14591086771

Committed 22 Apr 2025 09:07AM UTC coverage: 87.071% (-7.1%) from 94.191%

Build Type

push

github

Committed by Jae Sung Park

Commit Message

fix(core): Fix potential security vulnerability

Add prevention for prototype pollution, by enforcing
options objects to not extend nor chaining Object.prototype

Fix #3975

Run Details

5626 of 6953 branches covered (80.91%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 3 files covered. (100.0%)

389 existing lines in 27 files now uncovered.

7446 of 8060 relevant lines covered (92.38%)

11838.6 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

92.98

/src/ChartInternal/internals/transform.ts

/**
 * Copyright (c) 2017 ~ present NAVER Corp.
 * billboard.js project is licensed under the MIT license
 */
import {$ARC, $AXIS} from "../../config/classes";
import {asHalfPixel} from "../../module/util";

type TranslateParam = "main" | "context" | "legend" | "x" | "y" | "y2" | "subX" | "arc" | "radar"
        | "polar";

export default {
        getTranslate(target: TranslateParam, index = 0): string {
                const $$ = this;
                const {config, state} = $$;
                const isRotated = config.axis_rotated;
                let padding = 0;
                let x;
                let y;

                if (index && /^(x|y2?)$/.test(target)) {
                        padding = $$.getAxisSize(target) * index;
                }

                if (target === "main") {
                        x = asHalfPixel(state.margin.left);
                        y = asHalfPixel(state.margin.top);
                } else if (target === "context") {
                        x = asHalfPixel(state.margin2.left);
                        y = asHalfPixel(state.margin2.top);
                } else if (target === "legend") {
                        x = state.margin3.left;
                        y = state.margin3.top;
                } else if (target === "x") {
                        x = isRotated ? -padding : 0;
                        y = isRotated ? 0 : state.height + padding;
                } else if (target === "y") {
                        x = isRotated ? 0 : -padding;
                        y = isRotated ? state.height + padding : 0;
                } else if (target === "y2") {
                        x = isRotated ? 0 : state.width + padding;
                        y = isRotated ? -padding - 1 : 0;
                } else if (target === "subX") {
                        x = 0;
                        y = isRotated ? 0 : state.height2;
                } else if (target === "arc") {
                        x = state.arcWidth / 2;
                        y = state.arcHeight / 2;

                        if (config.arc_rangeText_values?.length) {
                                y += 5 + ($$.hasType("gauge") && config.title_text ? 10 : 0);
                        }
                } else if (target === "polar") {
                        x = state.arcWidth / 2;
                        y = state.arcHeight / 2;
                } else if (target === "radar") {
                        const [width, height] = $$.getRadarSize();

                        x = state.width / 2 - width;
                        y = state.height / 2 - height;
                }

                return `translate(${x}, ${y})`;
        },

        transformMain(withTransition: boolean, transitions): void {
                const $$ = this;
                const {$el: {main}, $T} = $$;

                const xAxis = transitions?.axisX ?
                        transitions.axisX :
                        $T(main.select(`.${$AXIS.axisX}`), withTransition);

                const yAxis = transitions?.axisY ?
                        transitions.axisY :
                        $T(main.select(`.${$AXIS.axisY}`), withTransition);

                const y2Axis = transitions?.axisY2 ?
                        transitions.axisY2 :
                        $T(main.select(`.${$AXIS.axisY2}`), withTransition);

                $T(main, withTransition)
                        .attr("transform", $$.getTranslate("main"));

                xAxis.attr("transform", $$.getTranslate("x"));
                yAxis.attr("transform", $$.getTranslate("y"));
                y2Axis.attr("transform", $$.getTranslate("y2"));

                main.select(`.${$ARC.chartArcs}`)
                        .attr("transform", $$.getTranslate("arc"));
        },

        transformAll(withTransition: boolean, transitions): void {
                const $$ = this;
                const {config, state: {hasAxis, hasFunnel, hasTreemap}, $el} = $$;

                !hasFunnel && !hasTreemap && $$.transformMain(withTransition, transitions);

                hasAxis && config.subchart_show &&
                        $$.transformContext(withTransition, transitions);

                $el.legend && $$.transformLegend(withTransition);
        }
};

