Infrastructure/verdaccio
0
Fork 0
mirror of https://github.com/verdaccio/verdaccio.git synced 2025-01-20 22:52:46 -05:00
Code Issues Activity

adding __proto__ to package name blacklist

Browse source
This commit is contained in:
Alex Kocharin 2013-09-27 13:20:38 +04:00
parent 361d653613
commit ac2ea00b2b
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/utils.js
View file

@ -3,11 +3,13 @@ var URL = require('url');
// from normalize-package-data/lib/fixer.js // from normalize-package-data/lib/fixer.js
module.exports.validate_name = function(name) { module.exports.validate_name = function(name) {
name = name.toLowerCase();
if ( if (
name.charAt(0) === "." || name.charAt(0) === "." || // ".bin", etc.
name.match(/[\/@\s\+%:]/) || name.match(/[\/@\s\+%:]/) ||
name !== encodeURIComponent(name) || name !== encodeURIComponent(name) ||
name.toLowerCase() === "node_modules" || name.toLowerCase() === "node_modules" ||
name.toLowerCase() === "__proto__" ||
name.toLowerCase() === "favicon.ico" name.toLowerCase() === "favicon.ico"
) { ) {
return false; return false;