check that currentScript is set by a script tag (#3863)

lkuechler · web-flow · commit 8e8b9352dac6 · 2025-03-07T19:32:05.000-05:00
Based on: https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 Should resolve: https://osv.dev/vulnerability/GHSA-x7hr-w5r2-h6wg
diff --git a/components/prism-core.js b/components/prism-core.js
@@ -222,7 +222,7 @@ var Prism = (function (_self) {
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}
 
diff --git a/components/prism-core.min.js b/components/prism-core.min.js
diff --git a/docs/prism-core.js.html b/docs/prism-core.js.html
@@ -275,7 +275,7 @@ <h1 class="page-title">prism-core.js</h1>
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document &amp;&amp; 1 &lt; 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript &amp;&amp; document.currentScript.tagName === 'SCRIPT' &amp;&amp; 1 &lt; 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}
 
diff --git a/prism.js b/prism.js
@@ -227,7 +227,7 @@ var Prism = (function (_self) {
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}
 

Original file line number	Diff line number	Diff line change
`@@ -222,7 +222,7 @@ var Prism = (function (_self) {`
`222`	`222`	`if (typeof document === 'undefined') {`
`223`	`223`	`return null;`
`224`	`224`	`}`
`225`		`- if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {`
	`225`	`+ if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {`
`226`	`226`	`return /** @type {any} */ (document.currentScript);`
`227`	`227`	`}`
`228`	`228`
Original file line number	Diff line number	Diff line change
`@@ -275,7 +275,7 @@ <h1 class="page-title">prism-core.js</h1>`
`275`	`275`	`if (typeof document === 'undefined') {`
`276`	`276`	`return null;`
`277`	`277`	`}`
`278`		`- if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {`
	`278`	`+ if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {`
`279`	`279`	`return /** @type {any} */ (document.currentScript);`
`280`	`280`	`}`
`281`	`281`
Original file line number	Diff line number	Diff line change
`@@ -227,7 +227,7 @@ var Prism = (function (_self) {`
`227`	`227`	`if (typeof document === 'undefined') {`
`228`	`228`	`return null;`
`229`	`229`	`}`
`230`		`- if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {`
	`230`	`+ if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {`
`231`	`231`	`return /** @type {any} */ (document.currentScript);`
`232`	`232`	`}`
`233`	`233`