This is an automated email from the ASF dual-hosted git repository.
dhavaljrajpara pushed a commit to branch ranger-2.9
in repository https://gitbox.apache.org/repos/asf/ranger.git
The following commit(s) were added to refs/heads/ranger-2.9 by this push:
new 1566016fe RANGER-5518 : Ranger: Upgrade underscore.js to 1.13.8 (#1060)
1566016fe is described below
commit 1566016fe301576d3ace9ef5c1c5443f22bc04c8
Author: Dhaval Rajpara <[email protected]>
AuthorDate: Fri Jul 10 14:25:10 2026 +0530
RANGER-5518 : Ranger: Upgrade underscore.js to 1.13.8 (#1060)
---
.../webapp/libs/bower/underscore/js/underscore.js | 309 ++++++++++++---------
1 file changed, 173 insertions(+), 136 deletions(-)
diff --git
a/security-admin/src/main/webapp/libs/bower/underscore/js/underscore.js
b/security-admin/src/main/webapp/libs/bower/underscore/js/underscore.js
index 337af14f6..37a16c014 100644
--- a/security-admin/src/main/webapp/libs/bower/underscore/js/underscore.js
+++ b/security-admin/src/main/webapp/libs/bower/underscore/js/underscore.js
@@ -1,19 +1,23 @@
-(function (global, factory) {
- typeof exports === 'object' && typeof module !== 'undefined' ?
module.exports = factory() :
- typeof define === 'function' && define.amd ? define('underscore', factory) :
- (global = typeof globalThis !== 'undefined' ? globalThis : global || self,
(function () {
- var current = global._;
- var exports = global._ = factory();
- exports.noConflict = function () { global._ = current; return exports; };
- }()));
-}(this, (function () {
- // Underscore.js 1.13.6
+(function (root, factory) {
+ var underscore = factory();
+
+ if (typeof define === 'function' && define.amd) {
+ // 1. Register for AMD (RequireJS)
+ define('underscore', [], function() { return underscore; });
+ }
+
+ // 2. ALWAYS attach to global window for legacy scripts
+ // This fixes the "Uncaught ReferenceError: _ is not defined"
+ root._ = underscore;
+
+}(this, function () {
+ // Underscore.js 1.13.8
// https://underscorejs.org
- // (c) 2009-2022 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud
and Investigative Reporters & Editors
+ // (c) 2009-2026 Jeremy Ashkenas, Julian Gonggrijp, and DocumentCloud
and Investigative Reporters & Editors
// Underscore may be freely distributed under the MIT license.
// Current version.
- var VERSION = '1.13.6';
+ var VERSION = '1.13.8';
// Establish the root object, `window` (`self`) in the browser, `global`
// on the server, or `this` in some virtual machines. We use `self`
@@ -150,8 +154,11 @@
// In IE 10 - Edge 13, `DataView` has string tag `'[object Object]'`.
// In IE 11, the most common among them, this problem also applies to
// `Map`, `WeakMap` and `Set`.
- var hasStringTagBug = (
- supportsDataView && hasObjectTag(new DataView(new ArrayBuffer(8)))
+ // Also, there are cases where an application can override the native
+ // `DataView` object, in cases like that we can't use the constructor
+ // safely and should just rely on alternate `DataView` checks
+ var hasDataViewBug = (
+ supportsDataView && (!/\[native code\]/.test(String(DataView)) ||
hasObjectTag(new DataView(new ArrayBuffer(8))))
),
isIE11 = (typeof Map !== 'undefined' && hasObjectTag(new Map));
@@ -159,11 +166,13 @@
// In IE 10 - Edge 13, we need a different heuristic
// to determine whether an object is a `DataView`.
- function ie10IsDataView(obj) {
+ // Also, in cases where the native `DataView` is
+ // overridden we can't rely on the tag itself.
+ function alternateIsDataView(obj) {
return obj != null && isFunction$1(obj.getInt8) &&
isArrayBuffer(obj.buffer);
}
- var isDataView$1 = (hasStringTagBug ? ie10IsDataView : isDataView);
+ var isDataView$1 = (hasDataViewBug ? alternateIsDataView : isDataView);
// Is a given value an array?
