-
Notifications
You must be signed in to change notification settings - Fork 674
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Prototype Pollution Vulnerability Affecting [email protected] module #1015
Comments
Team any update on this issues |
@jrburke It would be possible and cheap to sanitize the config, it is only 1 place to fix. Line 1283 in acec536
function sanitize(obj) {
if (obj && typeof obj === 'object') {
if (obj.hasOwnProperty('__proto__')) {
delete obj.__proto__;
}
for (const key in obj) {
if (obj.hasOwnProperty(key) && typeof obj[key] === 'object') {
sanitize(obj[key]);
}
}
}
}
...
configure: function (cfg) {
sanitize(cfg); |
EDITED Initially, I couldn't reproduce this vulnerability using the example code. When looking at the code, I saw functions I couldn't reproduce the vulnerability using my fork. I didn't notice that I was testing with that version. I could reproduce it using the official require.js 2.3.6. |
This should be fixed in 2.3.7: requirejs/requirejs#1854 |
Details sent directly to the maintainer
The text was updated successfully, but these errors were encountered: