diff --git a/lib/web/underscore.js b/lib/web/underscore.js index 3f53992b9fa26..01ff20f6371bd 100644 --- a/lib/web/underscore.js +++ b/lib/web/underscore.js @@ -7,19 +7,19 @@ exports.noConflict = function () { global._ = current; return exports; }; }())); }(this, (function () { - // Underscore.js 1.13.2 + // Underscore.js 1.13.8 // https://underscorejs.org - // (c) 2009-2021 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters & Editors + // (c) 2009-2026 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud and Investigative Reporters & Editors // Underscore may be freely distributed under the MIT license. // Current version. - var VERSION = '1.13.2'; + var VERSION = '1.13.8'; // Establish the root object, `window` (`self`) in the browser, `global` // on the server, or `this` in some virtual machines. We use `self` // instead of `window` for `WebWorker` support. - var root = typeof self == 'object' && self.self === self && self || - typeof global == 'object' && global.global === global && global || + var root = (typeof self == 'object' && self.self === self && self) || + (typeof global == 'object' && global.global === global && global) || Function('return this')() || {}; @@ -87,7 +87,7 @@ // Is a given variable an object? function isObject(obj) { var type = typeof obj; - return type === 'function' || type === 'object' && !!obj; + return type === 'function' || (type === 'object' && !!obj); } // Is a given value equal to null? @@ -150,8 +150,11 @@ // In IE 10 - Edge 13, `DataView` has string tag `'[object Object]'`. // In IE 11, the most common among them, this problem also applies to // `Map`, `WeakMap` and `Set`. - var hasStringTagBug = ( - supportsDataView && hasObjectTag(new DataView(new ArrayBuffer(8))) + // Also, there are cases where an application can override the native + // `DataView` object, in cases like that we can't use the constructor + // safely and should just rely on alternate `DataView` checks + var hasDataViewBug = ( + supportsDataView && (!/\[native code\]/.test(String(DataView)) || hasObjectTag(new DataView(new ArrayBuffer(8)))) ), isIE11 = (typeof Map !== 'undefined' && hasObjectTag(new Map)); @@ -159,11 +162,13 @@ // In IE 10 - Edge 13, we need a different heuristic // to determine whether an object is a `DataView`. - function ie10IsDataView(obj) { + // Also, in cases where the native `DataView` is + // overridden we can't rely on the tag itself. + function alternateIsDataView(obj) { return obj != null && isFunction$1(obj.getInt8) && isArrayBuffer(obj.buffer); } - var isDataView$1 = (hasStringTagBug ? ie10IsDataView : isDataView); + var isDataView$1 = (hasDataViewBug ? alternateIsDataView : isDataView); // Is a given value an array? // Delegates to ECMA5's native `Array.isArray`. @@ -264,7 +269,7 @@ keys = emulatedSet(keys); var nonEnumIdx = nonEnumerableProps.length; var constructor = obj.constructor; - var proto = isFunction$1(constructor) && constructor.prototype || ObjProto; + var proto = (isFunction$1(constructor) && constructor.prototype) || ObjProto; // Constructor is a special case. var prop = 'constructor'; @@ -352,131 +357,157 @@ // We use this string twice, so give it a name for minification. var tagDataView = '[object DataView]'; - // Internal recursive comparison function for `_.isEqual`. - function eq(a, b, aStack, bStack) { - // Identical objects are equal. `0 === -0`, but they aren't identical. - // See the [Harmony `egal` proposal](https://wiki.ecmascript.org/doku.php?id=harmony:egal). - if (a === b) return a !== 0 || 1 / a === 1 / b; - // `null` or `undefined` only equal to itself (strict comparison). - if (a == null || b == null) return false; - // `NaN`s are equivalent, but non-reflexive. - if (a !== a) return b !== b; - // Exhaust primitive checks - var type = typeof a; - if (type !== 'function' && type !== 'object' && typeof b != 'object') return false; - return deepEq(a, b, aStack, bStack); - } - - // Internal recursive comparison function for `_.isEqual`. - function deepEq(a, b, aStack, bStack) { - // Unwrap any wrapped objects. - if (a instanceof _$1) a = a._wrapped; - if (b instanceof _$1) b = b._wrapped; - // Compare `[[Class]]` names. - var className = toString.call(a); - if (className !== toString.call(b)) return false; - // Work around a bug in IE 10 - Edge 13. - if (hasStringTagBug && className == '[object Object]' && isDataView$1(a)) { - if (!isDataView$1(b)) return false; - className = tagDataView; - } - switch (className) { - // These types are compared by value. - case '[object RegExp]': - // RegExps are coerced to strings for comparison (Note: '' + /a/i === '/a/i') - case '[object String]': - // Primitives and their corresponding object wrappers are equivalent; thus, `"5"` is - // equivalent to `new String("5")`. - return '' + a === '' + b; - case '[object Number]': - // `NaN`s are equivalent, but non-reflexive. - // Object(NaN) is equivalent to NaN. - if (+a !== +a) return +b !== +b; - // An `egal` comparison is performed for other numeric values. - return +a === 0 ? 1 / +a === 1 / b : +a === +b; - case '[object Date]': - case '[object Boolean]': - // Coerce dates and booleans to numeric primitive values. Dates are compared by their - // millisecond representations. Note that invalid dates with millisecond representations - // of `NaN` are not equivalent. - return +a === +b; - case '[object Symbol]': - return SymbolProto.valueOf.call(a) === SymbolProto.valueOf.call(b); - case '[object ArrayBuffer]': - case tagDataView: - // Coerce to typed array so we can fall through. - return deepEq(toBufferView(a), toBufferView(b), aStack, bStack); - } + // Perform a deep comparison to check if two objects are equal. + function isEqual(a, b) { + // Keep track of which pairs of values need to be compared. We will be + // trampolining on this stack instead of using function recursion. + // (CVE-2026-27601) + var todo = [{a: a, b: b}]; + // Initializing stacks of traversed objects for cycle detection. + var aStack = [], bStack = []; + + // Keep traversing pairs until there is nothing left to compare. + while (todo.length) { + var frame = todo.pop(); + // As a special case, a single `true` on the todo means that we can + // unwind the cycle detection stacks. + if (frame === true) { + // Remove the first object from the stack of traversed objects. + aStack.pop(); + bStack.pop(); + continue; + } + a = frame.a; + b = frame.b; - var areArrays = className === '[object Array]'; - if (!areArrays && isTypedArray$1(a)) { - var byteLength = getByteLength(a); - if (byteLength !== getByteLength(b)) return false; - if (a.buffer === b.buffer && a.byteOffset === b.byteOffset) return true; - areArrays = true; - } - if (!areArrays) { - if (typeof a != 'object' || typeof b != 'object') return false; - - // Objects with different constructors are not equivalent, but `Object`s or `Array`s - // from different frames are. - var aCtor = a.constructor, bCtor = b.constructor; - if (aCtor !== bCtor && !(isFunction$1(aCtor) && aCtor instanceof aCtor && - isFunction$1(bCtor) && bCtor instanceof bCtor) - && ('constructor' in a && 'constructor' in b)) { + // Identical objects are equal. `0 === -0`, but they aren't identical. + // See the [Harmony `egal` proposal](https://wiki.ecmascript.org/doku.php?id=harmony:egal). + if (a === b) { + if (a !== 0 || 1 / a === 1 / b) continue; return false; } - } - // Assume equality for cyclic structures. The algorithm for detecting cyclic - // structures is adapted from ES 5.1 section 15.12.3, abstract operation `JO`. - - // Initializing stack of traversed objects. - // It's done here since we only need them for objects and arrays comparison. - aStack = aStack || []; - bStack = bStack || []; - var length = aStack.length; - while (length--) { - // Linear search. Performance is inversely proportional to the number of - // unique nested structures. - if (aStack[length] === a) return bStack[length] === b; - } + // `null` or `undefined` only equal to itself (strict comparison). + if (a == null || b == null) return false; + // `NaN`s are equivalent, but non-reflexive. + if (a !== a) { + if (b !== b) continue; + return false; + } + // Exhaust primitive checks + var type = typeof a; + if (type !== 'function' && type !== 'object' && typeof b != 'object') return false; + + // Internal recursive comparison function for `_.isEqual`. + // Unwrap any wrapped objects. + if (a instanceof _$1) a = a._wrapped; + if (b instanceof _$1) b = b._wrapped; + // Compare `[[Class]]` names. + var className = toString.call(a); + if (className !