in the Node.js < 6 REPL. |
Size
Gzip
Dependencies