fixed prototype pollution (#418)

Co-authored-by: Asjid Kalam <asjid.kalam@gmail.com> Co-authored-by: Jamie Slome <jamie@418sec.com>
locutusjs · Sep 3, 2020 · f2868ae · f2868ae
1 parent 3f14dc5
commit f2868ae
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/php/strings/parse_str.js b/src/php/strings/parse_str.js
@@ -74,6 +74,10 @@ module.exports = function parse_str (str, array) { // eslint-disable-line camelc
     key = _fixStr(tmp[0])
     value = (tmp.length < 2) ? '' : _fixStr(tmp[1])
 
+    if (key.includes('__proto__') || key.includes('constructor') || key.includes('prototype')) {
+      break;
+    }
+
     while (key.charAt(0) === ' ') {
       key = key.slice(1)
     }