Skip to content

Commit

Permalink
Fix prototype pollution vulnerability (#1828)
Browse files Browse the repository at this point in the history
(cherry picked from commit e1ecdbf)

Conflicts:
  lib/internal/iterator.js
  test/mapValues.js

NOTE(mriedem): The conflicts are due to:

- e475117 for iterator.js;
  resolution was trivial
- bd86f42 for mapValues.js;
  resolution was just copying the test change into the old
  test file before it was moved

This is a 2.x series backport for
https://nvd.nist.gov/vuln/detail/CVE-2021-43138.

Co-authored-by: Alexander Early <[email protected]>
  • Loading branch information
mriedem and aearly authored Apr 13, 2022
1 parent f1d8383 commit 8f7f903
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 0 deletions.
3 changes: 3 additions & 0 deletions lib/internal/iterator.js
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ function createObjectIterator(obj) {
var len = okeys.length;
return function next() {
var key = okeys[++i];
if (key === '__proto__') {
return next();
}
return i < len ? {value: obj[key], key: key} : null;
};
}
Expand Down
11 changes: 11 additions & 0 deletions mocha_test/mapValues.js
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,17 @@ describe('mapValues', function () {
done();
});
});

it('prototype pollution', (done) => {
var input = JSON.parse('{"a": 1, "b": 2, "__proto__": { "exploit": true }}');

async.mapValues(input, (val, key, next) => {
next(null, val)
}, (err, result) => {
expect(result.exploit).to.equal(undefined)
done(err);
})
})
});

context('mapValues', function () {
Expand Down

0 comments on commit 8f7f903

Please sign in to comment.