fix(object#set): enforce key types

bpmn-io · Jan 17, 2022 · 2c6689e · 2c6689e
1 parent 59451ec
commit 2c6689e
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 0 deletions.
diff --git a/lib/object.js b/lib/object.js
@@ -35,6 +35,14 @@ export function set(target, path, value) {
 
   forEach(path, function(key, idx) {
 
+    if (typeof key !== 'number' && typeof key !== 'string') {
+      throw new Error('illegal key type: ' + typeof key + '. Key should be of type number or string.');
+    }
+
+    if (key === 'constructor') {
+      throw new Error('illegal key: constructor');
+    }
+
     if (key === '__proto__') {
       throw new Error('illegal key: __proto__');
     }

diff --git a/test/object.spec.js b/test/object.spec.js
@@ -448,6 +448,27 @@ describe('object', function() {
       }).to.throw(/illegal key/);
     });
 
+
+    it('should not allow prototype polution via constructor', function() {
+      expect(function() {
+        set({}, ['constructor', 'prototype', 'polluted'], 'success');
+      }).to.throw(/illegal key/);
+    });
+
+
+    it('should not allow array as key', function() {
+      expect(function() {
+        set({}, [['__proto__'], 'polluted'], 'success');
+      }).to.throw(/illegal key type/);
+    });
+
+
+    it('should not allow object as key', function() {
+      expect(function() {
+        set({}, [{}, 'polluted'], 'success');
+      }).to.throw(/illegal key type/);
+    });
+
   });