nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: caolan/async
Pull request #1828 (2022-04-08 14:19:13)

Fix prototype pollution vulnerability
(cherry picked from commit e1ecdbf79264f9ab488c7799f4c76996d5dca66d)

Conflicts:
  lib/internal/iterator.js
  test/mapValues.js

NOTE(mriedem): The conflicts are due to:

- e4751178540a3c6e64598b93977481ec599704d2 for iterator.js;
  resolution was trivial
- bd86f42a7d71552d9a502b50235ffc090a1b4a98 for mapValues.js;
  resolution was just copying the test change into the old
  test file before it was moved

This is a 2.x series backport for
https://nvd.nist.gov/vuln/detail/CVE-2021-43138.

mriedem: Feel free to ignore/close this if you want. For the project I cared about we just removed the dependency on async (it was only using `doWhilst` and we were able to just re-write that code to use a simple do...while).
richgt: Would love to see this get merged and released as a 2.x patch. Ember.js relies on this library, but is incompatible with 3.x. Let us know if there's anything we can do to help get this merged. 
alexweininger: Us over at https://github.com/microsoft/vscode-azure-account would be very grateful if this fix could get merged and released as a 2.x patch as well!

Currently cannot update to 3.x since async is a transient dependency.
osdnk: I know this is crazy, but what's the fix for 1.5.x?
FrederikBolding: > I know this is crazy, but what's the fix for 1.5.x?

Is `mapValues` even included in the older versions? I can't seem to find it. And if not, is there no vuln in the older versions?

Patch:
diff --git a/lib/internal/iterator.js b/lib/internal/iterator.js
index 15c6fdd..24056ef 100644
--- a/lib/internal/iterator.js
+++ b/lib/internal/iterator.js
@@ -27,6 +27,9 @@ function createObjectIterator(obj) {
     var len = okeys.length;
     return function next() {
         var key = okeys[++i];
+        if (key === '__proto__') {
+            return next();
+        }
         return i < len ? {value: obj[key], key: key} : null;
     };
 }


Test patch:
diff --git a/mocha_test/mapValues.js b/mocha_test/mapValues.js
index 612feff..640060f 100644
--- a/mocha_test/mapValues.js
+++ b/mocha_test/mapValues.js
@@ -39,6 +39,17 @@ describe('mapValues', function () {
                 done();
             });
         });
+
+        it('prototype pollution', (done) => {
+            var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');
+
+            async.mapValues(input, (val, key, next) => {
+                next(null, val)
+            }, (err, result) => {
+                expect(result.exploit).to.equal(undefined)
+                done(err);
+            })
+        })
     });
 
     context('mapValues', function () {
Repository: ACloudGuru/serverless-plugin-aws-alerts
Pull request #32 (2017-07-06 13:41:25)

Issue 21
## What did you implement:
#21 

## How did you implement it:
Add alarm description to cloudformation via the alarm definition

## How can we verify it:


## Todos:

- [x] Write tests
- [x] Write documentation
- [x] Fix linting errors
- [ ] Provide verification config/commands/resources
- [ ] Change ready for review message below




Patch:
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index e090675..3cac1b4 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -31,5 +31,4 @@ Examples:
 - [ ] Write documentation
 - [ ] Fix linting errors
 - [ ] Provide verification config/commands/resources
-- [ ] Change ready for review message below
 
diff --git a/README.md b/README.md
index 605df63..21482c8 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ custom:
       functionErrors:
         period: 300 # override period
       customAlarm:
+        description: 'My custom alarm'
         namespace: 'AWS/Lambda'
         metric: duration
         threshold: 200
@@ -135,7 +136,7 @@ definitions:
   functionErrors:
     namespace: 'AWS/Lambda'
     metric: Errors
-    threshold: 10
+    threshold: 1
     statistic: Maximum
     period: 60
     evaluationPeriods: 1
@@ -153,7 +154,7 @@ definitions:
   functionThrottles:
     namespace: 'AWS/Lambda'
     metric: Throttles
-    threshold: 50
+    threshold: 1
     statistic: Sum
     period: 60
     evaluationPeriods: 1
diff --git a/example/serverless.yml b/example/serverless.yml
index 5662fc4..b14d7a4 100644
--- a/example/serverless.yml
+++ b/example/serverless.yml
@@ -2,6 +2,7 @@ service: service-test-alerts-plugin
 provider:
   name: aws
   runtime: nodejs4.3
+  region: us-east-1
   profile: ${opt:profile}
 
