From 35ab329291f810febb80c08b498855b7832c93d9 Mon Sep 17 00:00:00 2001 From: Isiah Meadows Date: Mon, 23 Sep 2019 17:07:01 -0400 Subject: [PATCH] v1.1.7 --- mithril.js | 43 ++++++++++++++++------- mithril.min.js | 88 +++++++++++++++++++++++------------------------ package-lock.json | 2 +- package.json | 2 +- 4 files changed, 76 insertions(+), 59 deletions(-) diff --git a/mithril.js b/mithril.js index a70355a76..081096ffd 100644 --- a/mithril.js +++ b/mithril.js @@ -397,6 +397,15 @@ var coreRenderer = function($window) { function getNameSpace(vnode) { return vnode.attrs && vnode.attrs.xmlns || nameSpace[vnode.tag] } + // IE9 - IE11 (at least) throw an UnspecifiedError when accessing document.activeElement when + // inside an iframe. Catch and swallow this error0, and heavy-handidly return null. + function activeElement() { + try { + return $doc.activeElement + } catch (e) { + return null + } + } //create function createNodes(parent, vnodes, start, end, hooks, nextSibling, ns) { for (var i = start; i < end; i++) { @@ -850,13 +859,13 @@ var coreRenderer = function($window) { if (key2 === "value") { var normalized0 = "" + value // eslint-disable-line no-implicit-coercion //setting input[value] to same value by typing on focused element moves cursor to end in Chrome - if ((vnode.tag === "input" || vnode.tag === "textarea") && vnode.dom.value === normalized0 && vnode.dom === $doc.activeElement) return + if ((vnode.tag === "input" || vnode.tag === "textarea") && vnode.dom.value === normalized0 && vnode.dom === activeElement()) return //setting select[value] to same value while having select open blinks select dropdown in Chrome if (vnode.tag === "select") { if (value === null) { - if (vnode.dom.selectedIndex === -1 && vnode.dom === $doc.activeElement) return + if (vnode.dom.selectedIndex === -1 && vnode.dom === activeElement()) return } else { - if (old !== null && vnode.dom.value === normalized0 && vnode.dom === $doc.activeElement) return + if (old !== null && vnode.dom.value === normalized0 && vnode.dom === activeElement()) return } } //setting option[value] to same value while having select open blinks select dropdown in Chrome @@ -901,7 +910,7 @@ var coreRenderer = function($window) { } } function isFormAttribute(vnode, attr) { - return attr === "value" || attr === "checked" || attr === "selectedIndex" || attr === "selected" && vnode.dom === $doc.activeElement + return attr === "value" || attr === "checked" || attr === "selectedIndex" || attr === "selected" && vnode.dom === activeElement() } function isLifecycleMethod(attr) { return attr === "oninit" || attr === "oncreate" || attr === "onupdate" || attr === "onremove" || attr === "onbeforeremove" || attr === "onbeforeupdate" @@ -975,7 +984,7 @@ var coreRenderer = function($window) { function render(dom, vnodes) { if (!dom) throw new Error("Ensure the DOM element being passed to m.route/m.mount/m.render is not undefined.") var hooks = [] - var active = $doc.activeElement + var active = activeElement() var namespace = dom.namespaceURI // First time0 rendering into a node clears it out if (dom.vnodes == null) dom.textContent = "" @@ -983,7 +992,7 @@ var coreRenderer = function($window) { updateNodes(dom, dom.vnodes, Vnode.normalizeChildren(vnodes), false, hooks, null, namespace === "http://www.w3.org/1999/xhtml" ? undefined : namespace) dom.vnodes = vnodes // document.activeElement can return null in IE https://developer.mozilla.org/en-US/docs/Web/API/Document/activeElement - if (active != null && $doc.activeElement !