CVE-2021-23518 (JavaScript, published 2022-01-21T20:15Z)
Description: value: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/ashaffer/cached-path-relative
Files changed:
.gitignore
Makefile
Readme.md
lib/index.js
package.json
shim.js
test/index.js
Commit message: Fix other instances of prototype pollution vulnerability


Vulnerable code:

Fixed code:
node_modules
*.log
#
# Vars
#

BIN = ./node_modules/.bin

#
# Tasks
# 

node_modules: package.json
	@npm install

test: node_modules
	@${BIN}/tape test/*

validate: node_modules
	@${BIN}/standard

.PHONY: test validate

# cached-path-relative

[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://github.com/feross/standard)

Memoize the results of the path.relative function. `path.relative` can be an expensive operation if it happens a lot, and its results shouldn't change for the same arguments.

## Installation

    $ npm install cached-path-relative

## Usage

Use it just like your normal path.relative, but it's memoized:

```javascript
var relative = require('cached-path-relative')


relative('test/index.js', '.') === '../..'
```

## Shim

If you want to shim path.relative globally so that you can optimize things that don't know about this module (browserify rebuild times are a good use-case here), you can just import the shim:

`require('cached-path-relative/shim')`

This will globally shim `path.relative` so that its results are cached.

## License

The MIT License

Copyright &copy; 2016, Weo.io &lt;info@weo.io&gt;

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
/**
 * Modules
 */

var path = require('path')

/**
 * Vars
 */

var relative = path.relative
var lastCwd = process.cwd()
var cache = Object.create(null)

/**
 * Expose cachedPathRelative
 */

module.exports = cachedPathRelative

/**
 * cachedPathRelative
 */

function cachedPathRelative (from, to) {
  // If the current working directory changes, we need
  // to invalidate the cache
  var cwd = process.cwd()
  if (cwd !== lastCwd) {
    cache = Object.create(null)
    lastCwd = cwd
  }

  if (cache[from] && cache[from][to]) return cache[from][to]

  var result = relative.call(path, from, to)

  cache[from] = cache[from] || Object.create(null)
  cache[from][to] = result

  return result

}
{
  "name": "cached-path-relative",
  "description": "Memoize the results of the path.relative function",
  "repository": "git://github.com/ashaffer/cached-path-relative.git",
  "version": "1.0.2",
  "license": "MIT",
  "main": "lib/index.js",
  "dependencies": {},
  "devDependencies": {
    "tape": "^4.2.0",
    "standard": "^4.0.0"
  }
}
/**
 * Modules
 */

var path = require('path')
var cachedPathRelative = require('.')

/**
 * Install shim
 */

path.relative = cachedPathRelative
/**
 * Imports
 */

var relative = require('..')
var path = require('path')
var test = require('tape')

/**
 * Tests
 */

test('should work', function (t) {
  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
  t.end()
})