Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 0351ade

Browse files
luchsamapparatFrozenPandaz
luchsamapparat
authored and
FrozenPandaz
committedAug 18, 2020
fix(core): update copy-webpack-plugin (#3514)
fixes security vulnerability caused by serialize-javascript < 3.1.0 closes #3506
·
9.8.09.6.0
1 parent 00de5d8 commit 0351ade

File tree

8 files changed

+144
-55
lines changed

8 files changed

+144
-55
lines changed
 

Diff for: ‎package.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@
7878
"@storybook/react": "5.3.9",
7979
"@svgr/webpack": "^5.2.0",
8080
"@testing-library/react": "9.4.0",
81+
"@types/copy-webpack-plugin": "6.0.0",
8182
"@types/eslint": "^6.1.8",
8283
"@types/express": "4.17.0",
8384
"@types/fast-levenshtein": "^0.0.1",
@@ -120,7 +121,7 @@
120121
"commitizen": "^4.0.3",
121122
"confusing-browser-globals": "^1.0.9",
122123
"conventional-changelog-cli": "^2.0.23",
123-
"copy-webpack-plugin": "5.1.1",
124+
"copy-webpack-plugin": "6.0.3",
124125
"core-js": "^3.6.5",
125126
"cosmiconfig": "^4.0.0",
126127
"css-loader": "3.4.2",

Diff for: ‎packages/node/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@
3939
"@angular-devkit/schematics": "~9.1.0",
4040
"@angular-devkit/build-webpack": "~0.901.0",
4141
"circular-dependency-plugin": "5.2.0",
42-
"copy-webpack-plugin": "5.1.1",
42+
"copy-webpack-plugin": "6.0.3",
4343
"fork-ts-checker-webpack-plugin": "^3.1.1",
4444
"license-webpack-plugin": "2.1.2",
4545
"source-map-support": "0.5.12",

Diff for: ‎packages/node/src/utils/config.ts

+18-20
Original file line numberDiff line numberDiff line change
@@ -99,27 +99,25 @@ export function getBaseWebpackPartial(
9999

100100
// process asset entries
101101
if (options.assets) {
102-
const copyWebpackPluginPatterns = options.assets.map((asset: any) => {
103-
return {
104-
context: asset.input,
105-
// Now we remove starting slash to make Webpack place it from the output root.
106-
to: asset.output,
107-
ignore: asset.ignore,
108-
from: {
109-
glob: asset.glob,
110-
dot: true,
111-
},
112-
};
102+
const copyWebpackPluginInstance = new CopyWebpackPlugin({
103+
patterns: options.assets.map((asset: any) => {
104+
return {
105+
context: asset.input,
106+
// Now we remove starting slash to make Webpack place it from the output root.
107+
to: asset.output,
108+
from: asset.glob,
109+
globOptions: {
110+
ignore: [
111+
'.gitkeep',
112+
'**/.DS_Store',
113+
'**/Thumbs.db',
114+
...(asset.ignore ? asset.ignore : []),
115+
],
116+
dot: true,
117+
},
118+
};
119+
}),
113120
});
114-
115-
const copyWebpackPluginOptions = {
116-
ignore: ['.gitkeep', '**/.DS_Store', '**/Thumbs.db'],
117-
};
118-
119-
const copyWebpackPluginInstance = new CopyWebpackPlugin(
120-
copyWebpackPluginPatterns,
121-
copyWebpackPluginOptions
122-
);
123121
extraPlugins.push(copyWebpackPluginInstance);
124122
}
125123

Diff for: ‎packages/web/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@
6060
"caniuse-lite": "^1.0.30001030",
6161
"circular-dependency-plugin": "5.2.0",
6262
"clean-css": "4.2.1",
63-
"copy-webpack-plugin": "5.1.1",
63+
"copy-webpack-plugin": "6.0.3",
6464
"core-js": "^3.6.5",
6565
"css-loader": "3.4.2",
6666
"file-loader": "4.2.0",

Diff for: ‎packages/web/src/utils/config.ts

+11-9
Original file line numberDiff line numberDiff line change
@@ -223,21 +223,23 @@ function getClientEnvironment(mode) {
223223
}
224224