1	/**
2	* Copyright (c) 2017 ~ present NAVER Corp.
3	* billboard.js project is licensed under the MIT license
4	*/
5	import {$ARC, $AXIS} from "../../config/classes";
6	import {asHalfPixel} from "../../module/util";
7
8	type TranslateParam = "main" \| "context" \| "legend" \| "x" \| "y" \| "y2" \| "subX" \| "arc" \| "radar"
9	\| "polar";
10
11	export default {
12	getTranslate(target: TranslateParam, index = 0): string {	64,831✔
13	const $$ = this;	64,831✔
14	const {config, state} = $$;	64,831✔
15	const isRotated = config.axis_rotated;	64,831✔
16	let padding = 0;	64,831✔
17	let x;
18	let y;
19
20	if (index && /^(x\|y2?)$/.test(target)) {	64,831!
UNCOV 21	padding = $$.getAxisSize(target) * index;	×
22	}
23
24	if (target === "main") {	64,831✔
25	x = asHalfPixel(state.margin.left);	11,530✔
26	y = asHalfPixel(state.margin.top);	11,530✔
27	} else if (target === "context") {	53,301✔
28	x = asHalfPixel(state.margin2.left);	785✔
29	y = asHalfPixel(state.margin2.top);	785✔
30	} else if (target === "legend") {	52,516✔
31	x = state.margin3.left;	11,434✔
32	y = state.margin3.top;	11,434✔
33	} else if (target === "x") {	41,082✔
34	x = isRotated ? -padding : 0;	10,873✔
35	y = isRotated ? 0 : state.height + padding;	10,873✔
36	} else if (target === "y") {	30,209✔
37	x = isRotated ? 0 : -padding;	10,873✔
38	y = isRotated ? state.height + padding : 0;	10,873✔
39	} else if (target === "y2") {	19,336✔
40	x = isRotated ? 0 : state.width + padding;	9,061✔
41	y = isRotated ? -padding - 1 : 0;	9,061✔
42	} else if (target === "subX") {	10,275✔
43	x = 0;	785✔
44	y = isRotated ? 0 : state.height2;	785✔
45	} else if (target === "arc") {	9,490✔
46	x = state.arcWidth / 2;	9,385✔
47	y = state.arcHeight / 2;	9,385✔
48
49	if (config.arc_rangeText_values?.length) {	9,385✔
50	y += 5 + ($$.hasType("gauge") && config.title_text ? 10 : 0);	156!
51	}
52	} else if (target === "polar") {	105!
53	x = state.arcWidth / 2;	×
54	y = state.arcHeight / 2;	×
55	} else if (target === "radar") {	105!
56	const [width, height] = $$.getRadarSize();	105✔
57
58	x = state.width / 2 - width;	105✔
59	y = state.height / 2 - height;	105✔
60	}
61
62	return `translate(${x}, ${y})`;	64,831✔
63	},
64
65	transformMain(withTransition: boolean, transitions): void {
66	const $$ = this;	8,818✔
67	const {$el: {main}, $T} = $$;	8,818✔
68
69	const xAxis = transitions?.axisX ?	8,818✔
70	transitions.axisX :
71	$T(main.select(`.${$AXIS.axisX}`), withTransition);
72
73	const yAxis = transitions?.axisY ?	8,818✔
74	transitions.axisY :
75	$T(main.select(`.${$AXIS.axisY}`), withTransition);
76
77	const y2Axis = transitions?.axisY2 ?	8,818✔
78	transitions.axisY2 :
79	$T(main.select(`.${$AXIS.axisY2}`), withTransition);
80
81	$T(main, withTransition)	8,818✔
82	.attr("transform", $$.getTranslate("main"));
83
84	xAxis.attr("transform", $$.getTranslate("x"));	8,818✔
85	yAxis.attr("transform", $$.getTranslate("y"));	8,818✔
86	y2Axis.attr("transform", $$.getTranslate("y2"));	8,818✔
87
88	main.select(`.${$ARC.chartArcs}`)	8,818✔
89	.attr("transform", $$.getTranslate("arc"));
90	},
91
92	transformAll(withTransition: boolean, transitions): void {
93	const $$ = this;	9,085✔
94	const {config, state: {hasAxis, hasFunnel, hasTreemap}, $el} = $$;	9,085✔
95
96	!hasFunnel && !hasTreemap && $$.transformMain(withTransition, transitions);	9,085✔
97
98	hasAxis && config.subchart_show &&	9,085✔
99	$$.transformContext(withTransition, transitions);
100
101	$el.legend && $$.transformLegend(withTransition);	9,085✔
102	}
103	};

naver / billboard.js / 14591086771

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous