From d6f704d0ad859e47ca8e947f41b8f1073d2cb857 Mon Sep 17 00:00:00 2001 From: anupamme Date: Mon, 17 Aug 2026 00:41:51 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- bindings/pre.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/bindings/pre.js b/bindings/pre.js index da1db4c0..9841242b 100644 --- a/bindings/pre.js +++ b/bindings/pre.js @@ -1,3 +1,11 @@ import { writeFileSync } from 'node:fs' +import { createHash } from 'node:crypto' -writeFileSync(`v8-fast-api-calls.h`, await (await fetch(`https://raw.githubusercontent.com/v8/v8/refs/tags/${process.versions.v8.substring(0, process.versions.v8.indexOf('-'))}/include/v8-fast-api-calls.h`)).text()) +const url = `https://raw.githubusercontent.com/v8/v8/refs/tags/${process.versions.v8.substring(0, process.versions.v8.indexOf('-'))}/include/v8-fast-api-calls.h` +const response = await fetch(url) +if (!response.ok) throw new Error(`Failed to fetch ${url}: ${response.status}`) +const content = await response.text() +if (!content.includes('#ifndef INCLUDE_V8_FAST_API_CALLS_H_') || !content.includes('namespace v8')) { + throw new Error(`Integrity check failed for v8-fast-api-calls.h (sha256: ${createHash('sha256').update(content).digest('hex')})`) +} +writeFileSync(`v8-fast-api-calls.h`, content)