LGTM.com - false positive - js/prototype-polluting-assignment

[rhansen]

Description of the false positive

The path starts at line 140, and line 146 has an explicit __proto__ check.

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/ether/etherpad-lite/snapshot/d25550e3aec960da12677955c6598040b73655b3/files/src/node/hooks/express/webaccess.js?sort=name&dir=ASC&mode=heatmap#xc5e75353d0d51c4a:1

[asgerf]

Hi @rhansen,

Thanks for reporting this. We recognize this is a false positive, but we don't have a fix that we can apply in the short term.

If you're interested in a workaround, the alert should go away if the value is only stored in the ctx.username after sanitization, like this:

let username = userpass.shift();
if (username === '__proto__') username = null;
ctx.username = username;

Once a value is stored in a property, it gets a bit harder to track whether it has been sanitized before a given use. We support this for common cases, but not for type of the control flow we see in your example.