Repository: googlemaps/google-maps-services-js
Pull request #428 (2020-07-20 17:24:08)

build(deps-dev): [security] bump codecov from 3.6.5 to 3.7.1
Bumps [codecov](https://github.com/codecov/codecov-node) from 3.6.5 to 3.7.1. **This update includes a security fix.**
<details>
<summary>Vulnerabilities fixed</summary>
<p><em>Sourced from <a href="https://github.com/advisories/GHSA-xp63-6vf5-xf3v">The GitHub Security Advisory Database</a>.</em></p>
<blockquote>
<p><strong>Command injection in codecov (npm package)</strong></p>
<h3>Impact</h3>
<p>The <code>upload</code> method has a command injection vulnerability. Clients of the <code>codecov-node</code> library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.</p>
<p>A similar CVE was issued: <a href="https://github.com/advisories/GHSA-5q88-cjfq-g2mh">CVE-2020-7597</a>, but the fix was incomplete. It only blocked <code>&amp;amp;</code>, and command injection is still possible using backticks instead to bypass the sanitizer.</p>
<p>We have written a <a href="https://codeql.com">CodeQL</a> query, which automatically detects this vulnerability. You can see the results of the query on the <code>codecov-node</code> project <a href="https://lgtm.com/query/7714424068617023832/">here</a>.</p>
<h3>Patches</h3>
<p>3.7.1</p>
<h3>Workarounds</h3>
<p>None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.</p>
<h3>References</h3>
<ul>
<li><a href="https://github.com/advisories/GHSA-5q88-cjfq-g2mh">CVE-2020-7597</a></li>
</ul>
<h3>For more information</h3>
<!-- raw HTML omitted -->
<p>Affected versions: &lt; 3.7.1</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/codecov/codecov-node/commit/29dd5b6b039ce03c7bc368855896641441233417"><code>29dd5b6</code></a> 3.7.1</li>
<li><a href="https://github.com/codecov/codecov-node/commit/c0711c656686e902af2cd92d6aecc8074de4d83d"><code>c0711c6</code></a> Switch from execSync to execFileSync (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/180">#180</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/5f6cc62d4f83bf3a75c973868259798814cd231e"><code>5f6cc62</code></a> Bump lodash from 4.17.15 to 4.17.19 (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/183">#183</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/0c4d7f3c6f2950445913e7f8081b26da4b41cbad"><code>0c4d7f3</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/182">#182</a> from codecov/update-readme-badges</li>
<li><a href="https://github.com/codecov/codecov-node/commit/cc5e1218426f21beaea94908775342623c27934b"><code>cc5e121</code></a> Update depstat image and urls</li>
<li><a href="https://github.com/codecov/codecov-node/commit/b44b44e1f8265d8f8b8f27c343283d6d2e8ee668"><code>b44b44e</code></a> Update readme with 400 error info (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/181">#181</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/bb793357190e1d799da5b5732ef57d1e7968680a"><code>bb79335</code></a> V3.7.0 (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/179">#179</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/0d7b9b01cbbd2c614e042a8f01cda25593dda4e5"><code>0d7b9b0</code></a> Remove <code>'x-amz-acl': 'public-read'</code> header (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/178">#178</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/eeff4e1953bffd2a3840322764bd5c8c9d3a91f4"><code>eeff4e1</code></a> Bump acorn from 5.7.3 to 5.7.4 (<a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/174">#174</a>)</li>
<li><a href="https://github.com/codecov/codecov-node/commit/eb8a5274707632f821751cfce5b882cf3817ddf8"><code>eb8a527</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/codecov/codecov-node/issues/172">#172</a> from RoboCafaz/bugfix/codebuild-pr-parser</li>
<li>Additional commits viewable in <a href="https://github.com/codecov/codecov-node/compare/v3.6.5...v3.7.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=codecov&package-manager=npm_and_yarn&previous-version=3.6.5&new-version=3.7.1)](https://dependabot.com/compatibility-score/?dependency-name=codecov&package-manager=npm_and_yarn&previous-version=3.6.5&new-version=3.7.1)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)



