BAP-21092: JavaScript Prototype Pollution (#31464)

oroinc · Dec 24, 2021 · 62c2693 · 62c2693
1 parent d9929d4
commit 62c2693
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js b/src/Oro/Bundle/UIBundle/Resources/public/js/tools.js
@@ -85,6 +85,10 @@ define(function(require) {
                 query = query.slice(1);
             }
             const setValue = function(root, path, value) {
+                if (path[0] === '__proto__') {
+                    // Prevent Object.prototype pollution
+                    return;
+                }
                 if (path.length > 1) {
                     const dir = path.shift();
                     if (typeof root[dir] === 'undefined') {