Skip to content

Commit 4527d5d

Browse files
archmojarchmoj
committed
Merge branch 'master' into autorange-bounds
2 parents 51ca21e + e824199 commit 4527d5d

36 files changed

+422
-109
lines changed

‎CHANGELOG.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,22 @@ To see all merged commits on the master branch that will be part of the next plo
99

1010
where X.Y.Z is the semver of most recent plotly.js release.
1111

12+
## [2.25.2] -- 2023-08-11
13+
14+
### Changed
15+
- Update Croatian translations in `hr` locale [[#6690](https://github.com/plotly/plotly.js/pull/6690)],
16+
with thanks to @Mkranj for the contribution!
17+
18+
### Fixed
19+
- Fix potential prototype pollution in plot API calls [[#6703](https://github.com/plotly/plotly.js/pull/6703), [6704](https://github.com/plotly/plotly.js/pull/6704)]
20+
21+
22+
## [2.25.1] -- 2023-08-02
23+
24+
### Fixed
25+
- Fix clearing legend using react (regression introduced in 2.25.0) [[#6695](https://github.com/plotly/plotly.js/pull/6695)]
26+
27+
1228
## [2.25.0] -- 2023-07-25
1329

1430
### Added

‎README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo
5555
5656
```html
5757
<head>
58-
<script src="https://cdn.plot.ly/plotly-2.25.0.min.js" charset="utf-8"></script>
58+
<script src="https://cdn.plot.ly/plotly-2.25.2.min.js" charset="utf-8"></script>
5959
</head>
6060
<body>
6161
<div id="gd"></div>
@@ -72,7 +72,7 @@ You may also consider using [`plotly.js-dist`](https://www.npmjs.com/package/plo
7272
Alternatively you may consider using [native ES6 import](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) in the script tag.
7373
```html
7474
<script type="module">
75-
import "https://cdn.plot.ly/plotly-2.25.0.min.js"
75+
import "https://cdn.plot.ly/plotly-2.25.2.min.js"
7676
Plotly.newPlot("gd", [{ y: [1, 2, 3] }])
7777
</script>
7878
```
@@ -82,7 +82,7 @@ Fastly supports Plotly.js with free CDN service. Read more at <https://www.fastl
8282
### Un-minified versions are also available on CDN
8383
While non-minified source files may contain characters outside UTF-8, it is recommended that you specify the `charset` when loading those bundles.
8484
```html
85-
<script src="https://cdn.plot.ly/plotly-2.25.0.js" charset="utf-8"></script>
85+
<script src="https://cdn.plot.ly/plotly-2.25.2.js" charset="utf-8"></script>
8686
```
8787

8888
> Please note that as of v2 the "plotly-latest" outputs (e.g. https://cdn.plot.ly/plotly-latest.min.js) will no longer be updated on the CDN, and will stay at the last v1 patch v1.58.5. Therefore, to use the CDN with plotly.js v2 and higher, you must specify an exact plotly.js version.

‎dist/README.md‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@ The main plotly.js bundles weight in at:
4646
| 8.1 MB | 3.4 MB | 1 MB | 8.4 MB |
4747

4848
#### CDN links
49-
> https://cdn.plot.ly/plotly-2.25.0.js
49+
> https://cdn.plot.ly/plotly-2.25.2.js
5050
51-
> https://cdn.plot.ly/plotly-2.25.0.min.js
51+
> https://cdn.plot.ly/plotly-2.25.2.min.js
5252
5353

5454
#### npm packages
@@ -91,12 +91,12 @@ The `basic` partial bundle contains trace modules `bar`, `pie` and `scatter`.
9191

9292
| Raw size | Minified size | Minified + gzip size |
9393
|------|-----------------|------------------------|
94-
| 2.6 MB | 969.3 kB | 324.3 kB |
94+
| 2.6 MB | 969.5 kB | 324.4 kB |
9595

9696
#### CDN links
97-
> https://cdn.plot.ly/plotly-basic-2.25.0.js
97+
> https://cdn.plot.ly/plotly-basic-2.25.2.js
9898
99-
> https://cdn.plot.ly/plotly-basic-2.25.0.min.js
99+
