Skip to content

Commit

Permalink
fix: apply v1 patch for the prototype pollution vulnerability
Browse files Browse the repository at this point in the history
  • Loading branch information
edmundhung committed May 26, 2024
1 parent 7a52c99 commit cb604dd
Showing 1 changed file with 12 additions and 2 deletions.
14 changes: 12 additions & 2 deletions packages/conform-dom/formdata.ts
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,13 @@ export function getPaths(name: string): Array<string | number> {
return name
.split(/\.|(\[\d*\])/)
.reduce<Array<string | number>>((result, segment) => {
if (typeof segment !== 'undefined' && segment !== '') {
if (
typeof segment !== 'undefined' &&
segment !== '' &&
segment !== '__proto__' &&
segment !== 'constructor' &&
segment !== 'prototype'
) {
if (segment.startsWith('[') && segment.endsWith(']')) {
const index = segment.slice(1, -1);

Expand Down Expand Up @@ -87,7 +93,11 @@ export function setValue(
const nextKey = paths[index + 1];
const newValue =
index != lastIndex
? pointer[key] ?? (typeof nextKey === 'number' ? [] : {})
? Object.prototype.hasOwnProperty.call(pointer, key)
? pointer[key]
: typeof nextKey === 'number'
? []
: {}
: valueFn(pointer[key]);

pointer[key] = newValue;
Expand Down

0 comments on commit cb604dd

Please sign in to comment.