This repository has been archived by the owner on Feb 4, 2021. It is now read-only.

Fix prototype pollution #38

Open

luci-m-666 wants to merge 1 commit into etc-tiago:master from luci-m-666:master

luci-m-666 commented Oct 29, 2020

Hi,
This package is vulnerable to prototype pollution.
POC

var {objectMerge } = require("deep-merge-object")
const payload = JSON.parse('{"__proto__":{"polluted":"Yes! Its Polluted"}}');
var obj = {}
console.log("Before : " + {}.polluted);
objectMerge(obj, payload);
console.log("After : " + {}.polluted);

OUTPUT

Before : undefined
After : Yes! Its Polluted

After fix prototype pollution can be avoided.

Before : undefined
After : undefined


          Fix prototype pollution

41d1864

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet