GHSA-55jh-84jv-8mx8

// --- Handle APIVersion rule separately to avoid unsafe-eval in the core library --- const apiVersionConfig = ruleConfig.rules.APIVersion; if (apiVersionConfig) { delete ruleConfig.rules.APIVersion; } // Manually evaluate the APIVersion rule, if it was configured. if (apiVersionConfig) { const flowApiVer = this.currentFlow.apiVersion || this.currentFlow.xmlData?.apiVersion; const apiVersionRuleDef = allRules.find(r => r.name === "APIVersion"); // Determine the required expression (e.g. ">=58"). let requiredExpr; if (apiVersionConfig.expression) { requiredExpr = apiVersionConfig.expression; } else if (apiVersionConfig.threshold != null) { requiredExpr = `>=${apiVersionConfig.threshold}`; } if (requiredExpr) { const minVer = parseInt(requiredExpr.replace(/[^0-9]/g, ""), 10); const operator = requiredExpr.replace(/[0-9]/g, "").trim(); const operators = { ">=": (a, b) => a < b, "<": (a, b) => a >= b, ">": (a, b) => a <= b, "<=": (a, b) => a > b, "==": (a, b) => a !== b, "=": (a, b) => a !== b }; const violation = operators[operator] ? operators[operator](flowApiVer, minVer) : flowApiVer < minVer; if (violation) { // Craft a result object that mimics the core scanner output so downstream logic remains unchanged. const manualScanResult = [{ flow: parsedFlow, ruleResults: [{ ruleName: "APIVersion", ruleDefinition: { description: apiVersionRuleDef?.description || "API Version check", label: apiVersionRuleDef?.label || "APIVersion" }, occurs: true, severity: apiVersionConfig.severity, details: [{ name: String(flowApiVer), type: "apiVersion", expression: requiredExpr }] }] }]; results.push(...this.processScanResults(manualScanResult)); } } }