Summary
A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.
Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.
Details
emit(context: Context, target: T) {
const node = traverseAndCreate(context.controller, this.segments);
node[this.lastSegment] = target;
this.addListeners(target, node, this.lastSegment);
}
The emit() function in src/templates/templates.ts is called without sanitizing the variable this.lastSegment . The variable this.lastSegment can be set to __proto__, and this will pollute the prototype of Javascipt Object (node['__proto__'] = target).
PoC
To reproduce this vulnerability, you can adjust the test case ignores DOM mutations in components\' create() in test/dom/ComponentHarness.mocha.js.
it('ignores DOM mutations in components\' create()', function() {
function Box() {}
Box.view = {
is: 'box',
- source: '<index:><div class="box" as="boxElement"></div>'
+ source: '<index:><div class="box" as="__proto__"></div>'
};
Box.prototype.create = function() {
this.boxElement.className = 'box-changed-in-create';
};
var harness = runner.createHarness('<view is="box" />', Box);
expect(harness).to.render('<div class="box"></div>');
});
When as attribute is controlled by attackers, the variable in this.lastSegment will exactly take value __proto__ and prototype pollution happens.
Patch
Add a check on this.lastSegment can prevent this attack.
emit(context: Context, target: T) {
const node = traverseAndCreate(context.controller, this.segments);
+ if (this.lastSegment.includes('__proto__') || this.lastSegment.includes('prototype')) {
+ throw new Error('Unsafe code detected');
+ }
node[this.lastSegment] = target;
this.addListeners(target, node, this.lastSegment);
}
Summary
A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.
Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn't be an issue in practice for most applications.
Details
The emit() function in src/templates/templates.ts is called without sanitizing the variable
this.lastSegment. The variablethis.lastSegmentcan be set to__proto__, and this will pollute the prototype of Javascipt Object (node['__proto__'] = target).PoC
To reproduce this vulnerability, you can adjust the test case
ignores DOM mutations in components\' create()intest/dom/ComponentHarness.mocha.js.When
asattribute is controlled by attackers, the variable inthis.lastSegmentwill exactly take value__proto__and prototype pollution happens.Patch
Add a check on
this.lastSegmentcan prevent this attack.