// Delegates to ECMA5's native `Array.isArray`.
@@ -352,131 +361,156 @@
// We use this string twice, so give it a name for minification.
var tagDataView = '[object DataView]';
- // Internal recursive comparison function for `_.isEqual`.
- function eq(a, b, aStack, bStack) {
- // Identical objects are equal. `0 === -0`, but they aren't identical.
- // See the [Harmony `egal`
proposal](https://wiki.ecmascript.org/doku.php?id=harmony:egal).
- if (a === b) return a !== 0 || 1 / a === 1 / b;
- // `null` or `undefined` only equal to itself (strict comparison).
- if (a == null || b == null) return false;
- // `NaN`s are equivalent, but non-reflexive.
- if (a !== a) return b !== b;
- // Exhaust primitive checks
- var type = typeof a;
- if (type !== 'function' && type !== 'object' && typeof b != 'object')
return false;
- return deepEq(a, b, aStack, bStack);
- }
-
- // Internal recursive comparison function for `_.isEqual`.
- function deepEq(a, b, aStack, bStack) {
- // Unwrap any wrapped objects.
- if (a instanceof _$1) a = a._wrapped;
- if (b instanceof _$1) b = b._wrapped;
- // Compare `[[Class]]` names.
- var className = toString.call(a);
- if (className !== toString.call(b)) return false;
- // Work around a bug in IE 10 - Edge 13.
- if (hasStringTagBug && className == '[object Object]' && isDataView$1(a)) {
- if (!isDataView$1(b)) return false;
- className = tagDataView;
- }
- switch (className) {
- // These types are compared by value.
+ // Perform a deep comparison to check if two objects are equal.
+ function isEqual(a, b) {
+ // Keep track of which pairs of values need to be compared. We will be
+ // trampolining on this stack instead of using function recursion.
+ // (CVE-2026-27601)
+ var todo = [{a: a, b: b}];
+ // Initializing stacks of traversed objects for cycle detection.
+ var aStack = [], bStack = [];
+
+ // Keep traversing pairs until there is nothing left to compare.
+ while (todo.length) {
+ var frame = todo.pop();
+ // As a special case, a single `true` on the todo means that we can
+ // unwind the cycle detection stacks.
+ if (frame === true) {
+ // Remove the first object from the stack of traversed objects.
+ aStack.pop();
+ bStack.pop();
+ continue;
+ }
+ a = frame.a;
+ b = frame.b;
+
+ // Identical objects are equal. `0 === -0`, but they aren't identical.
+ // See the [Harmony `egal`
proposal](https://wiki.ecmascript.org/doku.php?id=harmony:egal).
+ if (a === b) {
+ if (a !== 0 || 1 / a === 1 / b) continue;
+ return false;
+ }
+ // `null` or `undefined` only equal to itself (strict comparison).
+ if (a == null || b == null) return false;
+ // `NaN`s are equivalent, but non-reflexive.
+ if (a !== a) {
+ if (b !== b) continue;
+ return false;
+ }
+ // Exhaust primitive checks
+ var type = typeof a;
+ if (type !== 'function' && type !== 'object' && typeof b != 'object')
return false;
+
+ // Unwrap any wrapped objects.
+ if (a instanceof _$1) a = a._wrapped;
+ if (b instanceof _$1) b = b._wrapped;
+ // Compare `[[Class]]` names.
+ var className = toString.call(a);
+ if (className !== toString.call(b)) return false;
+ // Work around a bug in IE 10 - Edge 13.
+ if (hasDataViewBug && className == '[object Object]' && isDataView$1(a))
{
+ if (!isDataView$1(b)) return false;
+ className = tagDataView;
+ }
+ switch (className) {
+ // These types are compared by value.
case '[object RegExp]':
// RegExps are coerced to strings for comparison (Note: '' + /a/i ===
'/a/i')
case '[object String]':
// Primitives and their corresponding object wrappers are equivalent;
thus, `"5"` is
// equivalent to `new String("5")`.
- return '' + a === '' + b;
+ if ('' + a === '' + b) continue;
+ return false;
case '[object Number]':
- // `NaN`s are equivalent, but non-reflexive.
