Security Fix for Prototype Pollution - huntr.dev #1088
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[Fix] `setLocale`: do not allow prototype pollution
|
@jquense - referencing our conversation from earlier (418sec/huntr#826). Let me know if you have any questions! 馃嵃 |
|
@jquense - just a heads up that it seemed as though only one unit test was running previously? |
|
thanks |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
https://huntr.dev/users/ljharb has fixed the Prototype Pollution vulnerability 馃敤. ljharb has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 馃挼. Think you could fix a vulnerability like this?
Get involved at https://huntr.dev/
Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#2
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/yup/1/README.md
User Comments:
馃搳 Metadata *
Bounty URL: https://www.huntr.dev/bounties/1-npm-yup
鈿欙笍 Description *
This uses a null object as the base locale data, so it doesn't have a prototype to pollute.
馃捇 Technical Description *
Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
JavaScript allows all Object attributes to be altered, including their magical attributes such as proto, constructor and prototype.
An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.
Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain.
馃悰 Proof of Concept (PoC) *
See tests.
馃敟 Proof of Fix (PoF) *
See tests.
馃憤 User Acceptance Testing (UAT)
See tests. I also fixed the overarching test suite, which was only running a single test.