Skip to content

[Autofic] Security Patch 2025-07-18 #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eunsol1530 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

[Autofic] Security Patch 2025-07-18 #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b886116
[Autofic] Create package.json and CI workflow
Jul 17, 2025
d657e83
[Autofic] 19 malicious code detected!!
Jul 17, 2025
eaf778d
chore: remove CI workflow before upstream PR
Jul 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions platforms/android/cordova/lib/build.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,11 +35,11 @@ module.exports.run = function(build_type) {
switch(build_type) {
case '--debug' :
clean.run();
cmd = 'ant debug -f ' + path.join(ROOT, 'build.xml');
cmd = ['ant', 'debug', '-f', path.join(ROOT, 'build.xml')];
break;
case '--release' :
clean.run();
cmd = 'ant release -f ' + path.join(ROOT, 'build.xml');
cmd = ['ant', 'release', '-f', path.join(ROOT, 'build.xml')];
break;
case '--nobuild' :
console.log('Skipping build...');
Expand All @@ -50,7 +50,7 @@ module.exports.run = function(build_type) {
break;
}
if(cmd) {
var result = shell.exec(cmd, {silent:false, async:false});
var result = shell.exec(cmd.join(' '), {silent:false, async:false});
if(result.code > 0) {
console.error('ERROR: Failed to build android project.');
console.error(result.output);
Expand Down
7 changes: 6 additions & 1 deletion platforms/android/cordova/lib/clean.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,12 @@ var shell = require('shelljs'),
* Cleans the project using ant
*/
module.exports.run = function() {
var cmd = 'ant clean -f ' + path.join(ROOT, 'build.xml');
var buildFilePath = path.join(ROOT, 'build.xml');
if (!buildFilePath.startsWith(ROOT)) {
console.error('ERROR: Invalid build file path.');
process.exit(2);
}
var cmd = 'ant clean -f ' + buildFilePath;
var result = shell.exec(cmd, {silent:false, async:false});
if (result.code > 0) {
console.error('ERROR: Failed to clean android project.');
Expand Down
2 changes: 1 addition & 1 deletion platforms/android/cordova/lib/device.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ module.exports.list = function() {
var device_list = [];
for (var i = 1; i < response.length; i++) {
if (response[i].match(/\w+\tdevice/) && !response[i].match(/emulator/)) {
device_list.push(response[i].replace(/\tdevice/, '').replace('\r', ''));
device_list.push(response[i].replace(/\tdevice/, '').replace(/\r/g, ''));
}
}
return device_list;
Expand Down
14 changes: 7 additions & 7 deletions platforms/android/cordova/lib/emulator.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,22 +49,22 @@ module.exports.list_images = function() {
// To return more detailed information use img_obj
var img_obj = {};
if (response[i].match(/Name:\s/)) {
img_obj['name'] = response[i].split('Name: ')[1].replace('\r', '');
img_obj['name'] = response[i].split('Name: ')[1].replace(/\r/g, '');
if (response[i + 1].match(/Path:\s/)) {
i++;
img_obj['path'] = response[i].split('Path: ')[1].replace('\r', '');
img_obj['path'] = response[i].split('Path: ')[1].replace(/\r/g, '');
}
if (response[i + 1].match(/\(API\slevel\s/)) {
i++;
img_obj['target'] = response[i].replace('\r', '');
img_obj['target'] = response[i].replace(/\r/g, '');
}
if (response[i + 1].match(/ABI:\s/)) {
i++;
img_obj['abi'] = response[i].split('ABI: ')[1].replace('\r', '');
img_obj['abi'] = response[i].split('ABI: ')[1].replace(/\r/g, '');
}
if (response[i + 1].match(/Skin:\s/)) {
i++;
img_obj['skin'] = response[i].split('Skin: ')[1].replace('\r', '');
img_obj['skin'] = response[i].split('Skin: ')[1].replace(/\r/g, '');
}

emulator_list.push(img_obj);
Expand Down Expand Up @@ -114,7 +114,7 @@ module.exports.list_started = function() {
var started_emulator_list = [];
for (var i = 1; i < response.length; i++) {
if (response[i].match(/device/) && response[i].match(/emulator/)) {
started_emulator_list.push(response[i].replace(/\tdevice/, '').replace('\r', ''));
started_emulator_list.push(response[i].replace(/\tdevice/, '').replace(/\r/g, ''));
}
}
return started_emulator_list;
Expand All @@ -123,7 +123,7 @@ module.exports.list_started = function() {

module.exports.get_target = function() {
var target = shell.grep(/target=android-[\d+]/, path.join(ROOT, 'project.properties'));
return target.split('=')[1].replace('\n', '').replace('\r', '').replace(' ', '');
return target.split('=')[1].replace(/\n/g, '').replace(/\r/g, '').replace(' ', '');
}