== active) active.focus() + if (active != null && activeElement() !== active) active.focus() for (var i = 0; i < hooks.length; i++) hooks[i]() } return {render: render, setEventCallback: setEventCallback} @@ -1054,7 +1063,7 @@ var Promise = PromisePolyfill var parseQueryString = function(string) { if (string === "" || string == null) return {} if (string.charAt(0) === "?") string = string.slice(1) - var entries = string.split("&"), data0 = {}, counters = {} + var entries = string.split("&"), counters = {}, data0 = {} for (var i = 0; i < entries.length; i++) { var entry = entries[i].split("=") var key5 = decodeURIComponent(entry[0]) @@ -1067,16 +1076,24 @@ var parseQueryString = function(string) { for (var j = 0; j < levels.length; j++) { var level = levels[j], nextLevel = levels[j + 1] var isNumber = nextLevel == "" || !isNaN(parseInt(nextLevel, 10)) - var isValue = j === levels.length - 1 if (level === "") { var key5 = levels.slice(0, j).join() - if (counters[key5] == null) counters[key5] = 0 + if (counters[key5] == null) { + counters[key5] = Array.isArray(cursor) ? cursor.length : 0 + } level = counters[key5]++ } - if (cursor[level] == null) { - cursor[level] = isValue ? value : isNumber ? [] : {} + // Disallow direct prototype pollution + else if (level === "__proto__") break + if (j === levels.length - 1) cursor[level] = value + else { + // Read own properties exclusively to disallow indirect + // prototype pollution + var desc = Object.getOwnPropertyDescriptor(cursor, level) + if (desc != null) desc = desc.value + if (desc == null) cursor[level] = desc = isNumber ? [] : {} + cursor = desc } - cursor = cursor[level] } } return data0 @@ -1250,7 +1267,7 @@ m.request = requestService.request m.jsonp = requestService.jsonp m.parseQueryString = parseQueryString m.buildQueryString = buildQueryString -m.version = "1.1.6" +m.version = "1.1.7" m.vnode = Vnode if (typeof module !== "undefined") module["exports"] = m else window.m = m diff --git a/mithril.min.js b/mithril.min.js index 5595651be..01d43b13d 100644 --- a/mithril.min.js +++ b/mithril.min.js @@ -1,44 +1,44 @@ -(function(){function B(b,d,f,g,e,n){return{tag:b,key:d,attrs:f,children:g,text:e,dom:n,domSize:void 0,state:void 0,_state:void 0,events:void 0,instance:void 0,skip:!1}}function N(b){for(var d in b)if(G.call(b,d))return!1;return!0}function D(b){var d=arguments[1],f=2;if(null==b||"string"!==typeof b&&"function"!==typeof b&&"function"!==typeof b.view)throw Error("The selector must be either a string or a component.");if("string"===typeof b){var g;if(!(g=O[b])){var e="div";for(var n=[],h={};g=Q.exec(b);){var q= -g[1],m=g[2];""===q&&""!==m?e=m:"#"===q?h.id=m:"."===q?n.push(m):"["===g[3][0]&&((q=g[6])&&(q=q.replace(/\\(["'])/g,"$1").replace(/\\\\/g,"\\")),"class"===g[4]?n.push(q):h[g[4]]=""===q?q:q||!0)}0a.indexOf("?")?"?":"&";a+=f+d}return a}function h(a){try{return""!