kumquat-buildroot/package/jszip/jszip.mk

################################################################################
#
# jszip
#
################################################################################

JSZIP_VERSION = 3.2.2
JSZIP_SITE = $(call github,Stuk,jszip,v$(JSZIP_VERSION))
JSZIP_LICENSE = MIT or GPL-3.0
JSZIP_LICENSE_FILES = LICENSE.markdown
JSZIP_CPE_ID_VENDOR = jszip_project

# 0001-fix-Use-a-null-prototype-object-for-this-files.patch
JSZIP_IGNORE_CVES += CVE-2021-23413

define JSZIP_INSTALL_TARGET_CMDS
	$(INSTALL) -m 0644 -D $(@D)/dist/jszip.min.js \
		$(TARGET_DIR)/var/www/jszip/js/jszip.min.js
endef

$(eval $(generic-package))
package/jszip: new package Signed-off-by: Joeri Barbarien <joeri.barbarien@nokia.com> Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-12-08 19:05:24 +01:00			`################################################################################`
			`#`
			`# jszip`
			`#`
			`################################################################################`

			`JSZIP_VERSION = 3.2.2`
			`JSZIP_SITE = $(call github,Stuk,jszip,v$(JSZIP_VERSION))`
			`JSZIP_LICENSE = MIT or GPL-3.0`
			`JSZIP_LICENSE_FILES = LICENSE.markdown`
package/jszip: add JSZIP_CPE_ID_VENDOR cpe:2.3:a:jszip_project:jszip is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ajszip_project%3Ajszip Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2021-08-15 09:39:36 +02:00			`JSZIP_CPE_ID_VENDOR = jszip_project`
package/jszip: new package Signed-off-by: Joeri Barbarien <joeri.barbarien@nokia.com> Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-12-08 19:05:24 +01:00
package/jszip: fix CVE-2021-23413 This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2021-08-09 12:00:37 +02:00			`# 0001-fix-Use-a-null-prototype-object-for-this-files.patch`
			`JSZIP_IGNORE_CVES += CVE-2021-23413`

package/jszip: new package Signed-off-by: Joeri Barbarien <joeri.barbarien@nokia.com> Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2020-12-08 19:05:24 +01:00			`define JSZIP_INSTALL_TARGET_CMDS`
			`$(INSTALL) -m 0644 -D $(@D)/dist/jszip.min.js \`
			`$(TARGET_DIR)/var/www/jszip/js/jszip.min.js`
			`endef`

			`$(eval $(generic-package))`