Fixed @ CVE-2020-7677

[mik-patient]

Vulnerability Description

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

Integration

• Does this contain changes to src/components or src/

  • Will you publish to npm immediately after this PR, or wait until sometime in the future?
  • Incompatible API change to something existing (major version increase)
  • Adding new backwards-compatible functionality? (minor version increase)
  • Fixing a bug backwards-compatibly? (patch version increase)

• Does this contain changes to src/features for brave-core?

  • Are there non backwards-compatible changes required for brave-core? Do not merge until brave-core PR is approvable. Link to brave-core PR:
  • Will you create brave-core PR to update to this commit after it is merged?
  • Wants uplift to brave-core feature branch?
    • When uplift-approved, merge to brave-core-0.VV.x feature branch
    • Create additional brave-core PRs for each feature branch to update commit