From 5c5f857076d168bd1bc358a5529c9d83ca5173ca Mon Sep 17 00:00:00 2001
From: Tomas Juhasz <tjuhasz@redhat.com>
Date: Fri, 10 Jan 2025 13:30:29 +0100
Subject: [PATCH] Added patch for CVE-2024-4068

---
 0001-CVE-2024-4068-fix.patch | 38 ++++++++++++++++++++++++++++++++++++
 nodejs-nodemon.spec          |  6 +++++-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 0001-CVE-2024-4068-fix.patch

diff --git a/0001-CVE-2024-4068-fix.patch b/0001-CVE-2024-4068-fix.patch
new file mode 100644
index 0000000..db163f6
--- /dev/null
+++ b/0001-CVE-2024-4068-fix.patch
@@ -0,0 +1,38 @@
+From 1dfe8b9208dade21baad8344d6e9847eecb5837d Mon Sep 17 00:00:00 2001
+From: Aaron Moat <2937187+AaronMoat@users.noreply.github.com>
+Date: Tue, 21 May 2024 17:32:41 +1000
+Subject: [PATCH] Lower defaultLength to 10000
+
+---
+ README.md        | 2 +-
+ lib/constants.js | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+ **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera.
+ 
+diff --git a/README.md b/README.md
+index 6b94046..f59dd60 100644
+--- node_modules/braces/README.md
++++ node_modules/braces/README.md
+@@ -178,7 +178,7 @@ console.log(braces.expand('a{b}c'));
+ 
+ **Type**: `Number`
+ 
+-**Default**: `65,536`
++**Default**: `10,000`
+ 
+ **Description**: Limit the length of the input string. Useful when the input string is generated or your application allows users to pass a string, et cetera.
+ 
+diff --git a/lib/constants.js b/lib/constants.js
+index a937943..2bb3b88 100644
+--- node_modules/braces/lib/constants.js
++++ node_modules/braces/lib/constants.js
+@@ -1,7 +1,7 @@
+ 'use strict';
+ 
+ module.exports = {
+-  MAX_LENGTH: 1024 * 64,
++  MAX_LENGTH: 10000,
+ 
+   // Digits
+   CHAR_0: '0', /* 0 */
diff --git a/nodejs-nodemon.spec b/nodejs-nodemon.spec
index 56cb406..8cf78af 100644
--- a/nodejs-nodemon.spec
+++ b/nodejs-nodemon.spec
@@ -12,6 +12,10 @@ License:       ISC AND MIT
 URL:           https://github.com/remy/nodemon
 Source0:       %{npm_name}-v%{version}-bundled.tar.gz
 
+# Patch in the fix for unlimited resource allocation of dependency
+# Source: https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+Patch:         0001-CVE-2024-4068-fix.patch
+
 BuildRequires: nodejs-devel
 BuildRequires: nodejs-packaging
 BuildRequires: npm
@@ -41,7 +45,7 @@ on the command line when you run your script.
 
 %prep
 %setup -q -n %{npm_name}-%{version}
-
+%patch -P 0 
 %build
 
 # nothing to do