Add vulns 3

package.json

@@ -10,14 +10,53 @@
   "devDependencies": {
     "@rollup/plugin-commonjs": "^17.0.0",
     "@rollup/plugin-node-resolve": "^11.0.0",
+    "@types/offscreencanvas": "^2019.7.3",
+    "@types/source-map": "^0.5.7",
+    "clean-webpack-plugin": "^4.0.0",
+    "dts-dom": "^3.7.0",
+    "eslint": "^8.56.0",
+    "eslint-plugin-es5": "^1.5.0",
+    "exports-loader": "^5.0.0",
+    "fs-extra": "^11.2.0",
+    "imports-loader": "^5.0.0",
+    "jsdoc": "3.x.x",
+    "node-sloc": "^0.2.1",
+    "path": "^0.12.7",
+    "phaser3spectorjs": "^0.0.8",
+    "remove-files-webpack-plugin": "^1.5.0",
     "rollup": "^2.3.4",
     "rollup-plugin-css-only": "^3.1.0",
     "rollup-plugin-livereload": "^2.0.0",
     "rollup-plugin-svelte": "^7.0.0",
     "rollup-plugin-terser": "^7.0.0",
-    "svelte": "^3.0.0"
+    "source-map": "^0.7.4",
+    "svelte": "^3.0.0",
+    "terser-webpack-plugin": "^5.3.10",
+    "typescript": "^5.3.3",
+    "vivid-cli": "^1.1.2",
+    "webpack": "^5.90.3",
+    "webpack-cli": "^5.1.4",
+    "webpack-shell-plugin": "^0.5.0"
   },
   "dependencies": {
-    "sirv-cli": "^2.0.0"
+    "axios": "0.21.1",
+    "dot-prop": "4.2.0",
+    "eventemitter3": "^5.0.1",
+    "express": "4.21.2",
+    "fast-xml-parser": "4.0.11",
+    "got": "12.1.0",
+    "handlebars": "4.3.0",
+    "immer": "9.0.21",
+    "jquery": "3.4.1",
+    "lodash": "4.17.15",
+    "log4js": "4.5.1",
+    "minimist": "1.2.5",
+    "moment": "2.29.4",
+    "node-fetch": "2.6.1",
+    "prismjs": "1.29.0",
+    "serialize-javascript": "2.1.1",
+    "shelljs": "0.8.4",
+    "sirv-cli": "^2.0.0",
+    "ws": "7.2.0"
   }
 }

src/main.js

@@ -1,12 +1,41 @@
-import App from './App.svelte';
+import { XMLParser } from "fast-xml-parser";
+import got from "got";
+import { produce } from "immer";
+import moment from "moment";
+import Prism from "prismjs";
+import App from "./App.svelte";
 
 const a = 1;
 
+// PrismJS XSS test (CVE-2023-40608, CVE-2023-45133)
+Prism.highlight(
+  "<img src=x onerror=alert(1)>",
+  Prism.languages.javascript,
+  "javascript"
+);
+
+// moment.js prototype pollution test (CVE-2022-31129)
+const polluted = moment.updateLocale("en", { calendar: { sameDay: "h:mm A" } });
+
+// fast-xml-parser XXE test (CVE-2023-28848)
+const parser = new XMLParser();
+parser.parse(
+  '<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]><foo>&xxe;</foo>'
+);
+
+// got SSRF test (CVE-2024-24765)
+got("http://127.0.0.1");
+
+// immer prototype pollution test (CVE-2023-47132)
+produce({ a: 1 }, (draft) => {
+  draft.__proto__.polluted = true;
+});
+
 const app = new App({
-	target: document.body,
-	props: {
-		name: 'world'
-	}
+  target: document.body,
+  props: {
+    name: "world",
+  },
 });
 
 export default app;