Skip to content

Commit

Permalink
fix: avoid prototype pollution on init
Browse files Browse the repository at this point in the history
  • Loading branch information
vkarpov15 committed Jul 12, 2023
1 parent 98e0762 commit f1efabf
Show file tree
Hide file tree
Showing 2 changed files with 24 additions and 0 deletions.
4 changes: 4 additions & 0 deletions lib/document.js
Original file line number Diff line number Diff line change
Expand Up @@ -689,6 +689,10 @@ function init(self, obj, doc, opts, prefix) {

function _init(index) {
i = keys[index];
// avoid prototype pollution
if (i === '__proto__' || i === 'constructor') {
return;
}
path = prefix + i;
schema = self.$__schema.path(path);

Expand Down
20 changes: 20 additions & 0 deletions test/document.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -10528,4 +10528,24 @@ describe('document', function() {
assert.ok(!band.embeddedMembers[0].member.name);
});
});

it('avoids prototype pollution on init', function() {
const Example = db.model('Example', new Schema({ hello: String }));

return co(function*() {
const example = yield new Example({ hello: 'world!' }).save();
yield Example.findByIdAndUpdate(example._id, {
$rename: {
hello: '__proto__.polluted'
}
});

// this is what causes the pollution
yield Example.find();

const test = {};
assert.strictEqual(test.polluted, undefined);
assert.strictEqual(Object.prototype.polluted, undefined);
});
});
});

0 comments on commit f1efabf

Please sign in to comment.