.github/workflows/nodejs.yml

@@ -0,0 +1,82 @@
+name: loader-utils
+
+on:
+  push:
+    branches:
+      - master
+      - next
+  pull_request:
+    branches:
+      - master
+      - next
+
+jobs:
+  lint:
+    name: Lint - ${{ matrix.os }} - Node v${{ matrix.node-version }}
+
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        node-version: [12.x]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn
+
+      - name: Lint
+        run: yarn lint
+
+      - name: Security audit
+        run: yarn audit
+
+      - name: Check commit message
+        uses: wagoid/commitlint-github-action@v4
+
+  test:
+    name: Test - ${{ matrix.os }} - Node v${{ matrix.node-version }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        node-version: [8.x, 10.x, 12.x, 14.x, 16.x, 17.x]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Setup Git
+        if: matrix.os == 'windows-latest'
+        run: git config --global core.autocrlf input
+
+      - uses: actions/checkout@v2
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v2
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'yarn'
+
+      - name: Install dependencies
+        run: yarn
+
+      - name: Run tests
+        run: yarn test
+
+      - name: Submit coverage data to codecov
+        uses: codecov/codecov-action@v2
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}

CHANGELOG.md

@@ -1,7 +1,37 @@
-# Change Log
+# Changelog
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [2.0.3](https://github.com/webpack/loader-utils/compare/v2.0.1...v2.0.3) (2022-10-20)
+
+
+### Bug Fixes
+
+* **security:** prototype pollution exploit ([#217](https://github.com/webpack/loader-utils/issues/217)) ([a93cf6f](https://github.com/webpack/loader-utils/commit/a93cf6f4702012030f6b5ee8340d5c95ec1c7d4c))
+
+### [2.0.2](https://github.com/webpack/loader-utils/compare/v2.0.1...v2.0.2) (2021-11-04)
+
+
+### Bug Fixes
+
+* base64 generation and unicode characters ([#197](https://github.com/webpack/loader-utils/issues/197)) ([8c2d24e](https://github.com/webpack/loader-utils/commit/8c2d24ee400bc4567335e97ee6004c3baa6ef66f))
+
+### [2.0.1](https://github.com/webpack/loader-utils/compare/v2.0.0...v2.0.1) (2021-10-29)
+
+
+### Bug Fixes
+
+* md4 support on Node.js v17 ([#193](https://github.com/webpack/loader-utils/issues/193)) ([1069f61](https://github.com/webpack/loader-utils/commit/1069f61284a571614ee4acdde6e6087174be118a))
+
+## [2.0.0](https://github.com/webpack/loader-utils/compare/v1.4.0...v2.0.0) (2020-03-17)
+
+
+### ⚠ BREAKING CHANGES
+
+* minimum required `Node.js` version is `8.9.0` ([#166](https://github.com/webpack/loader-utils/issues/166)) ([c937e8c](https://github.com/webpack/loader-utils/commit/c937e8c77231b42018be616b784a6b45eac86f8a))
+* the `getOptions` method returns empty object on empty query ([#167](https://github.com/webpack/loader-utils/issues/167)) ([b595cfb](https://github.com/webpack/loader-utils/commit/b595cfba022d3f04f3d310dd570b0253e461605b))
+* Use `md4` by default
+
 <a name="1.4.0"></a>
 # [1.4.0](https://github.com/webpack/loader-utils/compare/v1.3.0...v1.4.0) (2020-02-19)
 

README.md

@@ -180,14 +180,14 @@ The following tokens are replaced in the `name` parameter:
 * `[query]` the queryof the resource, i.e. `?foo=bar`
 * `[emoji]` a random emoji representation of `options.content`
 * `[emoji:<length>]` same as above, but with a customizable number of emojis
-* `[contenthash]` the hash of `options.content` (Buffer) (by default it's the hex digest of the md5 hash)
+* `[contenthash]` the hash of `options.content` (Buffer) (by default it's the hex digest of the md4 hash)
 * `[<hashType>:contenthash:<digestType>:<length>]` optionally one can configure
-  * other `hashType`s, i. e. `sha1`, `md5`, `sha256`, `sha512`
+  * other `hashType`s, i. e. `sha1`, `md4`, `md5`, `sha256`, `sha512`
   * other `digestType`s, i. e. `hex`, `base26`, `base32`, `base36`, `base49`, `base52`, `base58`, `base62`, `base64`
   * and `length` the length in chars
-* `[hash]` the hash of `options.content` (Buffer) (by default it's the hex digest of the md5 hash)
+* `[hash]` the hash of `options.content` (Buffer) (by default it's the hex digest of the md4 hash)
 * `[<hashType>:hash:<digestType>:<length>]` optionally one can configure
-  * other `hashType`s, i. e. `sha1`, `md5`, `sha256`, `sha512`
+  * other `hashType`s, i. e. `sha1`, `md4`, `md5`, `sha256`, `sha512`
   * other `digestType`s, i. e. `hex`, `base26`, `base32`, `base36`, `base49`, `base52`, `base58`, `base62`, `base64`
   * and `length` the length in chars
 * `[N]` the N-th match obtained from matching the current file name against `options.regExp`
@@ -229,7 +229,7 @@ loaderUtils.interpolateName(loaderContext, "[emoji:4]", { content: ... });
 // loaderContext.resourcePath = "/absolute/path/to/app/img/image.png"
 loaderUtils.interpolateName(loaderContext, "[sha512:hash:base64:7].[ext]", { content: ... });
 // => 2BKDTjl.png
-// use sha512 hash instead of md5 and with only 7 chars of base64
+// use sha512 hash instead of md4 and with only 7 chars of base64
 
