Skip to content

Fix object proto pollution#113

Merged
weizman merged 8 commits intoLavaMoat:mainfrom
mmndaniel:fix-object-proto-pollution
Jun 26, 2023
Merged

Fix object proto pollution#113
weizman merged 8 commits intoLavaMoat:mainfrom
mmndaniel:fix-object-proto-pollution

Conversation

@mmndaniel
Copy link
Copy Markdown
Contributor

An attempt to fix #112

src/inserters.js Outdated
desc.configurable = true;
if (prop === 'value') {
desc.writable = true;
if (Object.hasOwnProperty.call(map, proto)) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we instead do:

const protos = Object.getOwnPropertyNames(map);
for (let i = 0; i < protos.length; i++) {
  const proto = protos[i];
  const funcs = map[proto];
  ...

?

That way we save the extra indentation, and this should be safe because Object is a native and therefore protos too

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(protos could also be declared in the upper scope, outside of the function, your call)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good ideas! the 2nd will save the extra call. on it

expect(result).toBe('V');
});

it('should fail to use atob of an iframe added after Object.prototype pollution', async function () {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

excellent test, I think this would be more appropriate at /test/overwrites.js. Also can you add the // reference: https://github.com/LavaMoat/snow/pull/112 comment please?

Copy link
Copy Markdown
Member

@weizman weizman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @mmndaniel!

A few minor requests if you don't mind. Also, please add and commit snow.js and snow.prod.js files after running yarn build locally (you can see in former PRs we add the dst files with each change. we do this because we'd like each version to be accessible via servers such as unpkg out of the box)

@mmndaniel mmndaniel requested a review from weizman June 26, 2023 11:06
Copy link
Copy Markdown
Member

@weizman weizman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome work, super important!
Thanks again for the help @mmndaniel 🙏
(first external PR ever btw 🎉)

@weizman weizman merged commit d648e27 into LavaMoat:main Jun 26, 2023
@weizman weizman mentioned this pull request Jul 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bypass with Object.prototype pollution

2 participants