New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(Moddle): replicate set/get API for createAny elements #54
Conversation
12edafd
to
3fef9ed
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
See comment below. Let's also test for prototype pollution.
lib/moddle.js
Outdated
return this[name]; | ||
}, | ||
set: function(name, value) { | ||
this[name] = value; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This leads to prototype pollution:
~/workspace/bpmn-io/moddle replicate-api-on-createAny 7s
❯ node
Welcome to Node.js v18.12.1.
Type ".help" for more information.
> const Moddle = require('.')
undefined
> Moddle
{
Moddle: [Function: Moddle],
coerceType: [Function: coerceType],
isBuiltInType: [Function: isBuiltIn],
isSimpleType: [Function: isSimple],
parseNameNS: [Function: parseName]
}
> const model = new Moddle.Moddle([])
undefined
> const a = model.createAny('test', 'http://example.com')
undefined
> a.set('__proto__', { hacked() { console.log('hacked') } })
undefined
> a.hacked()
hacked
undefined
Cf. min-dash#set
for mitigation: https://github.com/bpmn-io/min-dash/blob/master/lib/object.js#L40
We could also reuse min-dash method if we make sure name
is string and not array.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's use min-dash#set
here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch. Addressed with 118b5fd by using min-dash
set: function(name, value) { | ||
this[name] = value; | ||
set: function(key, value) { | ||
set(this, [ key ], value); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🥇
Thanks for the review, I'll take care of the patch release |
related to camunda/camunda-modeler#3589