From 3aaddefc5153f64d4c690bb831a5f8fdd5c93f56 Mon Sep 17 00:00:00 2001 From: William Chargin Date: Tue, 8 May 2018 16:31:25 -0700 Subject: [PATCH] ensureSlash: Fix accidental string-to-NaN coercion (#4424) Summary: The `hasSlash` method uses `path.substr(path, path.length - 1)` to remove the last character from `path`. Clearly, the first parameter is suspect; it should be `0`. The code works as written, but only very accidentally: the first parameter is coerced by `ToNumber` to `NaN`, which is then coerced by `ToInteger` to `+0`, per [the spec][1]. [1]: https://www.ecma-international.org/ecma-262/6.0/#sec-string.prototype.substr Test Plan: Reading the spec should be sufficient. To verify in the Real World: ```js const path = "has-slash-but-does-not-need-slash/" const a = path.substr(path, path.length - 1); const b = path.substr(0, path.length - 1); console.log(a === b); // true console.log(a); // has-slash-but-does-not-need-slash ``` wchargin-branch: ensureslash-accidental-coercion --- packages/react-scripts/config/paths.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/react-scripts/config/paths.js b/packages/react-scripts/config/paths.js index 8cd5cf439d7..d7f55b6f638 100644 --- a/packages/react-scripts/config/paths.js +++ b/packages/react-scripts/config/paths.js @@ -23,7 +23,7 @@ const envPublicUrl = process.env.PUBLIC_URL; function ensureSlash(path, needsSlash) { const hasSlash = path.endsWith('/'); if (hasSlash && !needsSlash) { - return path.substr(path, path.length - 1); + return path.substr(0, path.length - 1); } else if (!hasSlash && needsSlash) { return `${path}/`; } else {