check that currentScript is set by a script tag (#3863)

Based on: https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 Should resolve: https://osv.dev/vulnerability/GHSA-x7hr-w5r2-h6wg
PrismJS · Mar 8, 2025 · 8e8b935 · 8e8b935
1 parent f894dc2
commit 8e8b935
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/components/prism-core.js b/components/prism-core.js
@@ -222,7 +222,7 @@ var Prism = (function (_self) {
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}
 

diff --git a/components/prism-core.min.js b/components/prism-core.min.js
diff --git a/docs/prism-core.js.html b/docs/prism-core.js.html
@@ -275,7 +275,7 @@ <h1 class="page-title">prism-core.js</h1>
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document &amp;&amp; 1 &lt; 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript &amp;&amp; document.currentScript.tagName === 'SCRIPT' &amp;&amp; 1 &lt; 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}
 

diff --git a/prism.js b/prism.js
@@ -227,7 +227,7 @@ var Prism = (function (_self) {
 				if (typeof document === 'undefined') {
 					return null;
 				}
-				if ('currentScript' in document && 1 < 2 /* hack to trip TS' flow analysis */) {
+				if (document.currentScript && document.currentScript.tagName === 'SCRIPT' && 1 < 2 /* hack to trip TS' flow analysis */) {
 					return /** @type {any} */ (document.currentScript);
 				}