vndb/mithril-vndb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prevent prototype pollution while parsing query strings (#2494)

Browse source 
* Prevent prototype pollution while parsing query strings

* Update changelog [skip ci]
This commit is contained in:
Isiah Meadows 2019-07-27 17:39:55 -04:00 • committed by GitHub
parent 48e7fd1711
commit 97fa1788c2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 23 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
querystring/tests/test-parseQueryString.js
View file

@ -97,4 +97,16 @@ o.spec("parseQueryString", function() {
var data = parseQueryString("a=1&b=2&a=3")
o(data).deepEquals({a: "3", b: "2"})
})
o("doesn't pollute prototype directly, censors `__proto__`", function() {
var prev = Object.prototype.toString
var data = parseQueryString("a=b&__proto__%5BtoString%5D=123")
o(Object.prototype.toString).equals(prev)
o(data).deepEquals({a: "b"})
})
o("doesn't pollute prototype indirectly, retains `constructor`", function() {
var prev = Object.prototype.toString
var data = parseQueryString("constructor%5Bprototype%5D%5BtoString%5D=123")
o(Object.prototype.toString).equals(prev)
o(data).deepEquals({a: "b"})
})
})