-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: 🎸 check for client side prototype pollution on pages
The user is able to feed the tool with multiple pages to check for client-side prototype pollution
- Loading branch information
1 parent
e75cab8
commit 8668b9c
Showing
5 changed files
with
64 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,6 +2,6 @@ export default { | |
cdnjs: { | ||
api: { | ||
url: 'https://api.cdnjs.com', | ||
} | ||
} | ||
}, | ||
}, | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
const types = [Object, String, Number, Array, Function, Boolean]; | ||
|
||
const prototypesPropertiesReducer = (acc, type) => ({ | ||
...acc, | ||
[type.name]: Object.getOwnPropertyNames(type.prototype), | ||
}); | ||
|
||
const prototypePropertyNames = types.reduce(prototypesPropertiesReducer, {}); | ||
|
||
const probe = () => | ||
Object.keys(prototypePropertyNames).reduce((acc, key) => { | ||
for (let propKey of prototypePropertyNames[key]) { | ||
const payload = `${key}.prototype.${propKey}`; | ||
try { | ||
if (typeof eval(payload) === 'function' && eval(payload).call() === window) { | ||
acc.push(payload); | ||
} | ||
} catch (e) { | ||
// Nothing to catch now. | ||
} | ||
} | ||
return acc; | ||
}, []); | ||
|
||
probe(); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
import { load, log } from '../utils/file.utils.js'; | ||
import puppeteer from 'puppeteer'; | ||
import { PromisePool } from '@supercharge/promise-pool'; | ||
|
||
const browser = await puppeteer.launch({ headless: true }); | ||
|
||
const payload = load('../sandbox/js/check.payload.js'); | ||
|
||
const probe = async (pageUrl) => { | ||
const page = await browser.newPage(); | ||
|
||
await page.goto(pageUrl, { waitUntil: 'networkidle0' }); | ||
|
||
const results = await page.evaluate(payload); | ||
|
||
await page.close(); | ||
|
||
return { url: pageUrl, findings: results }; | ||
}; | ||
|
||
const probeAll = async (urls, concurrency = 10) => { | ||
const { results } = await PromisePool.for(urls) | ||
.withConcurrency(concurrency) | ||
.onTaskFinished((url, pool) => console.log(`[${pool.processedPercentage().toFixed(2)}%] Processed ${url} ...`)) | ||
.process(probe); | ||
|
||
log(results); | ||
browser.close(); | ||
return results; | ||
}; | ||
|
||
export default { probeAll }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters