2.0.3

minifyfromhtml.js

@@ -1,5 +1,6 @@
 let argv = require('minimist')(process.argv.slice(2));
 let fs = require('fs');
+let path = require('path');
 let Terser = require('terser');
 let CleanCSS = require('clean-css');
 let jsdom = require('jsdom');
@@ -71,8 +72,8 @@ readStdin(function(html) {
 				comments: false
 			},
 			sourceMap: {
-				filename: argv.js,
+				includeSources: true,
-				url: argv.js + '.map'
+				url: path.basename(outFile) + '.map'
 			}
 		};
 

node_modules/.bin/acorn

@@ -1,15 +1 @@
-#!/bin/sh
+../acorn/bin/acorn
-basedir=$(dirname "$(echo "$0" | sed -e 's,\\,/,g')")
-
-case `uname` in
-    *CYGWIN*|*MINGW*|*MSYS*) basedir=`cygpath -w "$basedir"`;;
-esac
-
-if [ -x "$basedir/node" ]; then
-  "$basedir/node"  "$basedir/../acorn/bin/acorn" "$@"
-  ret=$?
-else 
-  node  "$basedir/../acorn/bin/acorn" "$@"
-  ret=$?
-fi
-exit $ret

node_modules/acorn/dist/acorn.js

@@ -3206,7 +3206,8 @@
     if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
       return c
     }
-    return (c << 10) + s.charCodeAt(i + 1) - 0x35FDC00
+    var next = s.charCodeAt(i + 1);
+    return next >= 0xDC00 && next <= 0xDFFF ? (c << 10) + next - 0x35FDC00 : c
   };
 
   RegExpValidationState.prototype.nextIndex = function nextIndex (i) {
@@ -3215,8 +3216,9 @@
     if (i >= l) {
       return l
     }
-    var c = s.charCodeAt(i);
+    var c = s.charCodeAt(i), next;
-    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
+    if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l ||
+        (next = s.charCodeAt(i + 1)) < 0xDC00 || next > 0xDFFF) {
       return i + 1
     }
     return i + 2

node_modules/acorn/dist/acorn.mjs

@@ -3200,7 +3200,8 @@ RegExpValidationState.prototype.at = function at (i) {
   if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
     return c
   }
-  return (c << 10) + s.charCodeAt(i + 1) - 0x35FDC00
+  var next = s.charCodeAt(i + 1);
+  return next >= 0xDC00 && next <= 0xDFFF ? (c << 10) + next - 0x35FDC00 : c
 };
 
 RegExpValidationState.prototype.nextIndex = function nextIndex (i) {
@@ -3209,8 +3210,9 @@ RegExpValidationState.prototype.nextIndex = function nextIndex (i) {
   if (i >= l) {
     return l
   }
-  var c = s.charCodeAt(i);
+  var c = s.charCodeAt(i), next;
-  if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l) {
+  if (!this.switchU || c <= 0xD7FF || c >= 0xE000 || i + 1 >= l ||
+      (next = s.charCodeAt(i + 1)) < 0xDC00 || next > 0xDFFF) {
     return i + 1
   }
   return i + 2

node_modules/acorn/package.json

@@ -1,28 +1,28 @@
 {
-  "_from": "acorn@^6.0.4",
+  "_from": "acorn@6.4.1",
-  "_id": "acorn@6.4.0",
+  "_id": "acorn@6.4.1",
   "_inBundle": false,
-  "_integrity": "sha512-gac8OEcQ2Li1dxIEWGZzsp2BitJxwkwcOm0zHAJLcPJaVvm58FRnk6RkuLRpU1EujipU2ZFODv2P9DLMfnV8mw==",
+  "_integrity": "sha512-ZVA9k326Nwrj3Cj9jlh3wGFutC2ZornPNARZwsNYqQYgN0EsV2d53w5RN/co65Ohn4sUAUtb1rSUAOD6XN9idA==",
   "_location": "/acorn",
   "_phantomChildren": {},
   "_requested": {
-    "type": "range",
+    "type": "version",
     "registry": true,
-    "raw": "acorn@^6.0.4",
+    "raw": "acorn@6.4.1",
     "name": "acorn",
     "escapedName": "acorn",
-    "rawSpec": "^6.0.4",
+    "rawSpec": "6.4.1",
     "saveSpec": null,
-    "fetchSpec": "^6.0.4"
+    "fetchSpec": "6.4.1"
   },
   "_requiredBy": [
     "/acorn-globals",
     "/jsdom"
   ],
-  "_resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.0.tgz",
+  "_resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.1.tgz",
-  "_shasum": "b659d2ffbafa24baf5db1cdbb2c94a983ecd2784",
+  "_shasum": "531e58ba3f51b9dacb9a6646ca4debf5b14ca474",
-  "_spec": "acorn@^6.0.4",
+  "_spec": "acorn@6.4.1",
-  "_where": "F:\\projects\\p\\minifyfromhtml\\node_modules\\jsdom",
+  "_where": "/home/s2/Code/minifyfromhtml/node_modules/jsdom",
   "bin": {
     "acorn": "bin/acorn"
   },
@@ -63,5 +63,5 @@
   "scripts": {
     "prepare": "cd ..; npm run build:main && npm run build:bin"
   },
-  "version": "6.4.0"
+  "version": "6.4.1"
 }

node_modules/minimist/example/parse.js

@@ -1,2 +1,2 @@
 var argv = require('../')(process.argv.slice(2));
-console.dir(argv);
+console.log(argv);

node_modules/minimist/index.js

@@ -68,12 +68,21 @@ module.exports = function (args, opts) {
 
     function setKey (obj, keys, value) {
         var o = obj;
-        keys.slice(0,-1).forEach(function (key) {
+        for (var i = 0; i < keys.length-1; i++) {
+            var key = keys[i];
+            if (key === '__proto__') return;
             if (o[key] === undefined) o[key] = {};
+            if (o[key] === Object.prototype || o[key] === Number.prototype
+                || o[key] === String.prototype) o[key] = {};
+            if (o[key] === Array.prototype) o[key] = [];
             o = o[key];
-        });
+        }
 
         var key = keys[keys.length - 1];
+        if (key === '__proto__') return;
+        if (o === Object.prototype || o === Number.prototype
+            || o === String.prototype) o = {};
+        if (o === Array.prototype) o = [];
         if (o[key] === undefined || flags.bools[key] || typeof o[key] === 'boolean') {
             o[key] = value;
         }
@@ -171,7 +180,7 @@ module.exports = function (args, opts) {
                     setArg(key, args[i+1], arg);
                     i++;
                 }
-                else if (args[i+1] && /true|false/.test(args[i+1])) {
+                else if (args[i+1] && /^(true|false)$/.test(args[i+1])) {
                     setArg(key, args[i+1] === 'true', arg);
                     i++;
                 }

node_modules/minimist/package.json

@@ -1,27 +1,27 @@
 {
-  "_from": "minimist@^1.2.0",
+  "_from": "minimist@^1.2.2",
-  "_id": "minimist@1.2.0",
+  "_id": "minimist@1.2.5",
   "_inBundle": false,
-  "_integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
+  "_integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
   "_location": "/minimist",
   "_phantomChildren": {},
   "_requested": {
     "type": "range",
     "registry": true,
-    "raw": "minimist@^1.2.0",
+    "raw": "minimist@^1.2.2",
     "name": "minimist",
     "escapedName": "minimist",
-    "rawSpec": "^1.2.0",
+    "rawSpec": "^1.2.2",
     "saveSpec": null,
-    "fetchSpec": "^1.2.0"
+    "fetchSpec": "^1.2.2"
   },
   "_requiredBy": [
     "/"
   ],
-  "_resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+  "_resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-  "_shasum": "a35008b20f41383eec1fb914f4cd5df79a264284",
+  "_shasum": "67d66014b66a6a8aaa0c083c5fd58df4e4e97602",
-  "_spec": "minimist@^1.2.0",
+  "_spec": "minimist@^1.2.2",
-  "_where": "F:\\projects\\p\\minifyfromhtml",
+  "_where": "/home/s2/Code/minifyfromhtml",
   "author": {
     "name": "James Halliday",
     "email": "mail@substack.net",
@@ -69,5 +69,5 @@
       "opera/12"
     ]
   },
-  "version": "1.2.0"
+  "version": "1.2.5"
 }

node_modules/minimist/readme.markdown

@@ -5,15 +5,11 @@ parse argument options
 This module is the guts of optimist's argument parser without all the
 fanciful decoration.
 
-[![browser support](https://ci.testling.com/substack/minimist.png)](http://ci.testling.com/substack/minimist)
-
-[![build status](https://secure.travis-ci.org/substack/minimist.png)](http://travis-ci.org/substack/minimist)
-
 # example
 
 ``` js
 var argv = require('minimist')(process.argv.slice(2));
-console.dir(argv);
+console.log(argv);
 ```
 
 ```
@@ -33,6 +29,13 @@ $ node example/parse.js -x 3 -y 4 -n5 -abc --beep=boop foo bar baz
   beep: 'boop' }
 ```
 
+# security
+
+Previous versions had a prototype pollution bug that could cause privilege
+escalation in some circumstances when handling untrusted user input.
+
+Please use version 1.2.3 or later: https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
+
 # methods
 
 ``` js
@@ -65,19 +68,20 @@ argument names to use as aliases
 first non-option
 * `opts['--']` - when true, populate `argv._` with everything before the `--`
 and `argv['--']` with everything after the `--`. Here's an example:
+
+  ```
+  > require('./')('one two three -- four five --six'.split(' '), { '--': true })
+  { _: [ 'one', 'two', 'three' ],
+    '--': [ 'four', 'five', '--six' ] }
+  ```
+
+  Note that with `opts['--']` set, parsing for arguments still stops after the
+  `--`.
+
 * `opts.unknown` - a function which is invoked with a command line parameter not
 defined in the `opts` configuration object. If the function returns `false`, the
 unknown option is not added to `argv`.
 
-```
-> require('./')('one two three -- four five --six'.split(' '), { '--': true })
-{ _: [ 'one', 'two', 'three' ],
-  '--': [ 'four', 'five', '--six' ] }
-```
-
-Note that with `opts['--']` set, parsing for arguments still stops after the
-`--`.
-
 # install
 
 With [npm](https://npmjs.org) do:

node_modules/minimist/test/bool.js

@@ -164,3 +164,15 @@ test('boolean --boool=false', function (t) {
     t.same(parsed.boool, false);
     t.end();
 });
+
+test('boolean using something similar to true', function (t) {
+    var opts = { boolean: 'h' };
+    var result = parse(['-h', 'true.txt'], opts);
+    var expected = {
+        h: true,
+        '_': ['true.txt']
+    };
+
+    t.same(result, expected);
+    t.end();
+});

node_modules/minimist/test/proto.js

@@ -0,0 +1,44 @@
+var parse = require('../');
+var test = require('tape');
+
+test('proto pollution', function (t) {
+    var argv = parse(['--__proto__.x','123']);
+    t.equal({}.x, undefined);
+    t.equal(argv.__proto__.x, undefined);
+    t.equal(argv.x, undefined);
+    t.end();
+});
+
+test('proto pollution (array)', function (t) {
+    var argv = parse(['--x','4','--x','5','--x.__proto__.z','789']);
+    t.equal({}.z, undefined);
+    t.deepEqual(argv.x, [4,5]);
+    t.equal(argv.x.z, undefined);
+    t.equal(argv.x.__proto__.z, undefined);
+    t.end();
+});
+
+test('proto pollution (number)', function (t) {
+    var argv = parse(['--x','5','--x.__proto__.z','100']);
+    t.equal({}.z, undefined);
+    t.equal((4).z, undefined);
+    t.equal(argv.x, 5);
+    t.equal(argv.x.z, undefined);
+    t.end();
+});
+
+test('proto pollution (string)', function (t) {
+    var argv = parse(['--x','abc','--x.__proto__.z','def']);
+    t.equal({}.z, undefined);
+    t.equal('...'.z, undefined);
+    t.equal(argv.x, 'abc');
+    t.equal(argv.x.z, undefined);
+    t.end();
+});
+
+test('proto pollution (constructor)', function (t) {
+    var argv = parse(['--constructor.prototype.y','123']);
+    t.equal({}.y, undefined);
+    t.equal(argv.y, undefined);
+    t.end();
+});

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "minifyfromhtml",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -10,9 +10,9 @@
       "integrity": "sha512-tsFzPpcttalNjFBCFMqsKYQcWxxen1pgJR56by//QwvJc4/OUS3kPOOttx2tSIfjsylB0pYu7f5D3K1RCxUnUg=="
     },
     "acorn": {
-      "version": "6.4.0",
+      "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.0.tgz",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.1.tgz",
-      "integrity": "sha512-gac8OEcQ2Li1dxIEWGZzsp2BitJxwkwcOm0zHAJLcPJaVvm58FRnk6RkuLRpU1EujipU2ZFODv2P9DLMfnV8mw=="
+      "integrity": "sha512-ZVA9k326Nwrj3Cj9jlh3wGFutC2ZornPNARZwsNYqQYgN0EsV2d53w5RN/co65Ohn4sUAUtb1rSUAOD6XN9idA=="
     },
     "acorn-globals": {
       "version": "4.3.4",
@@ -406,9 +406,9 @@
       }
     },
     "minimist": {
-      "version": "1.2.0",
+      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ="
+      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw=="
     },
     "nwsapi": {
       "version": "2.2.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "minifyfromhtml",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "minify scripts and css starting from an html file",
   "main": "minifyfromhtml.js",
   "scripts": {
@@ -11,7 +11,7 @@
   "dependencies": {
     "clean-css": "^4.2.3",
     "jsdom": "^14.0.0",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.2",
     "terser": "^4.6.3"
   },
   "repository": {