> https://cdn.plot.ly/plotly-basic-2.25.2.min.js
100100
101101

102102
#### npm packages
@@ -114,12 +114,12 @@ The `cartesian` partial bundle contains trace modules `bar`, `box`, `contour`, `
114114

115115
| Raw size | Minified size | Minified + gzip size |
116116
|------|-----------------|------------------------|
117-
| 3.3 MB | 1.2 MB | 410.4 kB |
117+
| 3.3 MB | 1.2 MB | 410.5 kB |
118118

119119
#### CDN links
120-
> https://cdn.plot.ly/plotly-cartesian-2.25.0.js
120+
> https://cdn.plot.ly/plotly-cartesian-2.25.2.js
121121
122-
> https://cdn.plot.ly/plotly-cartesian-2.25.0.min.js
122+
> https://cdn.plot.ly/plotly-cartesian-2.25.2.min.js
123123
124124

125125
#### npm packages
@@ -140,9 +140,9 @@ The `geo` partial bundle contains trace modules `choropleth`, `scatter` and `sca
140140
| 3.1 MB | 1.1 MB | 368.4 kB |
141141

142142
#### CDN links
143-
> https://cdn.plot.ly/plotly-geo-2.25.0.js
143+
> https://cdn.plot.ly/plotly-geo-2.25.2.js
144144
145-
> https://cdn.plot.ly/plotly-geo-2.25.0.min.js
145+
> https://cdn.plot.ly/plotly-geo-2.25.2.min.js
146146
147147

148148
#### npm packages
@@ -163,9 +163,9 @@ The `gl3d` partial bundle contains trace modules `cone`, `isosurface`, `mesh3d`,
163163
| 3.6 MB | 1.5 MB | 488.9 kB |
164164

165165
#### CDN links
166-
> https://cdn.plot.ly/plotly-gl3d-2.25.0.js
166+
> https://cdn.plot.ly/plotly-gl3d-2.25.2.js
167167
168-
> https://cdn.plot.ly/plotly-gl3d-2.25.0.min.js
168+
> https://cdn.plot.ly/plotly-gl3d-2.25.2.min.js
169169
170170

171171
#### npm packages
@@ -183,12 +183,12 @@ The `gl2d` partial bundle contains trace modules `heatmapgl`, `parcoords`, `poin
183183

184184
| Raw size | Minified size | Minified + gzip size |
185185
|------|-----------------|------------------------|
186-
| 4.4 MB | 1.8 MB | 594.8 kB |
186+
| 4.4 MB | 1.8 MB | 594.9 kB |
187187

188188
#### CDN links
189-
> https://cdn.plot.ly/plotly-gl2d-2.25.0.js
189+
> https://cdn.plot.ly/plotly-gl2d-2.25.2.js
190190
191-
> https://cdn.plot.ly/plotly-gl2d-2.25.0.min.js
191+
> https://cdn.plot.ly/plotly-gl2d-2.25.2.min.js
192192
193193

194194
#### npm packages
@@ -209,9 +209,9 @@ The `mapbox` partial bundle contains trace modules `choroplethmapbox`, `densitym
209209
| 4.3 MB | 1.7 MB | 525.6 kB |
210210

211211
#### CDN links
212-
> https://cdn.plot.ly/plotly-mapbox-2.25.0.js
212+
> https://cdn.plot.ly/plotly-mapbox-2.25.2.js
213213
214-
> https://cdn.plot.ly/plotly-mapbox-2.25.0.min.js
214+
> https://cdn.plot.ly/plotly-mapbox-2.25.2.min.js
215215
216216

217217
#### npm packages
@@ -232,9 +232,9 @@ The `finance` partial bundle contains trace modules `bar`, `candlestick`, `funne
232232
| 2.8 MB | 1 MB | 353 kB |
233233

234234
#### CDN links
235-
> https://cdn.plot.ly/plotly-finance-2.25.0.js
235+
> https://cdn.plot.ly/plotly-finance-2.25.2.js
236236
237-
> https://cdn.plot.ly/plotly-finance-2.25.0.min.js
237+
> https://cdn.plot.ly/plotly-finance-2.25.2.min.js
238238
239239

240240
#### npm packages
@@ -255,9 +255,9 @@ The `strict` partial bundle contains trace modules `bar`, `barpolar`, `box`, `ca
255255
| 8.6 MB | 3.7 MB | 1.1 MB |
256256

257257
#### CDN links
258-
> https://cdn.plot.ly/plotly-strict-2.25.0.js
258+
> https://cdn.plot.ly/plotly-strict-2.25.2.js
259259
260-
> https://cdn.plot.ly/plotly-strict-2.25.0.min.js
260+
> https://cdn.plot.ly/plotly-strict-2.25.2.min.js
261261
262262

263263
#### npm packages

‎dist/plotly-basic.js‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* plotly.js (basic) v2.25.0
2+
* plotly.js (basic) v2.25.2
33
* Copyright 2012-2023, Plotly, Inc.
44
* All rights reserved.
55
* Licensed under the MIT license
@@ -11255,7 +11255,6 @@ function drawOne(gd, opts) {
1125511255
trace: shapeLegend
1125611256
}]);
1125711257
}
11258-
if (!calcdata.length) return;
1125911258
legendData = fullLayout.showlegend && getLegendData(calcdata, legendObj, fullLayout._legends.length > 1);
1126011259
} else {
1126111260
if (!legendObj.entries) return;
@@ -25868,6 +25867,10 @@ lib.objectFromPath = function (path, value) {
2586825867
// the inner loop.
2586925868
var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
2587025869
var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
25870+
function notValid(prop) {
25871+
// guard against polluting __proto__ and other internals getters and setters
25872+
return prop.slice(0, 2) === '__';
25873+
}
2587125874
lib.expandObjectPaths = function (data) {
2587225875
var match, key, prop, datum, idx, dest, trailingPath;
2587325876
if (typeof data === 'object' && !Array.isArray(data)) {
@@ -25876,11 +25879,13 @@ lib.expandObjectPaths = function (data) {
2587625879
if (match = key.match(dottedPropertyRegex)) {
2587725880
datum = data[key];
2587825881
prop = match[1];
25882+
if (notValid(prop)) continue;
2587925883
delete data[key];
2588025884
data[prop] = lib.extendDeepNoArrays(data[prop] || {}, lib.objectFromPath(key, lib.expandObjectPaths(datum))[prop]);
2588125885
} else if (match = key.match(indexedPropertyRegex)) {
2588225886
datum = data[key];
2588325887
prop = match[1];
25888+
if (notValid(prop)) continue;
2588425889
idx = parseInt(match[2]);
2588525890
delete data[key];
2588625891
data[prop] = data[prop] || [];
@@ -25906,9 +25911,12 @@ lib.expandObjectPaths = function (data) {
2590625911
} else {
2590725912
// This is the case where this property is the end of the line,
2590825913
// e.g. xaxis.range[0]
25914+
25915+
if (notValid(prop)) continue;
2590925916
data[prop][idx] = lib.expandObjectPaths(datum);
2591025917
}
2591125918
} else {
25919+
if (notValid(key)) continue;
2591225920
data[key] = lib.expandObjectPaths(data[key]);
2591325921
}
2591425922
}
@@ -26833,13 +26841,19 @@ module.exports = function nestedProperty(container, propStr) {
2683326841
if (isNumeric(propStr)) propStr = String(propStr);else if (typeof propStr !== 'string' || propStr.substr(propStr.length - 4) === '[-1]') {
2683426842
throw 'bad property string';
2683526843
}
26836-
var j = 0;
2683726844
var propParts = propStr.split('.');
2683826845
var indexed;
2683926846
var indices;
26840-
var i;
26847+
var i, j;
26848+
for (j = 0; j < propParts.length; j++) {
26849+
// guard against polluting __proto__ and other internals
26850+
if (String(propParts[j]).slice(0, 2) === '__') {
26851+
throw 'bad property string';
26852+
}
26853+
}
2684126854

2684226855
// check for parts of the nesting hierarchy that are numbers (ie array elements)
26856+
j = 0;
2684326857
while (j < propParts.length) {
2684426858
// look for non-bracket chars, then any number of [##] blocks
2684526859
indexed = String(propParts[j]).match(/^([^\[\]]*)((\[\-?[0-9]*\])+)$/);
@@ -60287,7 +60301,7 @@ function getSortFunc(opts, d2c) {
6028760301

6028860302

6028960303
// package version injected by `npm run preprocess`
60290-
exports.version = '2.25.0';
60304+
exports.version = '2.25.2';
6029160305

6029260306
/***/ }),
6029360307

‎dist/plotly-basic.min.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/plotly-cartesian.js‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* plotly.js (cartesian) v2.25.0