 // loaderContext.resourcePath = "/absolute/path/to/app/img/myself.png"
 // loaderContext.query.name =
@@ -266,7 +266,7 @@ const digestString = loaderUtils.getHashDigest(buffer, hashType, digestType, max
 ```
 
 * `buffer` the content that should be hashed
-* `hashType` one of `sha1`, `md5`, `sha256`, `sha512` or any other node.js supported hash type
+* `hashType` one of `sha1`, `md4`, `md5`, `sha256`, `sha512` or any other node.js supported hash type
 * `digestType` one of `hex`, `base26`, `base32`, `base36`, `base49`, `base52`, `base58`, `base62`, `base64`
 * `maxLength` the maximum length in chars
 

lib/getHashDigest.js

@@ -39,11 +39,34 @@ function encodeBufferToBase(buffer, base) {
   return output;
 }
 
+let createMd4 = undefined;
+let BatchedHash = undefined;
+
 function getHashDigest(buffer, hashType, digestType, maxLength) {
-  hashType = hashType || 'md5';
+  hashType = hashType || 'md4';
   maxLength = maxLength || 9999;
 
-  const hash = require('crypto').createHash(hashType);
+  let hash;
+
+  try {
+    hash = require('crypto').createHash(hashType);
+  } catch (error) {
+    if (error.code === 'ERR_OSSL_EVP_UNSUPPORTED' && hashType === 'md4') {
+      if (createMd4 === undefined) {
+        createMd4 = require('./hash/md4');
+
+        if (BatchedHash === undefined) {
+          BatchedHash = require('./hash/BatchedHash');
+        }
+      }
+
+      hash = new BatchedHash(createMd4());
+    }
+
+    if (!hash) {
+      throw error;
+    }
+  }
 
   hash.update(buffer);
 
@@ -54,8 +77,7 @@ function getHashDigest(buffer, hashType, digestType, maxLength) {
     digestType === 'base49' ||
     digestType === 'base52' ||
     digestType === 'base58' ||
-    digestType === 'base62' ||
-    digestType === 'base64'
+    digestType === 'base62'
   ) {
     return encodeBufferToBase(hash.digest(), digestType.substr(4)).substr(
       0,

lib/getOptions.js

@@ -11,7 +11,7 @@ function getOptions(loaderContext) {
 
   if (!query || typeof query !== 'object') {
     // Not object-like queries are not supported.
-    return null;
+    return {};
   }
 
   return query;

lib/hash/BatchedHash.js

@@ -0,0 +1,64 @@
+const MAX_SHORT_STRING = require('./wasm-hash').MAX_SHORT_STRING;
+
+class BatchedHash {
+  constructor(hash) {
+    this.string = undefined;
+    this.encoding = undefined;
+    this.hash = hash;
+  }
+
+  /**
+   * Update hash {@link https://nodejs.org/api/crypto.html#crypto_hash_update_data_inputencoding}
+   * @param {string|Buffer} data data
+   * @param {string=} inputEncoding data encoding
+   * @returns {this} updated hash
+   */
+  update(data, inputEncoding) {
+    if (this.string !== undefined) {
+      if (
+        typeof data === 'string' &&
+        inputEncoding === this.encoding &&
+        this.string.length + data.length < MAX_SHORT_STRING
+      ) {
+        this.string += data;
+
+        return this;
+      }
+
+      this.hash.update(this.string, this.encoding);
+      this.string = undefined;
+    }
+
+    if (typeof data === 'string') {
+      if (
+        data.length < MAX_SHORT_STRING &&
+        // base64 encoding is not valid since it may contain padding chars
+        (!inputEncoding || !inputEncoding.startsWith('ba'))
+      ) {
+        this.string = data;
+        this.encoding = inputEncoding;
+      } else {
+        this.hash.update(data, inputEncoding);
+      }
+    } else {
+      this.hash.update(data);
+    }
+
+    return this;
+  }
+
+  /**
+   * Calculates the digest {@link https://nodejs.org/api/crypto.html#crypto_hash_digest_encoding}
+   * @param {string=} encoding encoding of the return value
+   * @returns {string|Buffer} digest
+   */
+  digest(encoding) {
+    if (this.string !== undefined) {
+      this.hash.update(this.string, this.encoding);
+    }
+
+    return this.hash.digest(encoding);
+  }
+}
+
+module.exports = BatchedHash;