 package:
@@ -36,6 +37,7 @@ custom:
         threshold: 10
         period: 600
       customAlarm:
+        description: 'My custom alarm'
         namespace: 'AWS/Lambda'
         metric: duration
         threshold: 200
diff --git a/src/index.js b/src/index.js
index 0798b14..7c218f8 100644
--- a/src/index.js
+++ b/src/index.js
@@ -110,6 +110,7 @@ class Plugin {
       Properties: {
         Namespace: namespace,
         MetricName: metricName,
+        AlarmDescription: definition.description,
         Threshold: definition.threshold,
         Statistic: definition.statistic,
         Period: definition.period,


Test patch:
diff --git a/src/index.test.js b/src/index.test.js
index f0811f7..d8def3a 100644
--- a/src/index.test.js
+++ b/src/index.test.js
@@ -623,6 +623,7 @@ describe('#index', function () {
       };
 
       const definition = {
+        description: 'An error alarm',
         namespace: 'AWS/Lambda',
         metric: 'Errors',
         threshold: 1,
@@ -640,6 +641,7 @@ describe('#index', function () {
       expect(cf).toEqual({
         Type: 'AWS::CloudWatch::Alarm',
         Properties: {
+          AlarmDescription: definition.description,
           Namespace: definition.namespace,
           MetricName: definition.metric,
           Threshold: definition.threshold,
Repository: ACloudGuru/serverless-plugin-aws-alerts
Pull request #43 (2017-08-04 19:06:14)

Added an ability to overwrite alarm definitions per function
## What did you implement:

Sometimes it's needed to be able to tweak alarms for some functions (e.g. throttling threshold).

## How did you implement it:

Syntax remains the same, but logic was tweaked to merging alarm definition from function level with a globally defined one.

## How can we verify it:

Use the following service definition:
```yaml
custom:
  alerts:
    topics:
      alarm: 'alarm-topic'
    definitions:
      functionErrors:
        threshold: 1
    alarms:
      - functionErrors

functions:
  foo:
    handler: foo.handler
  bar:
    handler: bar.handler
    alarms:
      - name: functionErrors
        threshold: 100
```

After packaging service, check that both functions have `functionErrors` alarm, but threshold for `foo` is 1, while for `bar` - 100.

## Todos:

- [x] Write tests
- [x] Write documentation
- [x] Fix linting errors
- [x] Provide verification config/commands/resources



AntonBazhal: @johncmckim 

Patch:
diff --git a/README.md b/README.md
index 79f75df..a830bc2 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,7 @@ functions:
     handler: foo.handler
     alarms: # merged with function alarms
       - customAlarm
-      - name: fooAlarm
+      - name: fooAlarm # creates new alarm or overwrites some properties of the alarm (with the same name) from definitions
         namespace: 'AWS/Lambda'
         metric: errors # define custom metrics here
         threshold: 1
diff --git a/src/index.js b/src/index.js
index 5696955..5917e4f 100644
--- a/src/index.js
+++ b/src/index.js
@@ -45,7 +45,7 @@ class Plugin {
           name: alarm
         }));
       } else if (_.isObject(alarm)) {
-        result.push(alarm);
+        result.push(_.merge({}, definitions[alarm.name], alarm));
       }
 
       return result;


Test patch:
diff --git a/src/index.test.js b/src/index.test.js
index a7eac59..037e636 100644
--- a/src/index.test.js
+++ b/src/index.test.js
@@ -106,6 +106,27 @@ describe('#index', function () {
         plugin.getAlarms(alarms, definitions);
       }).toThrow();
     });
+
+    it('should merge alarm with definition', () => {
+      const testAlarm = {
+        name: 'testAlarm',
+        threshold: 100
+      };
+      const alarms = [testAlarm];
+      const definitions = {
+        testAlarm: {
+          threshold: 1,
+          statistic: 'Sum'
+        }
+      };
+
+      const alarmsConfig = plugin.getAlarms(alarms, definitions);
+      expect(alarmsConfig).toEqual([{
+        name: 'testAlarm',
+        threshold: 100,
+        statistic: 'Sum'
+      }]);
+    });
   });
 
   describe('#getGlobalAlarms', () => {