1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
Description: Fix prototype pollution in set()
Author: Mario Casciaro <mariocasciaro@gmail.com>
Origin: upstream, https://github.com/mariocasciaro/object-path/commit/2be3354c6
Bug: https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w
Forwarded: not-needed
Reviewed-By: Xavier Guimard <yadd@debian.org>
Last-Update: 2020-10-22
--- a/index.js
+++ b/index.js
@@ -105,6 +105,10 @@
}
var currentPath = path[0];
var currentValue = getShallowProperty(obj, currentPath);
+ if (options.includeInheritedProps && (currentPath === '__proto__' ||
+ (currentPath === 'constructor' && typeof currentValue === 'function'))) {
+ throw new Error('For security reasons, object\'s magic properties cannot be set')
+ }
if (path.length === 1) {
if (currentValue === void 0 || !doNotReplace) {
obj[currentPath] = value;
|
