|
 |
1c9387 |
From 00da0b65c4c6bd75be2b91fba196be520e8ccf00 Mon Sep 17 00:00:00 2001
|
|
|
1c9387 |
From: Jordan Harband <ljharb@gmail.com>
|
|
|
1c9387 |
Date: Mon, 27 Dec 2021 19:15:57 -0800
|
|
|
1c9387 |
Subject: [PATCH] deps(qs/parse): ignore `__proto__` keys (CVE-2022-24999)
|
|
|
1c9387 |
|
|
|
1c9387 |
Signed-off-by: rpm-build <rpm-build>
|
|
|
1c9387 |
---
|
|
|
1c9387 |
deps/npm/node_modules/qs/lib/parse.js | 2 +-
|
|
|
1c9387 |
deps/npm/node_modules/qs/test/parse.js | 60 ++++++++++++++++++++++++++
|
|
|
1c9387 |
2 files changed, 61 insertions(+), 1 deletion(-)
|
|
|
1c9387 |
|
|
|
1c9387 |
diff --git a/deps/npm/node_modules/qs/lib/parse.js b/deps/npm/node_modules/qs/lib/parse.js
|
|
|
1c9387 |
index 8c9872e..08e623a 100644
|
|
|
1c9387 |
--- a/deps/npm/node_modules/qs/lib/parse.js
|
|
|
1c9387 |
+++ b/deps/npm/node_modules/qs/lib/parse.js
|
|
|
1c9387 |
@@ -69,7 +69,7 @@ var parseObject = function (chain, val, options) {
|
|
|
1c9387 |
) {
|
|
|
1c9387 |
obj = [];
|
|
|
1c9387 |
obj[index] = leaf;
|
|
|
1c9387 |
- } else {
|
|
|
1c9387 |
+ } else if (cleanRoot !== '__proto__') {
|
|
|
1c9387 |
obj[cleanRoot] = leaf;
|
|
|
1c9387 |
}
|
|
|
1c9387 |
}
|
|
|
1c9387 |
diff --git a/deps/npm/node_modules/qs/test/parse.js b/deps/npm/node_modules/qs/test/parse.js
|
|
|
1c9387 |
index 0f8fe45..3e93784 100644
|
|
|
1c9387 |
--- a/deps/npm/node_modules/qs/test/parse.js
|
|
|
1c9387 |
+++ b/deps/npm/node_modules/qs/test/parse.js
|
|
|
1c9387 |
@@ -515,6 +515,66 @@ test('parse()', function (t) {
|
|
|
1c9387 |
st.end();
|
|
|
1c9387 |
});
|
|
|
1c9387 |
|
|
|
1c9387 |
+ t.test('dunder proto is ignored', function (st) {
|
|
|
1c9387 |
+ var payload = 'categories[__proto__]=login&categories[__proto__]&categories[length]=42';
|
|
|
1c9387 |
+ var result = qs.parse(payload, { allowPrototypes: true });
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.deepEqual(
|
|
|
1c9387 |
+ result,
|
|
|
1c9387 |
+ {
|
|
|
1c9387 |
+ categories: {
|
|
|
1c9387 |
+ length: '42'
|
|
|
1c9387 |
+ }
|
|
|
1c9387 |
+ },
|
|
|
1c9387 |
+ 'silent [[Prototype]] payload'
|
|
|
1c9387 |
+ );
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ var plainResult = qs.parse(payload, { allowPrototypes: true, plainObjects: true });
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.deepEqual(
|
|
|
1c9387 |
+ plainResult,
|
|
|
1c9387 |
+ {
|
|
|
1c9387 |
+ __proto__: null,
|
|
|
1c9387 |
+ categories: {
|
|
|
1c9387 |
+ __proto__: null,
|
|
|
1c9387 |
+ length: '42'
|
|
|
1c9387 |
+ }
|
|
|
1c9387 |
+ },
|
|
|
1c9387 |
+ 'silent [[Prototype]] payload: plain objects'
|
|
|
1c9387 |
+ );
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ var query = qs.parse('categories[__proto__]=cats&categories[__proto__]=dogs&categories[some][json]=toInject', { allowPrototypes: true });
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.notOk(Array.isArray(query.categories), 'is not an array');
|
|
|
1c9387 |
+ st.notOk(query.categories instanceof Array, 'is not instanceof an array');
|
|
|
1c9387 |
+ st.deepEqual(query.categories, { some: { json: 'toInject' } });
|
|
|
1c9387 |
+ st.equal(JSON.stringify(query.categories), '{"some":{"json":"toInject"}}', 'stringifies as a non-array');
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.deepEqual(
|
|
|
1c9387 |
+ qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true }),
|
|
|
1c9387 |
+ {
|
|
|
1c9387 |
+ foo: {
|
|
|
1c9387 |
+ bar: 'stuffs'
|
|
|
1c9387 |
+ }
|
|
|
1c9387 |
+ },
|
|
|
1c9387 |
+ 'hidden values'
|
|
|
1c9387 |
+ );
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.deepEqual(
|
|
|
1c9387 |
+ qs.parse('foo[__proto__][hidden]=value&foo[bar]=stuffs', { allowPrototypes: true, plainObjects: true }),
|
|
|
1c9387 |
+ {
|
|
|
1c9387 |
+ __proto__: null,
|
|
|
1c9387 |
+ foo: {
|
|
|
1c9387 |
+ __proto__: null,
|
|
|
1c9387 |
+ bar: 'stuffs'
|
|
|
1c9387 |
+ }
|
|
|
1c9387 |
+ },
|
|
|
1c9387 |
+ 'hidden values: plain objects'
|
|
|
1c9387 |
+ );
|
|
|
1c9387 |
+
|
|
|
1c9387 |
+ st.end();
|
|
|
1c9387 |
+ });
|
|
|
1c9387 |
+
|
|
|
1c9387 |
t.test('can return null objects', { skip: !Object.create }, function (st) {
|
|
|
1c9387 |
var expected = Object.create(null);
|
|
|
1c9387 |
expected.a = Object.create(null);
|
|
|
1c9387 |
--
|
|
|
1c9387 |
2.38.1
|
|
|
1c9387 |
|