- // Object(NaN) is equivalent to NaN.
- if (+a !== +a) return +b !== +b;
- // An `egal` comparison is performed for other numeric values.
- return +a === 0 ? 1 / +a === 1 / b : +a === +b;
+ todo.push({a: +a, b: +b});
+ continue;
case '[object Date]':
case '[object Boolean]':
// Coerce dates and booleans to numeric primitive values. Dates are
compared by their
// millisecond representations. Note that invalid dates with
millisecond representations
// of `NaN` are not equivalent.
- return +a === +b;
+ if (+a === +b) continue;
+ return false;
case '[object Symbol]':
- return SymbolProto.valueOf.call(a) === SymbolProto.valueOf.call(b);
+ if (SymbolProto.valueOf.call(a) === SymbolProto.valueOf.call(b))
continue;
+ return false;
case '[object ArrayBuffer]':
case tagDataView:
// Coerce to typed array so we can fall through.
- return deepEq(toBufferView(a), toBufferView(b), aStack, bStack);
- }
+ todo.push({a: toBufferView(a), b: toBufferView(b)});
+ continue;
+ }
- var areArrays = className === '[object Array]';
- if (!areArrays && isTypedArray$1(a)) {
+ var areArrays = className === '[object Array]';
+ if (!areArrays && isTypedArray$1(a)) {
var byteLength = getByteLength(a);
if (byteLength !== getByteLength(b)) return false;
- if (a.buffer === b.buffer && a.byteOffset === b.byteOffset) return
true;
+ if (a.buffer === b.buffer && a.byteOffset === b.byteOffset) continue;
areArrays = true;
- }
- if (!areArrays) {
- if (typeof a != 'object' || typeof b != 'object') return false;
-
- // Objects with different constructors are not equivalent, but `Object`s
or `Array`s
- // from different frames are.
- var aCtor = a.constructor, bCtor = b.constructor;
- if (aCtor !== bCtor && !(isFunction$1(aCtor) && aCtor instanceof aCtor &&
- isFunction$1(bCtor) && bCtor instanceof bCtor)
- && ('constructor' in a && 'constructor' in b)) {
- return false;
}
- }
- // Assume equality for cyclic structures. The algorithm for detecting
cyclic
- // structures is adapted from ES 5.1 section 15.12.3, abstract operation
`JO`.
-
- // Initializing stack of traversed objects.
- // It's done here since we only need them for objects and arrays
comparison.
- aStack = aStack || [];
- bStack = bStack || [];
- var length = aStack.length;
- while (length--) {
- // Linear search. Performance is inversely proportional to the number of
- // unique nested structures.
- if (aStack[length] === a) return bStack[length] === b;
- }
+ if (!areArrays) {
+ if (typeof a != 'object' || typeof b != 'object') return false;
+
+ // Objects with different constructors are not equivalent, but
`Object`s or `Array`s
+ // from different frames are.
+ var aCtor = a.constructor, bCtor = b.constructor;
+ if (aCtor !== bCtor && !(isFunction$1(aCtor) && aCtor instanceof aCtor
&&
+ isFunction$1(bCtor) && bCtor instanceof bCtor)
+ && ('constructor' in a && 'constructor' in b)) {
+ return false;
+ }
+ }
- // Add the first object to the stack of traversed objects.
- aStack.push(a);
- bStack.push(b);
+ // Assume equality for cyclic structures. The algorithm for detecting
cyclic
+ // structures is adapted from ES 5.1 section 15.12.3, abstract operation
`JO`.
- // Recursively compare objects and arrays.
- if (areArrays) {
- // Compare array lengths to determine if a deep comparison is necessary.
- length = a.length;
- if (length !== b.length) return false;
- // Deep compare the contents, ignoring non-numeric properties.
+ var length = aStack.length;
while (length--) {
- if (!eq(a[length], b[length], aStack, bStack)) return false;
+ // Linear search. Performance is inversely proportional to the number
of
+ // unique nested structures.
+ if (aStack[length] === a) {
+ // Cycle detected. Break out of the inner loop and continue the outer
+ // loop. Step 1:
+ if (bStack[length] === b) break;
+ return false;
+ }
}
- } else {
- // Deep compare objects.