== toString.call(b)) return false; + // Work around a bug in IE 10 - Edge 13. + if (hasDataViewBug && className == '[object Object]' && isDataView$1(a)) { + if (!isDataView$1(b)) return false; + className = tagDataView; + } + switch (className) { + // These types are compared by value. + case '[object RegExp]': + // RegExps are coerced to strings for comparison (Note: '' + /a/i === '/a/i') + case '[object String]': + // Primitives and their corresponding object wrappers are equivalent; thus, `"5"` is + // equivalent to `new String("5")`. + if ('' + a === '' + b) continue; + return false; + case '[object Number]': + todo.push({a: +a, b: +b}); + continue; + case '[object Date]': + case '[object Boolean]': + // Coerce dates and booleans to numeric primitive values. Dates are compared by their + // millisecond representations. Note that invalid dates with millisecond representations + // of `NaN` are not equivalent. + if (+a === +b) continue; + return false; + case '[object Symbol]': + if (SymbolProto.valueOf.call(a) === SymbolProto.valueOf.call(b)) continue; + return false; + case '[object ArrayBuffer]': + case tagDataView: + // Coerce to typed array so we can fall through. + todo.push({a: toBufferView(a), b: toBufferView(b)}); + continue; + } + + var areArrays = className === '[object Array]'; + if (!areArrays && isTypedArray$1(a)) { + var byteLength = getByteLength(a); + if (byteLength !== getByteLength(b)) return false; + if (a.buffer === b.buffer && a.byteOffset === b.byteOffset) continue; + areArrays = true; + } + if (!areArrays) { + if (typeof a != 'object' || typeof b != 'object') return false; + + // Objects with different constructors are not equivalent, but `Object`s or `Array`s + // from different frames are. + var aCtor = a.constructor, bCtor = b.constructor; + if (aCtor !== bCtor && !(isFunction$1(aCtor) && aCtor instanceof aCtor && + isFunction$1(bCtor) && bCtor instanceof bCtor) + && ('constructor' in a && 'constructor' in b)) { + return false; + } + } - // Add the first object to the stack of traversed objects. - aStack.push(a); - bStack.push(b); + // Assume equality for cyclic structures. The algorithm for detecting cyclic + // structures is adapted from ES 5.1 section 15.12.3, abstract operation `JO`. - // Recursively compare objects and arrays. - if (areArrays) { - // Compare array lengths to determine if a deep comparison is necessary. - length = a.length; - if (length !== b.length) return false; - // Deep compare the contents, ignoring non-numeric properties. + var length = aStack.length; while (length--) { - if (!eq(a[length], b[length], aStack, bStack)) return false; + // Linear search. Performance is inversely proportional to the number of + // unique nested structures. + if (aStack[length] === a) { + // Cycle detected. Break out of the inner loop and continue the outer + // loop. Step 1: + if (bStack[length] === b) break; + return false; + } } - } else { - // Deep compare objects. - var _keys = keys(a), key; - length = _keys.length; - // Ensure that both objects contain the same number of properties before comparing deep equality. - if (keys(b).length !== length) return false; - while (length--) { - // Deep compare each member - key = _keys[length]; - if (!(has$1(b, key) && eq(a[key], b[key], aStack, bStack))) return false; + // Step 2, use `length` to verify whether we detected a cycle: + if (length >= 0) continue; + + // Add the first object to the stack of traversed objects. + aStack.push(a); + bStack.push(b); + // Remember to remove them again after the recursion below. + todo.push(true); + + // Recursively compare objects and arrays. + if (areArrays) { + // Compare array lengths to determine if a deep comparison is necessary. + length = a.length; + if (length !== b.length) return false; + // Deep compare the contents, ignoring non-numeric properties. + while (length--) { + todo.push({a: a[length], b: b[length]}); + } + } else { + // Deep compare objects. + var _keys = keys(a), key; + length = _keys.length; + // Ensure that both objects contain the same number of properties before comparing deep equality. + if (keys(b).length !