module.exports.list_targets = function() {
Expand Down
4 changes: 2 additions & 2 deletions platforms/blackberry10/cordova/lib/bbwpignore.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,13 +94,13 @@ BBWPignore = function (bbwpIgnoreFile, filesToMatch) {
//match wildCards
wildcardEntries.forEach(function (wildcard) {
if (wildcard.match("^/")) { // special case looking for exact match
wildcard = "^" + wildcard.replace("*", "[^\/]*");
wildcard = "^" + wildcard.replace(/\*/g, "[^\/]*");
if (("/" + fileToMatch).match(wildcard)) {
matched.push(fileToMatch);
isMatch = true;
}
} else {
wildcard = wildcard.replace("*", "[^\/]*");
wildcard = wildcard.replace(/\*/g, "[^\/]*");
if (fileToMatch.match(wildcard)) {
matched.push(fileToMatch);
isMatch = true;
Expand Down
4 changes: 2 additions & 2 deletions platforms/blackberry10/lib/cordova.3.1.0/javascript/cordova.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,7 +518,7 @@ function include(parent, objects, clobber, merge) {
*/
function recursiveMerge(target, src) {
for (var prop in src) {
if (src.hasOwnProperty(prop)) {
if (src.hasOwnProperty(prop)) { // Prevent prototype pollution
if (target.prototype && target.prototype.constructor === target) {
// If the target object is a constructor override off prototype.
clobber(target.prototype, prop, src[prop]);
Expand Down Expand Up @@ -1232,7 +1232,7 @@ function findCordovaPath() {
var term = 'cordova.js';
for (var n = scripts.length-1; n>-1; n--) {
var src = scripts[n].src;
if (src.indexOf(term) == (src.length - term.length)) {
if (src.indexOf(term) == (src.length - term.length) && src.indexOf(term) !== -1) { // Added check for -1
path = src.substring(0, src.length - term.length);
break;
}
Expand Down
4 changes: 2 additions & 2 deletions platforms/blackberry10/native/device/chrome/lib/policy/folderAccess.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ function _determineDepth(folderPath) {
var depthCount = 0;

// Replace all backslashes with forward slash
folderPath = folderPath.replace("\\", "/");
folderPath = folderPath.replaceAll("\\", "/");

// Special case: "/" is the given path
if (folderPath === "/") {
Expand Down Expand Up @@ -75,7 +75,7 @@ function _getPath(folderPath, desiredDepth) {
}

// Replace all backslashes with forward slash
folderPath = folderPath.replace("\\", "/");
folderPath = folderPath.replaceAll("\\", "/");

folderPath = _trimSurroundingSlashes(folderPath);

Expand Down
28 changes: 14 additions & 14 deletions platforms/blackberry10/native/device/chrome/lib/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,20 +236,20 @@ self = module.exports = {
},

regexSanitize: function (regexString) {
return regexString.replace("^", "\\^")
.replace("$", "\\$")
.replace("(", "\\(")
.replace(")", "\\)")
.replace("<", "\\<")
.replace("[", "\\[")
.replace("{", "\\{")
.replace(/\\/, "\\\\")
.replace("|", "\\|")
.replace(">", "\\>")
.replace(".", "\\.")
.replace("*", "\\*")
.replace("+", "\\+")
.replace("?", "\\?");
return regexString.replace(/\\/g, "\\\\")
.replace(/\^/g, "\\^")
.replace(/\$/g, "\\$")
.replace(/\(/g, "\\(")
.replace(/\)/g, "\\)")
.replace(/</g, "\\<")
.replace(/\[/g, "\\[")
.replace(/{/g, "\\{")
.replace(/\|/g, "\\|")
.replace(/>/g, "\\>")
.replace(/\./g, "\\.")
.replace(/\*/g, "\\*")
.replace(/\+/g, "\\+")
.replace(/\?/g, "\\?");
},

find: function (comparison, collection, startInx, endInx, callback) {
Expand Down
6 changes: 5 additions & 1 deletion plugins/org.apache.cordova.device/test/cordova-incl.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,11 @@ if (PLAT) {

if (!window._doNotWriteCordovaScript) {
if (PLAT != "windows8") {
document.write('<script type="text/javascript" charset="utf-8" src="' + cordovaPath + '"></script>');
var scriptElement = document.createElement('script');
scriptElement.type = 'text/javascript';
scriptElement.charset = 'utf-8';
scriptElement.src = cordovaPath;
document.head.appendChild(scriptElement);
} else {
var s = document.createElement('script');
s.src = cordovaPath;
Expand Down