Source: highlight.js Version: 10.7.3+dfsg-5 Severity: grave Justification: renders package unusable Tags: patch X-Debbugs-Cc: [email protected], [email protected]
Dear Maintainer,
Debian provided deep-freeze-es6 (under debian/build_modules) breaks freezing
nested objects, by recursively freezing properties of an object without first
checking if a property object has already been frozen, causing errors such as:
Uncaught TypeError: "begin" is read-only
deepFreeze http://localhost:3000/highlight-1bbf5e38.js:16
HLJS http://localhost:3000/highlight-1bbf5e38.js:2493
hljs http://localhost:3000/highlight-1bbf5e38.js:2508
<anonymous> http://localhost:3000/highlight-1bbf5e38.js:2512
In this concrete example, APOS_STRING_MODE first gets frozen. Due to
aforementioned problem, APOS_STRING_MODE.contains.0, which is BACKSLASH_ESCAPE,
is also frozen. Then, later when BACKSLASH_ESCAPE itself gets frozen again (or
maybe being frozen again as something else's .contains.0, or maybe in a reverse
order), this error is thrown.
Upstream uses a `!Object.isFrozen(prop)` check to avoid this problem, see
https://github.com/christophehurpeau/deep-freeze-es6/blob/c1b69815/lib/index.js#L49
The fix is simple:
diff --git a/debian/build_modules/deep-freeze-es6/index.js
b/debian/build_modules/deep-freeze-es6/index.js
index 50ef5d2..47c87de 100644
--- a/debian/build_modules/deep-freeze-es6/index.js
+++ b/debian/build_modules/deep-freeze-es6/index.js
@@ -5,7 +5,9 @@ export function deepFreeze(obj) {
// On gèle les propriétés avant de geler l'objet
for (let name of propNames) {
let value = obj[name];
- obj[name] = value && typeof value === "object" ? deepFreeze(value) : value;
+ if ((typeof value === "object" || typeof value === "function") &&
!Object.isFrozen(value)) {
+ deepFreeze(value)
+ }
}
// On gèle l'objet initial
--
,Sdrager
Blair Noctis
🇵🇸
signature.asc
Description: PGP signature
