[Pkg-javascript-devel] Bug#1144874: highlight.js: Debian provided deep-freeze-es6 breaks freezing nested objects

[Blair Noctis]

Source: highlight.js
Version: 10.7.3+dfsg-5
Severity: grave
Justification: renders package unusable
Tags: patch
X-Debbugs-Cc: debian-js at lists.debian.org, ncts at debian.org

Dear Maintainer,

Debian provided deep-freeze-es6 (under debian/build_modules) breaks freezing
nested objects, by recursively freezing properties of an object without first
checking if a property object has already been frozen, causing errors such as:

Uncaught TypeError: "begin" is read-only
    deepFreeze http://localhost:3000/highlight-1bbf5e38.js:16
    HLJS http://localhost:3000/highlight-1bbf5e38.js:2493
    hljs http://localhost:3000/highlight-1bbf5e38.js:2508
    <anonymous> http://localhost:3000/highlight-1bbf5e38.js:2512

In this concrete example, APOS_STRING_MODE first gets frozen. Due to
aforementioned problem, APOS_STRING_MODE.contains.0, which is BACKSLASH_ESCAPE,
is also frozen. Then, later when BACKSLASH_ESCAPE itself gets frozen again (or
maybe being frozen again as something else's .contains.0, or maybe in a reverse
order), this error is thrown.

Upstream uses a `!Object.isFrozen(prop)` check to avoid this problem, see
https://github.com/christophehurpeau/deep-freeze-es6/blob/c1b69815/lib/index.js#L49

The fix is simple:

diff --git a/debian/build_modules/deep-freeze-es6/index.js b/debian/build_modules/deep-freeze-es6/index.js
index 50ef5d2..47c87de 100644
--- a/debian/build_modules/deep-freeze-es6/index.js
+++ b/debian/build_modules/deep-freeze-es6/index.js
@@ -5,7 +5,9 @@ export function deepFreeze(obj) {
   // On gèle les propriétés avant de geler l'objet
   for (let name of propNames) {
     let value = obj[name];
-    obj[name] = value && typeof value === "object" ? deepFreeze(value) : value;
+    if ((typeof value === "object" || typeof value === "function") && !Object.isFrozen(value)) {
+      deepFreeze(value)
+    }
   }

   // On gèle l'objet initial

-- 
    ,Sdrager
Blair Noctis

🇵🇸
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-javascript-devel/attachments/20260819/42980c77/attachment.sig>