4 Commits

Include renames

Author	SHA1	Message	Date
Fabrice Fontaine	fe522b9c17	package/jszip: security bump to version 3.10.0 ... - Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. - Drop patch (already in version) - Update hash of license file (dual licensing clarification with https://github.com/Stuk/jszip/commit/f81c2d700d8e5fec4ed89fb565e4a266bb4dd26e) - Update indentation in hash file (two spaces) https://github.com/Stuk/jszip/blob/v3.10.0/CHANGES.md Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>	2022-07-27 12:14:12 +02:00
Fabrice Fontaine	d55535622f	package/jszip: add JSZIP_CPE_ID_VENDOR ... cpe:2.3:a:jszip_project:jszip is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ajszip_project%3Ajszip Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>	2021-08-15 16:52:23 +02:00
Fabrice Fontaine	921830e92d	package/jszip: fix CVE-2021-23413 ... This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>	2021-08-12 23:54:48 +02:00
Joeri Barbarien	e879e007c6	package/jszip: new package ... Signed-off-by: Joeri Barbarien <joeri.barbarien@nokia.com> Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>	2021-01-02 11:31:58 +01:00