==a?JSON.parse(a):null}catch(w){throw Error(a);}}function q(a){return a.responseText}function m(a,b){if("function"===typeof a)if(Array.isArray(b))for(var d=0;dk.status||304===k.status||T.test(a.url))d(m(a.type,b));else{var l=Error(k.responseText),c;for(c in b)l[c]=b[c];f(l)}}catch(p){f(p)}};g&&null!=a.data?k.send(a.data):k.send()});return!0===a.background?w:t(w)},jsonp:function(a,h){var t=f();a=g(a,h);var q=new d(function(d,f){var g=a.callbackName||"_mithril_"+ -Math.round(1E16*Math.random())+"_"+k++,h=b.document.createElement("script");b[g]=function(f){h.parentNode.removeChild(h);d(m(a.type,f));delete b[g]};h.onerror=function(){h.parentNode.removeChild(h);f(Error("JSONP request failed"));delete b[g]};null==a.data&&(a.data={});a.url=e(a.url,a.data);a.data[a.callbackKey||"callback"]=g;h.src=n(a.url,a.data);b.document.documentElement.appendChild(h)});return!0===a.background?q:t(q)},setCompletionCallback:function(a){t=a}}}(window,x),P=function(b){function d(l, -c,p,a,b,d,g){for(;p=v&&y>=r;){var u=c[v],z=p[r];if(u!==z||b)if(null==u)v++;else if(null==z)r++;else if(u.key===z.key){var C=null!= -t&&v>=c.length-t.length||null==t&&b;v++;r++;h(l,u,z,g,m(c,v,e),C,n);b&&u.tag===z.tag&&k(l,q(u),e)}else if(u=c[w],u!==z||b)if(null==u)w--;else if(null==z)r++;else if(u.key===z.key)C=null!=t&&w>=c.length-t.length||null==t&&b,h(l,u,z,g,m(c,w+1,e),C,n),(b||r=v&&y>=r;){u=c[w];z=p[y];if(u!==z||b)if(null==u)w--;else{if(null!=z)if(u.key===z.key)C=null!=t&&w>=c.length-t.length||null==t&&b,h(l,u,z,g,m(c,w+1,e),C,n),b&&u.tag===z.tag&& -k(l,q(u),e),null!=u.dom&&(e=u.dom),w--;else{if(!H){H=c;u=w;C={};var A;for(A=0;Ab.indexOf("?")?"?":"&";b+=f+c}return b}function l(b){try{return""!==b?JSON.parse(b):null}catch(C){throw Error(b);}}function n(b){return b.responseText}function r(b,a){if("function"===typeof b)if(Array.isArray(a))for(var c=0;ch.status||304===h.status||U.test(b.url))c(r(b.type,a));else{var e=Error(h.responseText),k;for(k in a)e[k]=a[k];f(e)}}catch(d){f(d)}};g&&null!=b.data?h.send(b.data):h.send()});return!0===b.background?C:q(C)},jsonp:function(b,h){var n=g();b=f(b,h);var l=new c(function(c,f){var h=b.callbackName||"_mithril_"+ +Math.round(1E16*Math.random())+"_"+q++,g=a.document.createElement("script");a[h]=function(f){g.parentNode.removeChild(g);c(r(b.type,f));delete a[h]};g.onerror=function(){g.parentNode.removeChild(g);f(Error("JSONP request failed"));delete a[h]};null==b.data&&(b.data={});b.url=e(b.url,b.data);b.data[b.callbackKey||"callback"]=h;g.src=m(b.url,b.data);a.document.documentElement.appendChild(g)});return!0===b.background?l:n(l)},setCompletionCallback:function(b){h=b}}}(window,v),Q=function(a){function c(){try{return D.activeElement}catch(k){return null}} +function g(k,d,u,b,a,c,h){for(;u=u&&z>=p;){var x=d[u],t=b[p];if(x!==t||a)if(null==x)u++;else if(null==t)p++;else if(x.key===t.key){var B=null!= +l&&u>=d.length-l.length||null==l&&a;u++;p++;n(k,x,t,c,q(d,u,e),B,m);a&&x.tag===t.tag&&h(k,r(x),e)}else if(x=d[y],x!==t||a)if(null==x)y--;else if(null==t)p++;else if(x.key===t.key)B=null!=l&&y>=d.length-l.length||null==l&&a,n(k,x,t,c,q(d,y+1,e),B,m),(a||p=u&&z>=p;){x=d[y];t=b[z];if(x!==t||a)if(null==x)y--;else{if(null!=t)if(x.key===t.key)B=null!=l&&y>=d.length-l.length||null==l&&a,n(k,x,t,c,q(d,y+1,e),B,m),a&&x.tag===t.tag&& +h(k,r(x),e),null!=x.dom&&(e=x.dom),y--;else{if(!J){J=d;x=y;B={};var v;for(v=0;v