225225
export function createCopyPlugin(assets: AssetGlobPattern[]) {
226-
return new CopyWebpackPlugin(
227-
assets.map((asset) => {
226+
return new CopyWebpackPlugin({
227+
patterns: assets.map((asset) => {
228228
return {
229229
context: asset.input,
230230
// Now we remove starting slash to make Webpack place it from the output root.
231231
to: asset.output,
232-
ignore: asset.ignore,
233-
from: {
234-
glob: asset.glob,
232+
from: asset.glob,
233+
globOptions: {
234+
ignore: [
235+
'.gitkeep',
236+
'**/.DS_Store',
237+
'**/Thumbs.db',
238+
...(asset.ignore ? asset.ignore : []),
239+
],
235240
dot: true,
236241
},
237242
};
238243
}),
239-
{
240-
ignore: ['.gitkeep', '**/.DS_Store', '**/Thumbs.db'],
241-
}
242-
);
244+
});
243245
}

Diff for: ‎packages/web/src/utils/normalize.ts

-1
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,5 @@ export function convertBuildOptions(buildOptions: WebBuildBuilderOptions): any {
170170
aot: false,
171171
forkTypeChecker: false,
172172
lazyModules: [] as string[],
173-
assets: [] as string[],
174173
};
175174
}

Diff for: ‎packages/web/src/utils/third-party/cli-files/models/webpack-configs/common.ts

+12-16
Original file line numberDiff line numberDiff line change
@@ -237,8 +237,8 @@ export function getCommonConfig(wco: WebpackConfigOptions): Configuration {
237237

238238
// process asset entries
239239
if (buildOptions.assets) {
240-
const copyWebpackPluginPatterns = buildOptions.assets.map(
241-
(asset: AssetPatternClass) => {
240+
const copyWebpackPluginInstance = new CopyWebpackPlugin({
241+
patterns: buildOptions.assets.map((asset: AssetPatternClass) => {
242242
// Resolve input paths relative to workspace root and add slash at the end.
243243
asset.input = path.resolve(root, asset.input).replace(/\\/g, '/');
244244
asset.input = asset.input.endsWith('/')
@@ -258,23 +258,19 @@ export function getCommonConfig(wco: WebpackConfigOptions): Configuration {
258258
context: asset.input,
259259
// Now we remove starting slash to make Webpack place it from the output root.
260260
to: asset.output.replace(/^\//, ''),
261-
ignore: asset.ignore,
262-
from: {
263-
glob: asset.glob,
261+
from: asset.glob,
262+
globOptions: {
263+
ignore: [
264+
'.gitkeep',
265+
'**/.DS_Store',
266+
'**/Thumbs.db',
267+
...(asset.ignore ? asset.ignore : []),
268+
],
264269
dot: true,
265270
},
266271
};
267-
}
268-
);
269-
270-
const copyWebpackPluginOptions = {
271-
ignore: ['.gitkeep', '**/.DS_Store', '**/Thumbs.db'],
272-
};
273-
274-
const copyWebpackPluginInstance = new CopyWebpackPlugin(
275-
copyWebpackPluginPatterns,
276-
copyWebpackPluginOptions
277-
);
272+
}),
273+
});
278274
extraPlugins.push(copyWebpackPluginInstance);
279275
}
280276

Diff for: ‎yarn.lock

+99-6
Original file line numberDiff line numberDiff line change
@@ -3248,6 +3248,14 @@
32483248
dependencies:
32493249
"@types/node" "*"
32503250

