|
| 1 | +From 960801d68f88b5f8a98d8384d97a92589f365509 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kanishk-Bansal <kbkanishk975@gmail.com> |
| 3 | +Date: Mon, 17 Feb 2025 12:38:27 +0000 |
| 4 | +Subject: [PATCH] Fix CVE-2020-24025 |
| 5 | +Upstream Patch Reference: https://github.com/sass/node-sass/pull/3149/commits/82e27620045e409746f051df36a7b8ff3b987f05 |
| 6 | + |
| 7 | +--- |
| 8 | + node-sass/scripts/util/downloadoptions.js | 5 ++- |
| 9 | + node-sass/scripts/util/rejectUnauthorized.js | 46 ++++++++++++++++++++ |
| 10 | + 2 files changed, 49 insertions(+), 2 deletions(-) |
| 11 | + create mode 100644 node-sass/scripts/util/rejectUnauthorized.js |
| 12 | + |
| 13 | +diff --git a/src/ui/node_modules/node-sass/scripts/util/downloadoptions.js b/src/ui/node_modules/node-sass/scripts/util/downloadoptions.js |
| 14 | +index 23529716..e9056b10 100644 |
| 15 | +--- a/src/ui/node_modules/node-sass/scripts/util/downloadoptions.js |
| 16 | ++++ b/src/ui/node_modules/node-sass/scripts/util/downloadoptions.js |
| 17 | +@@ -1,5 +1,6 @@ |
| 18 | + var proxy = require('./proxy'), |
| 19 | +- userAgent = require('./useragent'); |
| 20 | ++ userAgent = require('./useragent'), |
| 21 | ++ rejectUnauthorized = require('./rejectUnauthorized'); |
| 22 | + |
| 23 | + /** |
| 24 | + * The options passed to request when downloading the bibary |
| 25 | +@@ -14,7 +15,7 @@ var proxy = require('./proxy'), |
| 26 | + */ |
| 27 | + module.exports = function() { |
| 28 | + var options = { |
| 29 | +- rejectUnauthorized: false, |
| 30 | ++ rejectUnauthorized: rejectUnauthorized(), |
| 31 | + timeout: 60000, |
| 32 | + headers: { |
| 33 | + 'User-Agent': userAgent(), |
| 34 | +diff --git a/src/ui/node_modules/node-sass/scripts/util/rejectUnauthorized.js b/src/ui/node_modules/node-sass/scripts/util/rejectUnauthorized.js |
| 35 | +new file mode 100644 |
| 36 | +index 00000000..a1c80107 |
| 37 | +--- /dev/null |
| 38 | ++++ b/src/ui/node_modules/node-sass/scripts/util/rejectUnauthorized.js |
| 39 | +@@ -0,0 +1,46 @@ |
| 40 | ++var pkg = require('../../package.json'); |
| 41 | ++ |
| 42 | ++/** |
| 43 | ++ * Get the value of a CLI argument |
| 44 | ++ * |
| 45 | ++ * @param {String} name |
| 46 | ++ * @param {Array} args |
| 47 | ++ * @api private |
| 48 | ++ */ |
| 49 | ++ function getArgument(name, args) { |
| 50 | ++ var flags = args || process.argv.slice(2), |
| 51 | ++ index = flags.lastIndexOf(name); |
| 52 | ++ |
| 53 | ++ if (index === -1 || index + 1 >= flags.length) { |
| 54 | ++ return null; |
| 55 | ++ } |
| 56 | ++ |
| 57 | ++ return flags[index + 1]; |
| 58 | ++} |
| 59 | ++ |
| 60 | ++/** |
| 61 | ++ * Get the value of reject-unauthorized |
| 62 | ++ * If environment variable SASS_REJECT_UNAUTHORIZED is non-zero, |
| 63 | ++ * .npmrc variable sass_reject_unauthorized or |
| 64 | ++ * process argument --sass-reject_unauthorized is provided, |
| 65 | ++ * set rejectUnauthorized to true |
| 66 | ++ * Else set to false by default |
| 67 | ++ * |
| 68 | ++ * @return {Boolean} The value of rejectUnauthorized |
| 69 | ++ * @api private |
| 70 | ++ */ |
| 71 | ++module.exports = function() { |
| 72 | ++ var rejectUnauthorized = false; |
| 73 | ++ |
| 74 | ++ if (getArgument('--sass-reject-unauthorized')) { |
| 75 | ++ rejectUnauthorized = getArgument('--sass-reject-unauthorized'); |
| 76 | ++ } else if (process.env.SASS_REJECT_UNAUTHORIZED !== '0') { |
| 77 | ++ rejectUnauthorized = true; |
| 78 | ++ } else if (process.env.npm_config_sass_reject_unauthorized) { |
| 79 | ++ rejectUnauthorized = process.env.npm_config_sass_reject_unauthorized; |
| 80 | ++ } else if (pkg.nodeSassConfig && pkg.nodeSassConfig.rejectUnauthorized) { |
| 81 | ++ rejectUnauthorized = pkg.nodeSassConfig.rejectUnauthorized; |
| 82 | ++ } |
| 83 | ++ |
| 84 | ++ return rejectUnauthorized; |
| 85 | ++}; |
| 86 | +-- |
| 87 | +2.45.2 |
| 88 | + |
0 commit comments