fix: use expr-eval fork to fix security issue (#244)

tokens-studio · Jan 10, 2024 · 7409419 · 7409419
1 parent 8070158
commit 7409419
Show file tree

Hide file tree

Showing 4 changed files with 37 additions and 32 deletions.
diff --git a/.changeset/poor-singers-drop.md b/.changeset/poor-singers-drop.md
@@ -0,0 +1,5 @@
+---
+'@tokens-studio/sd-transforms': patch
+---
+
+Use expr-eval-fork to work around a prototype pollution vulnerability in the original package.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -43,7 +43,7 @@
     "color2k": "^2.0.1",
     "colorjs.io": "^0.4.3",
     "deepmerge": "^4.3.1",
-    "expr-eval": "^2.0.2",
+    "expr-eval-fork": "^2.0.2",
     "is-mergeable-object": "^1.1.1",
     "postcss-calc-ast-parser": "^0.1.4",
     "style-dictionary": "4.0.0-prerelease.7"

diff --git a/src/checkAndEvaluateMath.ts b/src/checkAndEvaluateMath.ts
@@ -1,4 +1,4 @@
-import { Parser } from 'expr-eval';
+import { Parser } from 'expr-eval-fork';
 import { parse, reduceExpression } from 'postcss-calc-ast-parser';
 
 const mathChars = ['+', '-', '*', '/'];