fix: protoype pollution!

Author: jaime-ez

src/handlers/record/record-transition.ts

@@ -1,4 +1,4 @@
-import { setValue as setPathValue } from '../../utils/json-path'
+import { setValue as setPathValue, isValidPath } from '../../utils/json-path'
 import RecordHandler from './record-handler'
 import { recordRequest } from './record-request'
 import { RecordWriteMessage, TOPIC, RECORD_ACTION, Message } from '../../constants'
@@ -128,6 +128,14 @@ export class RecordTransition {
       return
     }
 
+    if (message.path && !isValidPath(message.path)) {
+      socketWrapper.sendMessage({ ...message,
+        action: RECORD_ACTION.INVALID_MESSAGE_DATA,
+        originalAction: message.action,
+      })
+      return
+    }
+
     if (message.action === RECORD_ACTION.UPDATE) {
       if (!isOfType(message.parsedData, 'object') && !isOfType(message.parsedData, 'array')) {
         socketWrapper.sendMessage({ ...message,

src/services/permission/valve/rule-application.ts

@@ -231,7 +231,11 @@ export default class RuleApplication {
 
     if (typeof currentData !== UNDEFINED && currentData !== LOADING) {
       data = JSON.parse(JSON.stringify(currentData))
-      setValue(data, msg.path, msg.parsedData)
+      try {
+        setValue(data, msg.path, msg.parsedData)
+      } catch (e) {
+        return e as Error
+      }
       return data
     }
     this.loadRecord(this.params.name)

src/utils/json-path.spec.ts

@@ -328,3 +328,46 @@ describe('objects are created from paths and their value is set correctly', () =
   })
 
 })
+
+describe('rejects prototype-pollution paths', () => {
+  afterEach(() => {
+    delete (Object.prototype as any).polluted
+  })
+
+  it('throws on __proto__ as the first segment', () => {
+    const record: any = {}
+    expect(() => jsonPath.setValue(record, '__proto__.polluted', true)).to.throw(/forbidden/)
+    expect(({} as any).polluted).to.equal(undefined)
+  })
+
+  it('throws on __proto__ as a nested segment', () => {
+    const record: any = { a: {} }
+    expect(() => jsonPath.setValue(record, 'a.__proto__.polluted', true)).to.throw(/forbidden/)
+    expect(({} as any).polluted).to.equal(undefined)
+  })
+
+  it('throws on constructor.prototype path', () => {
+    const record: any = {}
+    expect(() => jsonPath.setValue(record, 'constructor.prototype.polluted', true)).to.throw(/forbidden/)
+    expect(({} as any).polluted).to.equal(undefined)
+  })
+
+  it('throws on a single __proto__ segment (record prototype switch)', () => {
+    const record: any = {}
+    expect(() => jsonPath.setValue(record, '__proto__', { polluted: true })).to.throw(/forbidden/)
+    expect((record as any).polluted).to.equal(undefined)
+  })
+
+  it('getValue refuses to traverse __proto__', () => {
+    expect(() => jsonPath.getValue({}, '__proto__.toString')).to.throw(/forbidden/)
+  })
+
+  it('isValidPath flags forbidden keys but accepts normal paths', () => {
+    expect(jsonPath.isValidPath('__proto__.x')).to.equal(false)
+    expect(jsonPath.isValidPath('constructor.prototype.x')).to.equal(false)
+    expect(jsonPath.isValidPath('a.__proto__.x')).to.equal(false)
+    expect(jsonPath.isValidPath('a.b.c')).to.equal(true)
+    expect(jsonPath.isValidPath('items[0].name')).to.equal(true)
+    expect(jsonPath.isValidPath('user_proto.foo')).to.equal(true)
+  })
+})

src/utils/json-path.ts

@@ -1,4 +1,5 @@
 const SPLIT_REG_EXP = /[[\]]/g
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype'])
 
 /**
 * Returns the value of the path or
@@ -49,6 +50,20 @@ export function setValue (root: any, path: string, value: any): void {
   }
 }
 
+/**
+ * Returns true if the path is safe to use with getValue / setValue.
+ * Rejects paths containing __proto__, constructor, or prototype tokens
+ * that would otherwise allow prototype-chain traversal.
+ */
+export function isValidPath (path: string): boolean {
+  try {
+    tokenize(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
 /**
  * Parses the path. Splits it into
  * keys for objects and indices for arrays.
@@ -72,6 +87,10 @@ function tokenize (path: string): Array<string | number> {
       continue
     }
 
+    if (FORBIDDEN_KEYS.has(arrayIndexes[0])) {
+      throw new Error(`invalid path: forbidden key '${arrayIndexes[0]}'`)
+    }
+
     tokens.push(arrayIndexes[0])
 
     for (let j = 1; j < arrayIndexes.length; j++) {