Bump to v4.17.21

README.md

@@ -1,4 +1,4 @@
-# lodash v4.17.20
+# lodash v4.17.21
 
 [Site](https://lodash.com/) |
 [Docs](https://lodash.com/docs) |
@@ -20,11 +20,11 @@ $ lodash core -o ./dist/lodash.core.js
 
 ## Download
 
- * [Core build](https://raw.githubusercontent.com/lodash/lodash/4.17.20/dist/lodash.core.js) ([~4 kB gzipped](https://raw.githubusercontent.com/lodash/lodash/4.17.20/dist/lodash.core.min.js))
- * [Full build](https://raw.githubusercontent.com/lodash/lodash/4.17.20/dist/lodash.js) ([~24 kB gzipped](https://raw.githubusercontent.com/lodash/lodash/4.17.20/dist/lodash.min.js))
+ * [Core build](https://raw.githubusercontent.com/lodash/lodash/4.17.21/dist/lodash.core.js) ([~4 kB gzipped](https://raw.githubusercontent.com/lodash/lodash/4.17.21/dist/lodash.core.min.js))
+ * [Full build](https://raw.githubusercontent.com/lodash/lodash/4.17.21/dist/lodash.js) ([~24 kB gzipped](https://raw.githubusercontent.com/lodash/lodash/4.17.21/dist/lodash.min.js))
  * [CDN copies](https://www.jsdelivr.com/projects/lodash)
 
-Lodash is released under the [MIT license](https://raw.githubusercontent.com/lodash/lodash/4.17.20/LICENSE) & supports modern environments.<br>
+Lodash is released under the [MIT license](https://raw.githubusercontent.com/lodash/lodash/4.17.21/LICENSE) & supports modern environments.<br>
 Review the [build differences](https://github.com/lodash/lodash/wiki/build-differences) & pick one that’s right for you.
 
 ## Installation

dist/lodash.core.js

@@ -13,7 +13,7 @@
  var undefined;
 
  /** Used as the semantic version number. */
- var VERSION = '4.17.20';
+ var VERSION = '4.17.21';
 
  /** Error message constants. */
  var FUNC_ERROR_TEXT = 'Expected a function';

dist/lodash.js

@@ -12,14 +12,15 @@
  var undefined;
 
  /** Used as the semantic version number. */
- var VERSION = '4.17.20';
+ var VERSION = '4.17.21';
 
  /** Used as the size to enable large array optimizations. */
  var LARGE_ARRAY_SIZE = 200;
 
  /** Error message constants. */
  var CORE_ERROR_TEXT = 'Unsupported core-js use. Try https://npms.io/search?q=ponyfill.',
- FUNC_ERROR_TEXT = 'Expected a function';
+ FUNC_ERROR_TEXT = 'Expected a function',
+ INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
 
  /** Used to stand-in for `undefined` hash values. */
  var HASH_UNDEFINED = '__lodash_hash_undefined__';
@@ -152,10 +153,11 @@
  var reRegExpChar = /[\\^$.*+?()[\]{}|]/g,
  reHasRegExpChar = RegExp(reRegExpChar.source);
 
- /** Used to match leading and trailing whitespace. */
- var reTrim = /^\s+|\s+$/g,
- reTrimStart = /^\s+/,
- reTrimEnd = /\s+$/;
+ /** Used to match leading whitespace. */
+ var reTrimStart = /^\s+/;
+
+ /** Used to match a single whitespace character. */
+ var reWhitespace = /\s/;
 
  /** Used to match wrap detail comments. */
  var reWrapComment = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/,
@@ -165,6 +167,18 @@
  /** Used to match words composed of alphanumeric characters. */
  var reAsciiWord = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g;
 
+ /**
+ * Used to validate the `validate` option in `_.template` variable.
+ *
+ * Forbids characters which could potentially change the meaning of the function argument definition:
+ * - "()," (modification of function parameters)
+ * - "=" (default value)
+ * - "[]{}" (destructuring of function parameters)
+ * - "/" (beginning of a comment)
+ * - whitespace
+ */
+ var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
+
  /** Used to match backslashes in property paths. */
  var reEscapeChar = /\\(\\)?/g;
 
@@ -993,6 +1007,19 @@
  });
  }
 
+ /**
+ * The base implementation of `_.trim`.
+ *
+ * @private
+ * @param {string} string The string to trim.
+ * @returns {string} Returns the trimmed string.
+ */
+ function baseTrim(string) {
+ return string
+ ? string.slice(0, trimmedEndIndex(string) + 1).replace(reTrimStart, '')
+ : string;
+ }
+
  /**
  * The base implementation of `_.unary` without support for storing metadata.
  *
@@ -1326,6 +1353,21 @@
  : asciiToArray(string);
  }
 
+ /**
+ * Used by `_.trim` and `_.trimEnd` to get the index of the last non-whitespace
+ * character of `string`.
+ *
+ * @private
+ * @param {string} string The string to inspect.
+ * @returns {number} Returns the index of the last non-whitespace character.
+ */
+ function trimmedEndIndex(string) {
+ var index = string.length;
+
+ while (index-- && reWhitespace.test(string.charAt(index))) {}
+ return index;
+ }
+
  /**
  * Used by `_.unescape` to convert HTML entities to characters.
  *
@@ -12494,7 +12536,7 @@
  if (typeof value != 'string') {
  return value === 0 ? value : +value;
  }
- value = value.replace(reTrim, '');
+ value = baseTrim(value);
  var isBinary = reIsBinary.test(value);
  return (isBinary || reIsOctal.test(value))
  ? freeParseInt(value.slice(2), isBinary ? 2 : 8)
@@ -14866,6 +14908,12 @@
  if (!variable) {
  source = 'with (obj) {\n' + source + '\n}\n';
  }
+ // Throw an error if a forbidden character was found in `variable`, to prevent
+ // potential command injection attacks.
+ else if (reForbiddenIdentifierChars.test(variable)) {
+ throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
+ }
+
  // Cleanup code by stripping empty strings.
  source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
  .replace(reEmptyStringMiddle, '$1')
@@ -14979,7 +15027,7 @@
  function trim(string, chars, guard) {
  string = toString(string);
  if (string && (guard || chars === undefined)) {
- return string.replace(reTrim, '');
+ return baseTrim(string);
  }
  if (!string || !(chars = baseToString(chars))) {
  return string;
@@ -15014,7 +15062,7 @@
  function trimEnd(string, chars, guard) {
  string = toString(string);
  if (string && (guard || chars === undefined)) {
- return string.replace(reTrimEnd, '');
+ return string.slice(0, trimmedEndIndex(string) + 1);
  }
  if (!string || !(chars = baseToString(chars))) {
  return string;