3251+
"@types/copy-webpack-plugin@6.0.0":
3252+
version "6.0.0"
3253+
resolved "https://registry.yarnpkg.com/@types/copy-webpack-plugin/-/copy-webpack-plugin-6.0.0.tgz#ad4a4d7be859ba6a6adcb970aab3256a705cd049"
3254+
integrity sha512-Ousy+sNap1j44eG+C9FZvTUybpp9lFmKjBRF7L0NDs/+SDA9OXKo2OpsHJfD/LMWflz+uvfTCBXH1CgdL6AW/g==
3255+
dependencies:
3256+
"@types/node" "*"
3257+
"@types/webpack" "*"
3258+
32513259
"@types/eslint-visitor-keys@^1.0.0":
32523260
version "1.0.0"
32533261
resolved "https://registry.yarnpkg.com/@types/eslint-visitor-keys/-/eslint-visitor-keys-1.0.0.tgz#1ee30d79544ca84d68d4b3cdb0af4f205663dd2d"
@@ -3666,10 +3674,10 @@
36663674
"@types/source-list-map" "*"
36673675
source-map "^0.6.1"
36683676

3669-
"@types/webpack@^4.4.24", "@types/webpack@^4.41.8":
3670-
version "4.41.17"
3671-
resolved "https://registry.yarnpkg.com/@types/webpack/-/webpack-4.41.17.tgz#0a69005e644d657c85b7d6ec1c826a71bebd1c93"
3672-
integrity sha512-6FfeCidTSHozwKI67gIVQQ5Mp0g4X96c2IXxX75hYEQJwST/i6NyZexP//zzMOBb+wG9jJ7oO8fk9yObP2HWAw==
3677+
"@types/webpack@*", "@types/webpack@^4.4.24", "@types/webpack@^4.41.8":
3678+
version "4.41.21"
3679+
resolved "https://registry.yarnpkg.com/@types/webpack/-/webpack-4.41.21.tgz#cc685b332c33f153bb2f5fc1fa3ac8adeb592dee"
3680+
integrity sha512-2j9WVnNrr/8PLAB5csW44xzQSJwS26aOnICsP3pSGCEdsu6KYtfQ6QJsVUKHWRnm1bL7HziJsfh5fHqth87yKA==
36733681
dependencies:
36743682
"@types/anymatch" "*"
36753683
"@types/node" "*"
@@ -6376,6 +6384,29 @@ cacache@^15.0.0:
63766384
tar "^6.0.2"
63776385
unique-filename "^1.1.1"
63786386

6387+
cacache@^15.0.4:
6388+
version "15.0.5"
6389+
resolved "https://registry.yarnpkg.com/cacache/-/cacache-15.0.5.tgz#69162833da29170d6732334643c60e005f5f17d0"
6390+
integrity sha512-lloiL22n7sOjEEXdL8NAjTgv9a1u43xICE9/203qonkZUCj5X1UEWIdf2/Y0d6QcCtMzbKQyhrcDbdvlZTs/+A==
6391+
dependencies:
6392+
"@npmcli/move-file" "^1.0.1"
6393+
chownr "^2.0.0"
6394+
fs-minipass "^2.0.0"
6395+
glob "^7.1.4"
6396+
infer-owner "^1.0.4"
6397+
lru-cache "^6.0.0"
6398+
minipass "^3.1.1"
6399+
minipass-collect "^1.0.2"
6400+
minipass-flush "^1.0.5"
6401+
minipass-pipeline "^1.2.2"
6402+
mkdirp "^1.0.3"
6403+
p-map "^4.0.0"
6404+
promise-inflight "^1.0.1"
6405+
rimraf "^3.0.2"
6406+
ssri "^8.0.0"
6407+
tar "^6.0.2"
6408+
unique-filename "^1.1.1"
6409+
63796410
cache-base@^1.0.1:
63806411
version "1.0.1"
63816412
resolved "https://registry.yarnpkg.com/cache-base/-/cache-base-1.0.1.tgz#0a7f46416831c8b662ee36fe4e7c59d76f666ab2"
@@ -7593,6 +7624,23 @@ copy-webpack-plugin@5.1.1:
75937624
serialize-javascript "^2.1.2"
75947625
webpack-log "^2.0.0"
75957626

