yarnpkg/CVE-2025-8263.patch

25 lines
1.1 KiB
Diff

diff -rupN yarn-1.22.22/node_modules/form-data/lib/form_data.js yarn-1.22.22-new/node_modules/form-data/lib/form_data.js
--- yarn-1.22.22/node_modules/form-data/lib/form_data.js 2025-07-28 11:18:19.000000000 +0200
+++ yarn-1.22.22-new/node_modules/form-data/lib/form_data.js 2025-07-31 00:39:06.012116839 +0200
@@ -5,6 +5,7 @@ var http = require('http');
var https = require('https');
var parseUrl = require('url').parse;
var fs = require('fs');
+var crypto = require('crypto');
var mime = require('mime-types');
var asynckit = require('asynckit');
var populate = require('./populate.js');
@@ -316,12 +317,7 @@ FormData.prototype.getBoundary = functio
FormData.prototype._generateBoundary = function() {
// This generates a 50 character boundary similar to those used by Firefox.
// They are optimized for boyer-moore parsing.
- var boundary = '--------------------------';
- for (var i = 0; i < 24; i++) {
- boundary += Math.floor(Math.random() * 10).toString(16);
- }
-
- this._boundary = boundary;
+ this._boundary = '--------------------------' + crypto.randomBytes(12).toString('hex');
};
// Note: getLengthSync DOESN'T calculate streams length