Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: redis/ioredis
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v4.27.7
Choose a base ref
...
head repository: redis/ioredis
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v4.27.8
Choose a head ref
  • 3 commits
  • 5 files changed
  • 2 contributors

Commits on Aug 1, 2021

  1. chore: fix potential security vulnerabilities [skip ci]

    @luin
    luin committed Aug 1, 2021
    Copy the full SHA
    17c7595 View commit details

Commits on Aug 18, 2021

  1. fix: handle malicious keys for hgetall (#1416) 

    Closes #1267
    @luin
    luin authored Aug 18, 2021

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    7d73b9d View commit details

  2. chore(release): 4.27.8 [skip ci] 

    ## [4.27.8](v4.27.7...v4.27.8) (2021-08-18)

### Bug Fixes

* handle malicious keys for hgetall ([#1416](#1416)) ([7d73b9d](7d73b9d)), closes [#1267](#1267)
    @semantic-release-bot
    semantic-release-bot committed Aug 18, 2021
    Copy the full SHA
    0587353 View commit details
Showing with 65 additions and 1,100 deletions.
  1. +7 −0 Changelog.md
  2. +14 −1 lib/command.ts
  3. +31 −1,098 package-lock.json
  4. +1 −1 package.json
  5. +12 −0 test/functional/hgetall.ts
7 changes: 7 additions & 0 deletions Changelog.md
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
## [4.27.8](https://github.com/luin/ioredis/compare/v4.27.7...v4.27.8) (2021-08-18)


### Bug Fixes

* handle malicious keys for hgetall ([#1416](https://github.com/luin/ioredis/issues/1416)) ([7d73b9d](https://github.com/luin/ioredis/commit/7d73b9d07b52ec077f235292aa15c7aca203bba9)), closes [#1267](https://github.com/luin/ioredis/issues/1267)

## [4.27.7](https://github.com/luin/ioredis/compare/v4.27.6...v4.27.7) (2021-08-01)


15 changes: 14 additions & 1 deletion lib/command.ts
View file
Original file line number Diff line number Diff line change
@@ -427,7 +427,20 @@ Command.setReplyTransformer("hgetall", function (result) {
if (Array.isArray(result)) {
const obj = {};
for (let i = 0; i < result.length; i += 2) {
obj[result[i]] = result[i + 1];
const key = result[i];
const value = result[i + 1];
if (obj[key]) {
// can only be truthy if the property is special somehow, like '__proto__' or 'constructor'
// https://github.com/luin/ioredis/issues/1267
Object.defineProperty(obj, key, {
value,
configurable: true,
enumerable: true,
writable: true,
});
} else {
obj[key] = value;
}
}
return obj;
}
Loading