Skip to content

Commit fadfa5d

Browse files
committed
2.0.0, remove the 'method' operator
1 parent 8b5e56b commit fadfa5d

File tree

4 files changed

+10
-39
lines changed

4 files changed

+10
-39
lines changed

CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Change Log
2+
3+
## 2.0.0
4+
5+
Major version bump because we're removing the `method` operation. The [NPM advisory 1542](https://www.npmjs.com/advisories/1542) shows that an attacker can supply a JsonLogic rule that will execute arbitrary code in the client of anyone who executes that rule with any data.
6+
7+
## 1.2.3
8+
9+
Cleaned up JsonLogic's behavior when the `data` parameter is not an object, especially when it's falsy. Resolves PRs [88](https://github.com/jwadhams/json-logic-js/pull/88) and [89](https://github.com/jwadhams/json-logic-js/pull/89), but more importantly makes the `var` operator more resilient.

logic.js

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -170,10 +170,6 @@ http://ricostacruz.com/cheatsheets/umdjs.html
170170
return are_missing;
171171
}
172172
},
173-
"method": function(obj, method, args) {
174-
return obj[method].apply(obj, args);
175-
},
176-
177173
};
178174

179175
jsonLogic.is_logic = function(logic) {

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "json-logic-js",
3-
"version": "1.2.3",
3+
"version": "2.0.0",
44
"description": "Build complex rules, serialize them as JSON, and execute them in JavaScript",
55
"main": "logic.js",
66
"directories": {

tests/tests.js

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -204,40 +204,6 @@ QUnit.test( "Expanding functionality with add_operator", function( assert) {
204204

205205
});
206206

207-
QUnit.test( "Expanding functionality with method", function( assert) {
208-
// Data contains a real object with methods and local state
209-
var a = {
210-
count: 0,
211-
increment: function() {
212-
return this.count += 1;
213-
},
214-
add: function(b) {
215-
return this.count += b;
216-
},
217-
};
218-
219-
// Look up "a" in data, and run the increment method on it with no args.
220-
assert.equal(
221-
jsonLogic.apply(
222-
{"method": [{"var": "a"}, "increment"]},
223-
{"a": a}
224-
),
225-
1 // Happy return value
226-
);
227-
assert.equal(a.count, 1); // Happy state change
228-
229-
// Run the add method with an argument
230-
assert.equal(
231-
jsonLogic.apply(
232-
{"method": [{"var": "a"}, "add", [41]]},
233-
{"a": a}
234-
),
235-
42 // Happy return value
236-
);
237-
assert.equal(a.count, 42); // Happy state change
238-
});
239-
240-
241207
QUnit.test("Control structures don't eval depth-first", function(assert) {
242208
// Depth-first recursion was wasteful but not harmful until we added custom operations that could have side-effects.
243209

0 commit comments

Comments
 (0)