921830e92d
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
21 lines
584 B
Makefile
21 lines
584 B
Makefile
################################################################################
|
|
#
|
|
# jszip
|
|
#
|
|
################################################################################
|
|
|
|
JSZIP_VERSION = 3.2.2
|
|
JSZIP_SITE = $(call github,Stuk,jszip,v$(JSZIP_VERSION))
|
|
JSZIP_LICENSE = MIT or GPL-3.0
|
|
JSZIP_LICENSE_FILES = LICENSE.markdown
|
|
|
|
# 0001-fix-Use-a-null-prototype-object-for-this-files.patch
|
|
JSZIP_IGNORE_CVES += CVE-2021-23413
|
|
|
|
define JSZIP_INSTALL_TARGET_CMDS
|
|
$(INSTALL) -m 0644 -D $(@D)/dist/jszip.min.js \
|
|
$(TARGET_DIR)/var/www/jszip/js/jszip.min.js
|
|
endef
|
|
|
|
$(eval $(generic-package))
|