Skip to content

Commit

Permalink
feat(NODE-6225): add property ownership check before referencing `mon…
Browse files Browse the repository at this point in the history
…gocryptdSpawnPath` and `mongocryptdSpawnArgs` (#4151)

Co-authored-by: Durran Jordan <[email protected]>
  • Loading branch information
vuusale and durran authored Jul 1, 2024
1 parent d85f827 commit f48f8d3
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 6 deletions.
14 changes: 9 additions & 5 deletions src/client-side-encryption/mongocryptd_manager.ts
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ export class MongocryptdManager {

uri: string;
bypassSpawn: boolean;
spawnPath: string;
spawnArgs: Array<string>;
spawnPath = '';
spawnArgs: Array<string> = [];
_child?: ChildProcess;

constructor(extraOptions: AutoEncryptionExtraOptions = {}) {
Expand All @@ -24,9 +24,13 @@ export class MongocryptdManager {

this.bypassSpawn = !!extraOptions.mongocryptdBypassSpawn;

this.spawnPath = extraOptions.mongocryptdSpawnPath || '';
this.spawnArgs = [];
if (Array.isArray(extraOptions.mongocryptdSpawnArgs)) {
if (Object.hasOwn(extraOptions, 'mongocryptdSpawnPath') && extraOptions.mongocryptdSpawnPath) {
this.spawnPath = extraOptions.mongocryptdSpawnPath;
}
if (
Object.hasOwn(extraOptions, 'mongocryptdSpawnArgs') &&
Array.isArray(extraOptions.mongocryptdSpawnArgs)
) {
this.spawnArgs = this.spawnArgs.concat(extraOptions.mongocryptdSpawnArgs);
}
if (
Expand Down
10 changes: 10 additions & 0 deletions test/unit/client-side-encryption/mongocryptd_manager.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ describe('MongocryptdManager', function () {
expect(mcdm.spawnArgs).to.deep.equal(['--idleShutdownTimeoutSecs', '12']);
});

it('does not allow prototype pollution on spawn path', function () {
const mcdm = new MongocryptdManager({ __proto__: { mongocryptdSpawnPath: 'test' } });
expect(mcdm.spawnPath).to.equal('');
});

it('does not allow prototype pollution on spawn args', function () {
const mcdm = new MongocryptdManager({ __proto__: { mongocryptdSpawnArgs: ['test'] } });
expect(mcdm.spawnArgs).to.deep.equal(['--idleShutdownTimeoutSecs', '60']);
});

it('should not override `idleShutdownTimeoutSecs` if the user sets it using `key=value` form', function () {
const mcdm = new MongocryptdManager({
mongocryptdSpawnArgs: ['--idleShutdownTimeoutSecs=12']
Expand Down
3 changes: 2 additions & 1 deletion tsconfig.json
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@
"skipLibCheck": true,
"lib": [
"es2021",
"ES2022.Error"
"ES2022.Error",
"ES2022.Object"
],
// We don't make use of tslib helpers, all syntax used is supported by target engine
"importHelpers": false,
Expand Down

0 comments on commit f48f8d3

Please sign in to comment.