Prettier 0.17.0 released on February 14, 2017, introduces a few key updates compared to its predecessor, version 0.16.0, released just over a week earlier on February 6, 2017. Both versions serve as opinionated JavaScript formatters, designed to automatically enforce consistent code styling. The core functionality remains the same, aiming to improve code readability and maintainability across projects.
However, looking closely at the dependencies and devDependencies unveils the changes. Prettier 0.17.0 adds chalk as a direct dependency, and diff to the devDependencies. The addition of chalk likely facilitates more visually appealing command-line output, potentially adding color to highlight changes or errors during the formatting process. The diff package in devDependencies facilitates the improvement of the test suite providing functionality for more detailed comparison during testing.
The rest of the core dependencies, including glob, babylon, esutils, minimist, ast-types, get-stdin, flow-parser, jest-validate, and babel-code-frame, remain consistent between the two versions, suggesting that the fundamental parsing and code manipulation logic is unchanged. Similarly, the development dependencies related to building and testing (like jest, rollup and associated plugins) also remain constant.
For developers, upgrading to 0.17.0 offers potentially enhanced command-line output via chalk which can improve user experience, especially when working with larger codebases or in environments where visual cues are helpful for debugging. The new addition of diff package ensures higher quality tests.
All the vulnerabilities related to the version 0.17.0 of the package
Prototype Pollution in minimist
Affected versions of minimist
are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object
, causing the addition or modification of an existing property that will exist on all objects.
Parsing the argument --__proto__.y=Polluted
adds a y
property with value Polluted
to all objects. The argument --__proto__=Polluted
raises and uncaught error and crashes the application.
This is exploitable if attackers have control over the arguments being passed to minimist
.
Upgrade to versions 0.2.1, 1.2.3 or later.
Prototype Pollution in minimist
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js
, function setKey()
(lines 69-95).