Releases: janl/node-jsonpointer
Releases · janl/node-jsonpointer
Version 5.0.1
v5.0.0
5.0.0 (2021-10-31)
Bug Fixes
-
Fix prototype pollution (#51)
- The original, non-mutated objects are now returned if any of the keys
__proto__
,constructor
orprototype
are used in a json pointer.
// returns the unmodified input {} jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
- When passing non-string arrays to a
.set
operation, an error is thrown:
// throws `new Error('Invalid JSON pointer. Must be of type string or number.')` jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')
- The original, non-mutated objects are now returned if any of the keys
v4.1.0
Version 4.0.1
Whitelist production relevant files in package.json.
This decreases the npm package size a bit.
#26
Version 4.0.0
null
values now get set properly- deleting a property is now supported by using jsonpointer.set(obj, '/val', undefined)
BREAKING CHANGES
setting null values
When setting a null
value, it now gets set as actual value.
Previously we've deleted the property.
var obj = {foo: 'bar'}
jsonpointer.set(obj, '/foo', null)
// results in obj = {foo: null}
empty values
When getting a non-existent value, we previously returned null
.
We've now changed that to undefined
.
var obj = {}
jsonpointer.get(obj, '/foo')
// returns `undefined`
// with earlier versions, we've returned `null`
Version 3.0.1
Split getter & setter to improve readability and improve the performance
Version 3.0.0
Version 2.0.0
1.1.0
Merge pull request #9 from hildjj/master Return null when value not found
1.0.1
1.0.1