Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Snyk - potential prototype pollution #40

Closed
steveukx opened this issue Dec 30, 2020 · 1 comment
Closed

Snyk - potential prototype pollution #40

steveukx opened this issue Dec 30, 2020 · 1 comment
Labels
bug resolved

Comments

@steveukx
Copy link
Owner

Steps to reproduce:

payload.properties

[__proto__]
polluted = polluted

poc.js:

var propertiesReader = require('properties-reader');

propertiesReader('./payload.properties');

console.log({}.polluted) // logs 'polluted'
@steveukx
Copy link
Owner Author

Fix released as 2.2.0 on npm

ms1111 added a commit to ms1111/properties that referenced this issue Jan 13, 2024
@ms1111
Create enumerable properties for properties.path()
3e8d798 
The return value of properties.path() had enumerable keys in 2.1.1 and
earlier. Starting in 2.2.0, the keys were no longer enumerable as part
of the change made for steveukx#40 in 0877cc8.

Fixes steveukx#58
@ms1111 ms1111 mentioned this issue Jan 13, 2024
Open
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
bug resolved
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@steveukx