7627+
copy-webpack-plugin@6.0.3:
7628+
version "6.0.3"
7629+
resolved "https://registry.yarnpkg.com/copy-webpack-plugin/-/copy-webpack-plugin-6.0.3.tgz#2b3d2bfc6861b96432a65f0149720adbd902040b"
7630+
integrity sha512-q5m6Vz4elsuyVEIUXr7wJdIdePWTubsqVbEMvf1WQnHGv0Q+9yPRu7MtYFPt+GBOXRav9lvIINifTQ1vSCs+eA==
7631+
dependencies:
7632+
cacache "^15.0.4"
7633+
fast-glob "^3.2.4"
7634+
find-cache-dir "^3.3.1"
7635+
glob-parent "^5.1.1"
7636+
globby "^11.0.1"
7637+
loader-utils "^2.0.0"
7638+
normalize-path "^3.0.0"
7639+
p-limit "^3.0.1"
7640+
schema-utils "^2.7.0"
7641+
serialize-javascript "^4.0.0"
7642+
webpack-sources "^1.4.3"
7643+
75967644
core-js-compat@^3.1.1, core-js-compat@^3.6.2:
75977645
version "3.6.5"
75987646
resolved "https://registry.yarnpkg.com/core-js-compat/-/core-js-compat-3.6.5.tgz#2a51d9a4e25dfd6e690251aa81f99e3c05481f1c"
@@ -9841,6 +9889,18 @@ fast-glob@^3.0.3:
98419889
micromatch "^4.0.2"
98429890
picomatch "^2.2.1"
98439891

9892+
fast-glob@^3.1.1, fast-glob@^3.2.4:
9893+
version "3.2.4"
9894+
resolved "https://registry.yarnpkg.com/fast-glob/-/fast-glob-3.2.4.tgz#d20aefbf99579383e7f3cc66529158c9b98554d3"
9895+
integrity sha512-kr/Oo6PX51265qeuCYsyGypiO5uJFgBS0jksyG7FUeCyQzNwYnzrNIMR1NXfkZXsMYXYLRAHgISHBz8gQcxKHQ==
9896+
dependencies:
9897+
"@nodelib/fs.stat" "^2.0.2"
9898+
"@nodelib/fs.walk" "^1.2.3"
9899+
glob-parent "^5.1.0"
9900+
merge2 "^1.3.0"
9901+
micromatch "^4.0.2"
9902+
picomatch "^2.2.1"
9903+
98449904
fast-json-stable-stringify@2.1.0, fast-json-stable-stringify@2.x, fast-json-stable-stringify@^2.0.0:
98459905
version "2.1.0"
98469906
resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz#874bf69c6f404c2b5d99c481341399fd55892633"
@@ -10592,7 +10652,7 @@ glob-parent@^3.1.0:
1059210652
is-glob "^3.1.0"
1059310653
path-dirname "^1.0.0"
1059410654

10595-
glob-parent@^5.0.0, glob-parent@^5.1.0, glob-parent@~5.1.0:
10655+
glob-parent@^5.0.0, glob-parent@^5.1.0, glob-parent@^5.1.1, glob-parent@~5.1.0:
1059610656
version "5.1.1"
1059710657
resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.1.tgz#b6c1ef417c4e5663ea498f1c45afac6916bbc229"
1059810658
integrity sha512-FnI+VGOpnlGHWZxthPGR+QhR78fuiK0sNLkHQv+bL9fQi57lNNdquIbna/WrfROrolq8GK5Ek6BiMwqL/voRYQ==
@@ -10778,6 +10838,18 @@ globby@8.0.2, globby@^8.0.1:
1077810838
pify "^3.0.0"
1077910839
slash "^1.0.0"
1078010840

10841+
globby@^11.0.1:
10842+
version "11.0.1"
10843+
resolved "https://registry.yarnpkg.com/globby/-/globby-11.0.1.tgz#9a2bf107a068f3ffeabc49ad702c79ede8cfd357"
10844+
integrity sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==
10845+
dependencies:
10846+
array-union "^2.1.0"
10847+
dir-glob "^3.0.1"
10848+
fast-glob "^3.1.1"
10849+
ignore "^5.1.4"
10850+
merge2 "^1.3.0"
10851+
slash "^3.0.0"
10852+
1078110853
globby@^5.0.0:
1078210854
version "5.0.0"
1078310855
resolved "https://registry.yarnpkg.com/globby/-/globby-5.0.0.tgz#ebd84667ca0dbb330b99bcfc68eac2bc54370e0d"
@@ -14003,6 +14075,13 @@ lru-cache@5.1.1, lru-cache@^5.1.1:
1400314075
dependencies:
1400414076
yallist "^3.0.2"
1400514077

