Security Fix for Prototype Pollution - huntr.dev #11
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
@arjunshibu (https://huntr.dev/users/arjunshibu) has fixed a potential Prototype Pollution vulnerability in your repository 🔨. For more information, visit our website (https://huntr.dev/) or click the bounty URL below...
Q | A
Version Affected | *
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/nested-object-assign/1/README.md
User Comments:
📊 Metadata *
nested-object-assign
is vulnerable toPrototype Pollution
.Bounty URL: https://www.huntr.dev/bounties/1-npm-nested-object-assign
⚙️ Description *
Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
JavaScript allows all Object attributes to be altered, including their magical attributes such as
__proto__
,constructor
andprototype
. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain.💻 Technical Description *
Fix implemented by not allowing to modify object prototype.
🐛 Proof of Concept (PoC) *
🔥 Proof of Fix (PoF) *
I've added unit tests for Prototype Pollution
+1 User Acceptance Testing (UAT)