Strip constructor, prototype, and __proto__ properties in the seriali…

…ze step (#267) * Strip constructor, prototype, and __proto__ properties in the serialize step * Update src/plainer.ts Co-authored-by: Simon Knott <[email protected]> --------- Co-authored-by: Simon Knott <[email protected]>
flightcontrolhq · Oct 23, 2023 · 47bf57d · 47bf57d
1 parent 5e01a01
commit 47bf57d
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/src/index.test.ts b/src/index.test.ts
@@ -1054,6 +1054,17 @@ test('regression: `Object.create(null)` / object without prototype', () => {
   expect(parsed.date).toBeInstanceOf(Date);
 });
 
+test.each(['__proto__', 'prototype', 'constructor'])(
+  'serialize prototype pollution: %s',
+  forbidden => {
+    expect(() => {
+      SuperJSON.serialize({
+        [forbidden]: 1,
+      });
+    }).toThrowError(/This is a prototype pollution risk/);
+  }
+);
+
 test('prototype pollution - __proto__', () => {
   expect(() => {
     SuperJSON.parse(

diff --git a/src/plainer.ts b/src/plainer.ts
@@ -216,6 +216,16 @@ export const walker = (
   const innerAnnotations: Record<string, Tree<TypeAnnotation>> = {};
 
   forEach(transformed, (value, index) => {
+    if (
+      index === '__proto__' ||
+      index === 'constructor' ||
+      index === 'prototype'
+    ) {
+      throw new Error(
+        `Detected property ${index}. This is a prototype pollution risk, please remove it from your object.`
+      );
+    }
+
     const recursiveResult = walker(
       value,
       identities,