- var _keys = keys(a), key;
- length = _keys.length;
- // Ensure that both objects contain the same number of properties before
comparing deep equality.
- if (keys(b).length !== length) return false;
- while (length--) {
- // Deep compare each member
- key = _keys[length];
- if (!(has$1(b, key) && eq(a[key], b[key], aStack, bStack))) return
false;
+ // Step 2, use `length` to verify whether we detected a cycle:
+ if (length >= 0) continue;
+
+ // Add the first object to the stack of traversed objects.
+ aStack.push(a);
+ bStack.push(b);
+ // Remember to remove them again after the recursion below.
+ todo.push(true);
+
+ // Recursively compare objects and arrays.
+ if (areArrays) {
+ // Compare array lengths to determine if a deep comparison is
necessary.
+ length = a.length;
+ if (length !== b.length) return false;
+ // Deep compare the contents, ignoring non-numeric properties.
+ while (length--) {
+ todo.push({a: a[length], b: b[length]});
+ }
+ } else {
+ // Deep compare objects.
+ var _keys = keys(a), key;
+ length = _keys.length;
+ // Ensure that both objects contain the same number of properties
before comparing deep equality.
+ if (keys(b).length !== length) return false;
+ while (length--) {
+ // Deep compare each member
+ key = _keys[length];
+ if (!has$1(b, key)) return false;
+ todo.push({a: a[key], b: b[key]});
+ }
}
}
- // Remove the first object from the stack of traversed objects.
- aStack.pop();
- bStack.pop();
+ // We made it to the end and found no differences.
return true;
}
- // Perform a deep comparison to check if two objects are equal.
- function isEqual(a, b) {
- return eq(a, b);
- }
-
// Retrieve all the enumerable property names of an object.
function allKeys(obj) {
if (!isObject(obj)) return [];
@@ -1026,26 +1060,31 @@
// Avoids a very nasty iOS 8 JIT bug on ARM-64. #2094
var isArrayLike = createSizePropertyCheck(getLength);
- // Internal implementation of a recursive `flatten` function.
- function flatten$1(input, depth, strict, output) {
- output = output || [];
- if (!depth && depth !== 0) {
- depth = Infinity;
- } else if (depth <= 0) {
- return output.concat(input);
- }
- var idx = output.length;
- for (var i = 0, length = getLength(input); i < length; i++) {
- var value = input[i];
- if (isArrayLike(value) && (isArray(value) || isArguments$1(value))) {
+ // Internal implementation of a `flatten` function.
+ function flatten$1(input, depth, strict) {
+ if (!depth && depth !== 0) depth = Infinity;
+ // We will be avoiding recursive calls because this could be exploited to
+ // cause a stack overflow (CVE-2026-27601). Instead, we "trampoline" on an
+ // explicit stack.
+ var output = [], idx = 0, i = 0, length = getLength(input) || 0, stack =
[];
+ while (true) {
+ if (i >= length) {
+ if (!stack.length) break;
+ var frame = stack.pop();
+ i = frame.i;
+ input = frame.v;
+ length = getLength(input);
+ continue;
+ }
+ var value = input[i++];
+ if (stack.length >= depth) {
+ output[idx++] = value;
+ } else if (isArrayLike(value) && (isArray(value) ||
isArguments$1(value))) {
// Flatten current level of array or arguments object.
- if (depth > 1) {
- flatten$1(value, depth - 1, strict, output);
- idx = output.length;
- } else {
- var j = 0, len = value.length;
- while (j < len) output[idx++] = value[j++];
- }
+ stack.push({i: i, v: input});
+ i = 0;
+ input = value;
+ length = getLength(input);
} else if (!strict) {
output[idx++] = value;
}
@@ -2032,11 +2071,9 @@
// Default Export
// Add all of the Underscore functions to the wrapper object.
- _ = mixin(allExports);
- // Legacy Node.js API.
- _._ = _;
+ var _ = mixin(allExports);
+ _._ = _;
return _;
-})));
-//# sourceMappingURL=underscore-umd.js.map
\ No newline at end of file
+}));
\ No newline at end of file