2+
* plotly.js (cartesian) v2.25.2
33
* Copyright 2012-2023, Plotly, Inc.
44
* All rights reserved.
55
* Licensed under the MIT license
@@ -11345,7 +11345,6 @@ function drawOne(gd, opts) {
1134511345
trace: shapeLegend
1134611346
}]);
1134711347
}
11348-
if (!calcdata.length) return;
1134911348
legendData = fullLayout.showlegend && getLegendData(calcdata, legendObj, fullLayout._legends.length > 1);
1135011349
} else {
1135111350
if (!legendObj.entries) return;
@@ -25977,6 +25976,10 @@ lib.objectFromPath = function (path, value) {
2597725976
// the inner loop.
2597825977
var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
2597925978
var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
25979+
function notValid(prop) {
25980+
// guard against polluting __proto__ and other internals getters and setters
25981+
return prop.slice(0, 2) === '__';
25982+
}
2598025983
lib.expandObjectPaths = function (data) {
2598125984
var match, key, prop, datum, idx, dest, trailingPath;
2598225985
if (typeof data === 'object' && !Array.isArray(data)) {
@@ -25985,11 +25988,13 @@ lib.expandObjectPaths = function (data) {
2598525988
if (match = key.match(dottedPropertyRegex)) {
2598625989
datum = data[key];
2598725990
prop = match[1];
25991+
if (notValid(prop)) continue;
2598825992
delete data[key];
2598925993
data[prop] = lib.extendDeepNoArrays(data[prop] || {}, lib.objectFromPath(key, lib.expandObjectPaths(datum))[prop]);
2599025994
} else if (match = key.match(indexedPropertyRegex)) {
2599125995
datum = data[key];
2599225996
prop = match[1];
25997+
if (notValid(prop)) continue;
2599325998
idx = parseInt(match[2]);
2599425999
delete data[key];
2599526000
data[prop] = data[prop] || [];
@@ -26015,9 +26020,12 @@ lib.expandObjectPaths = function (data) {
2601526020
} else {
2601626021
// This is the case where this property is the end of the line,
2601726022
// e.g. xaxis.range[0]
26023+
26024+
if (notValid(prop)) continue;
2601826025
data[prop][idx] = lib.expandObjectPaths(datum);
2601926026
}
2602026027
} else {
26028+
if (notValid(key)) continue;
2602126029
data[key] = lib.expandObjectPaths(data[key]);
2602226030
}
2602326031
}
@@ -26942,13 +26950,19 @@ module.exports = function nestedProperty(container, propStr) {
2694226950
if (isNumeric(propStr)) propStr = String(propStr);else if (typeof propStr !== 'string' || propStr.substr(propStr.length - 4) === '[-1]') {
2694326951
throw 'bad property string';
2694426952
}
26945-
var j = 0;
2694626953
var propParts = propStr.split('.');
2694726954
var indexed;
2694826955
var indices;
26949-
var i;
26956+
var i, j;
26957+
for (j = 0; j < propParts.length; j++) {
26958+
// guard against polluting __proto__ and other internals
26959+
if (String(propParts[j]).slice(0, 2) === '__') {
26960+
throw 'bad property string';
26961+
}
26962+
}
2695026963

2695126964
// check for parts of the nesting hierarchy that are numbers (ie array elements)
26965+
j = 0;
2695226966
while (j < propParts.length) {
2695326967
// look for non-bracket chars, then any number of [##] blocks
2695426968
indexed = String(propParts[j]).match(/^([^\[\]]*)((\[\-?[0-9]*\])+)$/);
@@ -70700,7 +70714,7 @@ function getSortFunc(opts, d2c) {
7070070714

7070170715

7070270716
// package version injected by `npm run preprocess`
70703-
exports.version = '2.25.0';
70717+
exports.version = '2.25.2';
7070470718

7070570719
/***/ }),
7070670720

‎dist/plotly-cartesian.min.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)