</details>

codecov[bot]: # [Codecov](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=h1) Report
> Merging [#428](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=desc) into [master](https://codecov.io/gh/googlemaps/google-maps-services-js/commit/53ef591b7d6a9ac3bed4803adfab2f336d17ccf0&el=desc) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428/graphs/tree.svg?width=650&height=150&src=pr&token=wXidzRKqFM)](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=tree)

```diff
@@            Coverage Diff            @@
##            master      #428   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           22        22           
  Lines          766       766           
  Branches       100       100           
=========================================
  Hits           766       766           
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=footer). Last update [53ef591...e58a99e](https://codecov.io/gh/googlemaps/google-maps-services-js/pull/428?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/package-lock.json b/package-lock.json
index c7e52240f..2b2138907 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -2567,9 +2567,9 @@
       "dev": true
     },
     "codecov": {
-      "version": "3.6.5",
-      "resolved": "https://registry.npmjs.org/codecov/-/codecov-3.6.5.tgz",
-      "integrity": "sha512-v48WuDMUug6JXwmmfsMzhCHRnhUf8O3duqXvltaYJKrO1OekZWpB/eH6iIoaxMl8Qli0+u3OxptdsBOYiD7VAQ==",
+      "version": "3.7.1",
+      "resolved": "https://registry.npmjs.org/codecov/-/codecov-3.7.1.tgz",
+      "integrity": "sha512-JHWxyPTkMLLJn9SmKJnwAnvY09kg2Os2+Ux+GG7LwZ9g8gzDDISpIN5wAsH1UBaafA/yGcd3KofMaorE8qd6Lw==",
       "dev": true,
       "requires": {
         "argv": "0.0.2",
@@ -6846,9 +6846,9 @@
       }
     },
     "lodash": {
-      "version": "4.17.15",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
-      "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==",
+      "version": "4.17.19",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz",
+      "integrity": "sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==",
       "dev": true
     },
     "lodash.capitalize": {
diff --git a/src/index.ts b/src/index.ts
index fd4ab6045..a362a392f 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -33,6 +33,7 @@ export {
 export {
   PlaceAutocompleteRequest,
   PlaceAutocompleteResponse,
+  PlaceAutocompleteResult,
   PlaceAutocompleteType
 } from "./places/autocomplete";
 export { PlaceDetailsRequest, PlaceDetailsResponse } from "./places/details";
diff --git a/src/serialize.ts b/src/serialize.ts
index b0a9a1381..2336f2178 100644
--- a/src/serialize.ts
+++ b/src/serialize.ts
@@ -105,12 +105,16 @@ export function serializer(
   }
 ) {
   return (params: { [key: string]: any }) => {
+    // avoid mutating params
+    const serializedParams = { ...params };
+
     Object.keys(format).forEach((key: string) => {
-      if (key in params) {
-        params[key] = format[key](params[key]);
+      if (key in serializedParams) {
+        serializedParams[key] = format[key](serializedParams[key]);
       }
     });
-    return qs(params, queryStringOptions);
+
+    return qs(serializedParams, queryStringOptions);
   };
 }
 


Test patch:
diff --git a/src/serialize.test.ts b/src/serialize.test.ts
index 5832f47fa..8b2bba933 100644
--- a/src/serialize.test.ts
+++ b/src/serialize.test.ts
@@ -60,6 +60,16 @@ test("serializer", () => {
   ).toBe("foo=0%2C1|2%2C3");
 });
 
+test("serializer should not mutate params", () => {
+  const location = { lat: 0, lng: 1 };
+  const params = {
+    location,
+  };
+
+  serializer({ location: latLngToString })(params);
+  expect(params.location).toBe(location);
+});
+
 test("serializer should return pipe joined arrays by default", () => {
   expect(serializer({})({ foo: ["b", "a", "r"] })).toBe("foo=b|a|r");
 });