Skip to content

Commit bf30b75

Browse files
committed
simple fix for prototype pollution
1 parent 80723ba commit bf30b75

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

Diff for: src/update-state.test.ts

+9
Original file line numberDiff line numberDiff line change
@@ -222,5 +222,14 @@ describe('updateState', () => {
222222
}],
223223
});
224224
});
225+
226+
it('should not update via prototype props', () => {
227+
var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')
228+
229+
const { hasChanges } = updateState(BAD_JSON, {})
230+
231+
expect(hasChanges).to.be.false;
232+
expect((Object.prototype as any).polluted).to.be.undefined;
233+
});
225234
});
226235

Diff for: src/update-state.ts

+5
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ const arrayItemKeyMap = new Map<string, string>([
1616
['currentSensorStateData', 'name'],
1717
]);
1818

19+
// https://github.com/andrei-tatar/nora-firebase-common/issues/9
20+
const ignoreKeys: any[] = ['__proto__', 'constructor', 'prototype'];
21+
1922
function updateArrayState(update: any[], state: any[], path = ''): boolean {
2023
let hasChanges = false;
2124

@@ -51,6 +54,8 @@ function updateStateInternal(update: any, state: any, path = ''): boolean {
5154

5255
let hasChanges = false;
5356
for (const [key, newValue] of entries(update)) {
57+
if (ignoreKeys.includes(key)) { continue; }
58+
5459
const oldValue = state[key];
5560
const newType = typeof newValue;
5661
const oldType = typeof oldValue;

0 commit comments

Comments
 (0)