Repository navigation
Release 1.3.0 - #557
Merged
Merged
Release 1.3.0#557
Conversation
pace read inline options from the first element with a data-pace-options attribute anywhere on the page. On pages that render user-supplied HTML before pace runs, that let page content set pace's options: a __proto__ key (also nested) polluted Object.prototype, and className was inserted into the bar's HTML without escaping. - Inline options are read only from a <script> element. - Option merging skips __proto__, constructor and prototype keys. - The bar is built with DOM methods instead of an HTML string, which also lets pace run on pages that enforce Trusted Types. Advisory: GHSA-5fmc-v4p3-pqpg
Add a "style" field pointing to pace-theme-default.css. jsDelivr reads this field to find a package's CSS file, which it currently has to guess: https://github.com/jsdelivr/jsdelivr#configuring-a-default-file-in-packagejson
The build now copies the version from package.json into the header of
pace.js and pace-theme-default.css before minifying them, so the version
is edited only in package.json:
npm version <version> --no-git-tag-version && npm run build
The generated-files check in CI fails if a header doesn't match.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This releases 1.3.0. It fixes a security issue in how pace reads inline options; the advisory, GHSA-5fmc-v4p3-pqpg, is published together with the release.
Commits
data-pace-optionsis read only from a<script>element, as the README documents;__proto__,constructorandprototypekeys, also in nested options;tests/security.spec.mjs.stylefield in package.json, pointing topace-theme-default.css, so jsDelivr finds the CSS file without guessing.pace.jsandpace-theme-default.css. CI fails if they don't match.Behavior change:
data-pace-optionson any element other than a<script>is now ignored. To set options elsewhere, usewindow.paceOptionsbefore pace.js loads.How to verify
npm ci && npm testpasses.git checkout master -- pace.js pace.min.js && npx playwright test tests/security.spec.mjs(thengit checkout HEAD -- pace.js pace.min.js).npm run buildleaves no changes.npm pack --dry-runlistspace-js-1.3.0.tgzwith 172 files, the same files as 1.2.4.