diff mbox series

[kirkstone,15/28] meta: lib: oe: npm_registry: Add more safe caracters

Message ID d3c1638077d4acbd61e7770c8e1d299ea33df638.1688655871.git.steve@sakoman.com
State New, archived
Headers show
Series [kirkstone,01/28] go: fix CVE-2023-29400 html/template improper handling of empty HTML attributes | expand

Commit Message

Steve Sakoman July 6, 2023, 3:06 p.m. UTC 
From: BELOUARGA Mohamed <m.belouarga@technologyandstrategy.com>

NPM registry cache should support caracaters like '(' and ')'
Explanation: NPM packages can contains these caracters like : @(._.)/execute

Signed-off-by: BELOUARGA Mohamed <m.belouarga@technologyandstrategy.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 6110d9e24e43e286781afd1b3634a4ad1a2050d0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/lib/oe/npm_registry.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/lib/oe/npm_registry.py b/meta/lib/oe/npm_registry.py
index 96c0affb45..3f70e4f5c8 100644
--- a/meta/lib/oe/npm_registry.py
+++ b/meta/lib/oe/npm_registry.py
@@ -5,7 +5,7 @@  import subprocess
 _ALWAYS_SAFE = frozenset('ABCDEFGHIJKLMNOPQRSTUVWXYZ'
                          'abcdefghijklmnopqrstuvwxyz'
                          '0123456789'
-                         '_.-~')
+                         '_.-~()')
 
 MISSING_OK = object()