== length) return false; + while (length--) { + // Deep compare each member + key = _keys[length]; + if (!has$1(b, key)) return false; + todo.push({a: a[key], b: b[key]}); + } } } - // Remove the first object from the stack of traversed objects. - aStack.pop(); - bStack.pop(); + // We made it to the end and found no differences. return true; } - // Perform a deep comparison to check if two objects are equal. - function isEqual(a, b) { - return eq(a, b); - } - // Retrieve all the enumerable property names of an object. function allKeys(obj) { if (!isObject(obj)) return []; @@ -1027,25 +1058,30 @@ var isArrayLike = createSizePropertyCheck(getLength); // Internal implementation of a recursive `flatten` function. - function flatten$1(input, depth, strict, output) { - output = output || []; - if (!depth && depth !== 0) { - depth = Infinity; - } else if (depth <= 0) { - return output.concat(input); - } - var idx = output.length; - for (var i = 0, length = getLength(input); i < length; i++) { - var value = input[i]; - if (isArrayLike(value) && (isArray(value) || isArguments$1(value))) { + function flatten$1(input, depth, strict) { + if (!depth && depth !== 0) depth = Infinity; + // We will be avoiding recursive calls because this could be exploited to + // cause a stack overflow (CVE-2026-27601). Instead, we "trampoline" on an + // explicit stack. + var output = [], idx = 0, i = 0, length = getLength(input) || 0, stack = []; + while (true) { + if (i >= length) { + if (!stack.length) break; + var frame = stack.pop(); + i = frame.i; + input = frame.v; + length = getLength(input); + continue; + } + var value = input[i++]; + if (stack.length >= depth) { + output[idx++] = value; + } else if (isArrayLike(value) && (isArray(value) || isArguments$1(value))) { // Flatten current level of array or arguments object. - if (depth > 1) { - flatten$1(value, depth - 1, strict, output); - idx = output.length; - } else { - var j = 0, len = value.length; - while (j < len) output[idx++] = value[j++]; - } + stack.push({i: i, v: input}); + i = 0; + input = value; + length = getLength(input); } else if (!strict) { output[idx++] = value; } @@ -1467,7 +1503,7 @@ function max(obj, iteratee, context) { var result = -Infinity, lastComputed = -Infinity, value, computed; - if (iteratee == null || typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null) { + if (iteratee == null || (typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null)) { obj = isArrayLike(obj) ? obj : values(obj); for (var i = 0, length = obj.length; i < length; i++) { value = obj[i]; @@ -1479,7 +1515,7 @@ iteratee = cb(iteratee, context); each(obj, function(v, index, list) { computed = iteratee(v, index, list); - if (computed > lastComputed || computed === -Infinity && result === -Infinity) { + if (computed > lastComputed || (computed === -Infinity && result === -Infinity)) { result = v; lastComputed = computed; } @@ -1492,7 +1528,7 @@ function min(obj, iteratee, context) { var result = Infinity, lastComputed = Infinity, value, computed; - if (iteratee == null || typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null) { + if (iteratee == null || (typeof iteratee == 'number' && typeof obj[0] != 'object' && obj != null)) { obj = isArrayLike(obj) ? obj : values(obj); for (var i = 0, length = obj.length; i < length; i++) { value = obj[i]; @@ -1504,7 +1540,7 @@ iteratee = cb(iteratee, context); each(obj, function(v, index, list) { computed = iteratee(v, index, list); - if (computed < lastComputed || computed === Infinity && result === Infinity) { + if (computed < lastComputed || (computed === Infinity && result === Infinity)) { result = v; lastComputed = computed; } @@ -1772,7 +1808,7 @@ // Complement of zip. Unzip accepts an array of arrays and groups // each array's elements on shared indices. function unzip(array) { - var length = array && max(array, getLength).length || 0; + var length = (array && max(array, getLength).length) || 0; var result = Array(length); for (var index = 0; index < length; index++) { @@ -2039,3 +2075,4 @@ return _; }))); +//# sourceMappingURL=underscore-umd.js.map