Unfortunately, bumping static-module to the unvulnerable 2.x series won't be trivial.

Changes from PRs browserify/static-eval#18 and browserify/static-module#38 appear to be incompatible with cwise.

From my findings, static-module fails (i.e. does not transform cwise({args: [], body: () => {}}) expressions) whenever body() mutates one if its input arguments.

For example, with

// cmd.js
var fs = require('fs')
var sm = require('./lib/cwise-transform')()

process.stdin.pipe(sm).pipe(process.stdout)

// works.js
var cwise = require('cwise')
var f = cwise({
  args: ["array"],
  body: function() {
      return 'yo'
  },
})

// fails.js
var cwise = require('cwise')
var f = cwise({
  args: ["array"],
  body: function(a) {
      ++a
  },
})

then, node cmd.js < works.js works just fine (but doesn't do anything 😏 ), and node cmd.js < fails.js outputs:

var f = cwise({
  args: ["array"],
  body: function(a) {
      ++a
  }
})

that is, it correctly removes the require statement, but ignores the cwise call.

Thanks for looking at it. I tried to update the dependency but the tests are failing (I am on windows and not familiar with these libs).
But I am able to run the examples which are in the example dir.

+1

@alhugot I believe your patch in https://github.com/alhugot/cwise/commit/39b4ad8a1c67d94903bdc139e59bc764e59bad6f defeats the purpose of browserify suite where cwise is used as a transform.

To double-check, would you mind comparing the output of browserify -t cwise test/fill.js using old and new static-module versions?

@etpinard I am sorry I don't know much about browserify. Do you mean changing
var cwise = require("cwise") to var cwise = require("../cwise") in the unit test?

ok I see, I have look at https://github.com/scijs/ndarray-fill module which use cwise and indeed the transform is wrong, as in your example. Sorry a bit slow on this one.

. Sorry a bit slow on this one.

No worries. Thanks for the help!

+1

@etpinard browserify -t cwise test/fill.js outputs are the same with static-module@2.2.5

@hakandilek thanks for the headsup, but npm test fails for me with static-module@2.2.5.

Check out my linked pull request.

Ha. Sorry I missed that. Thanks for the PR.

any update on this issue ?

potential security vulnerability +1

Hello! Is there any update on this one...Is this #21 successfully merged?

Thank you!