1. 20 Sep, 2018 5 commits
  2. 19 Sep, 2018 7 commits
  3. 18 Sep, 2018 10 commits
  4. 17 Sep, 2018 13 commits
  5. 02 Sep, 2018 1 commit
  6. 24 Aug, 2018 1 commit
  7. 22 Aug, 2018 2 commits
    • Dan Abramov's avatar
      Bump versions · 96ba7bdd
      Dan Abramov authored
      96ba7bdd
    • Andrew Clark's avatar
      Use file name whitelist to prevent RCE (#4866) · 577a274d
      Andrew Clark authored
      * Use file name whitelist to prevent RCE
      
      Use a whitelist to validate user-provided file names. This doesn't cover
      the entire range of valid filenames but should cover almost all of them
      in practice. Allows letters, numbers, periods, dashes, and underscores.
      Opting to use a whitelist instead of a blacklist because getting this
      wrong leaves us vulnerable to a RCE attack.
      
      * Allow alphabet characters from all languages
      
      Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches
      alphanumeric characters, periods, dashes, and underscores. Unicode
      property support is stage 4 so I've inlined the transpiled version.
      
      * Only use file name whitelist on Windows
      
      * Log error message if file name does not pass whitelist
      577a274d
  8. 26 Jul, 2018 1 commit