14078+
lru-cache@^6.0.0:
14079+
version "6.0.0"
14080+
resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz#6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94"
14081+
integrity sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==
14082+
dependencies:
14083+
yallist "^4.0.0"
14084+
1400614085
lru-queue@0.1:
1400714086
version "0.1.0"
1400814087
resolved "https://registry.yarnpkg.com/lru-queue/-/lru-queue-0.1.0.tgz#2738bd9f0d3cf4f84490c5736c48699ac632cda3"
@@ -15655,6 +15734,13 @@ p-limit@^2.0.0, p-limit@^2.2.0, p-limit@^2.2.1, p-limit@^2.2.2, p-limit@^2.3.0:
1565515734
dependencies:
1565615735
p-try "^2.0.0"
1565715736

15737+
p-limit@^3.0.1:
15738+
version "3.0.2"
15739+
resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-3.0.2.tgz#1664e010af3cadc681baafd3e2a437be7b0fb5fe"
15740+
integrity sha512-iwqZSOoWIW+Ew4kAGUlN16J4M7OB3ysMLSZtnhmqx7njIHFPlxWBX8xo3lVTyFVq6mI/lL9qt2IsN1sHwaxJkg==
15741+
dependencies:
15742+
p-try "^2.0.0"
15743+
1565815744
p-locate@^2.0.0:
1565915745
version "2.0.0"
1566015746
resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-2.0.0.tgz#20a0103b222a70c8fd39cc2e580680f3dde5ec43"
@@ -18774,7 +18860,7 @@ schema-utils@^1.0.0:
1877418860
ajv-errors "^1.0.0"
1877518861
ajv-keywords "^3.1.0"
1877618862

18777-
schema-utils@^2.0.0, schema-utils@^2.0.1, schema-utils@^2.5.0, schema-utils@^2.6.0, schema-utils@^2.6.1, schema-utils@^2.6.4, schema-utils@^2.6.5, schema-utils@^2.6.6:
18863+
schema-utils@^2.0.0, schema-utils@^2.0.1, schema-utils@^2.5.0, schema-utils@^2.6.0, schema-utils@^2.6.1, schema-utils@^2.6.4, schema-utils@^2.6.5, schema-utils@^2.6.6, schema-utils@^2.7.0:
1877818864
version "2.7.0"
1877918865
resolved "https://registry.yarnpkg.com/schema-utils/-/schema-utils-2.7.0.tgz#17151f76d8eae67fbbf77960c33c676ad9f4efc7"
1878018866
integrity sha512-0ilKFI6QQF5nxDZLFn2dMjvc4hjg/Wkg7rHd3jK6/A4a1Hl9VFdQWvgB1UMGoU94pad1P/8N7fMcEnLnSiju8A==
@@ -18914,6 +19000,13 @@ serialize-javascript@^3.0.0:
1891419000
dependencies:
1891519001
randombytes "^2.1.0"
1891619002

19003+
serialize-javascript@^4.0.0:
19004+
version "4.0.0"
19005+
resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-4.0.0.tgz#b525e1238489a5ecfc42afacc3fe99e666f4b1aa"
19006+
integrity sha512-GaNA54380uFefWghODBWEGisLZFj00nS5ACs6yHa9nLqlLpVLO8ChDGeKRjZnV4Nh4n0Qi7nhYZD/9fCPzEqkw==
19007+
dependencies:
19008+
randombytes "^2.1.0"
19009+
1891719010
serve-favicon@^2.5.0:
1891819011
version "2.5.0"
1891919012
resolved "https://registry.yarnpkg.com/serve-favicon/-/serve-favicon-2.5.0.tgz#935d240cdfe0f5805307fdfe967d88942a2cbcf0"

0 commit comments

Comments
 (0)
Please sign in to comment.