Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit 4ff542b

Browse files
authored
fix(SearchParameters): ignore invalid parameters (#880)
* fix(SearchParameters): ignore invalid parameters These parameters could be used maliciously, so are explicilty not allowed in merge * clearer test
1 parent dff9e32 commit 4ff542b

File tree

4 files changed

+34
-3
lines changed

4 files changed

+34
-3
lines changed

src/functions/merge.js

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,10 @@ function _merge(target, source) {
2121
}
2222

2323
for (var key in source) {
24-
if (!Object.prototype.hasOwnProperty.call(source, key)) {
24+
if (
25+
!Object.prototype.hasOwnProperty.call(source, key) ||
26+
key === '__proto__'
27+
) {
2528
continue;
2629
}
2730

@@ -32,7 +35,10 @@ function _merge(target, source) {
3235
continue;
3336
}
3437

35-
if (isObjectOrArrayOrFunction(targetVal) && isObjectOrArrayOrFunction(sourceVal)) {
38+
if (
39+
isObjectOrArrayOrFunction(targetVal) &&
40+
isObjectOrArrayOrFunction(sourceVal)
41+
) {
3642
target[key] = _merge(targetVal, sourceVal);
3743
} else {
3844
target[key] = clone(sourceVal);

test/spec/functions/defaultsPure.js

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,3 +92,16 @@ it('should keep the keys order when adding facet refinements', function() {
9292
);
9393
expect(Object.keys(actual)).toEqual(['facet1', 'facet2']);
9494
});
95+
96+
it('does not pollute the prototype', () => {
97+
var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable to PP"}}');
98+
var subject = {};
99+
100+
expect(subject.polluted).toBe(undefined);
101+
102+
const out = defaults({}, payload);
103+
104+
expect(out).toEqual({});
105+
106+
expect({}.polluted).toBe(undefined);
107+
});

test/spec/functions/intersection.js

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,3 @@ test('it should not produce duplicate primitive values', function() {
1818
'2'
1919
]);
2020
});
21-

test/spec/functions/merge.js

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,3 +170,16 @@ it('should not convert strings to arrays when merging arrays of `source`', funct
170170

171171
expect(actual).toStrictEqual({a: ['x', 'y', 'z']});
172172
});
173+
174+
it('does not pollute the prototype', () => {
175+
var payload = JSON.parse('{"__proto__": {"polluted": "vulnerable to PP"}}');
176+
var subject = {};
177+
178+
expect(subject.polluted).toBe(undefined);
179+
180+
const out = merge({}, payload);
181+
182+
expect(out).toEqual({});
183+
184+
expect({}.polluted).toBe(undefined);
185+
});

0 commit comments

Comments
 (0)