shinate / gulp-version-number Goto Github PK

High Command Injection
Package fs-path
Patched in No patch available
Dependency of gulp-version-number
Path gulp-version-number > fs-path
More info https://nodesecurity.io/advisories/661

Wondering if it's possible to target metadata such as <link> and <meta>.
I have these two cases:

<link rel="icon" href="/img/favicon.png">
<meta property="og:image" content="/img/share.png">

Thanks.

Hi I'm trying to have the ?v= string applied just to one of the js included in index.html, how could I do?
This way produce error

const $ = gulpLoadPlugins();
const versionConfig = {
'value': '%MDS%',
'append': {
'key': 'v',
'to': ['css', 'script1.js'],
},
};

if (_RULE[1]) {
^

TypeError: Cannot read property '1' of null
at Object.css (/var/www/html/project/node_modules/gulp-version-number/index.js:215:30)
at apply_append (/var/www/html/project/node_modules/gulp-version-number/index.js:200:46)
at /var/www/html/project/node_modules/gulp-version-number/index.js:309:51
at FSReqWrap.readFileAfterClose [as oncomplete] (fs.js:528:3)

Hi, i use gulp-version-number-0.1.7

Source:
<script src="<TMPL_VAR cdn_url>/js/embed.min.js"></script>

Result:
<script src="<TMPL_VAR cdn_url?v=0757b5c1a2b89ddc5a8ef49f1d17795d>/js/embed.min.js"></script>

Assert:
<script src="<TMPL_VAR cdn_url>/js/embed.min.js?v=0757b5c1a2b89ddc5a8ef49f1d17795d"></script>

How to fix this behavior?

Hello and thanks for a great utility - I wouldn't have been sure my approach to versioning is correct without it.

I'm running into an exception when it tries to replace an AngularJS directive though:

<img-crop/>

caused by this line:

var sts = content.match(/<img[^&gt;]*>/g);

Maybe this matching and the other similar lines can benefit from a space after the tag name, correct me if I'm wrong.

I found out that:

<link ng-href="themes/{{theme||'default'}}/css/style.css" rel="stylesheet" onerror="this.href='themes/experter/css/style.css'">

is being parsed as:

<link ng-href="themes/{{theme||?v=44edd1b317271634126140a94694357b'default'}}/css/style.css" rel="stylesheet" onerror="this.href='themes/experter/css/style.css'">

which is not the expected output. The expected output should be:

<link ng-href="themes/{{theme||'default'}}/css/style.css?v=44edd1b317271634126140a94694357b" rel="stylesheet" onerror="this.href='themes/default/css/style.css?v=44edd1b317271634126140a94694357b''">

I'm using version 0.1.7, using the version config as shown below:

const versionConfig = {
    'value': '%MDS%',
    'append': {
        'key': 'v',
        'to': ['js', 'css', 'sass'],
    },
};

It seems to get confused between php closing tag ?>,

gulp.src('src/*')
.pipe(version({
    value: 'v1.0.0',
    replaces: [
        /#version#/g
    ]
}))
.pipe(gulp.dest('dist'));

v1.0.0 will be with V1.0.0 in dest file. All alphabet in version string will be change to uppercase.
Please retain original version string.

index.js#L86