Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent prototype pollution in cookie memstore #283

Merged
merged 1 commit into from
Jun 5, 2023

Conversation

colincasey
Copy link
Contributor

All occurrences of new object creation in memstore.js have been changed from {} (i.e.; Object.create(Object.prototype) to Object.create(null) so that we are using object instances that do not have a prototype property that can be polluted.

@fixes #282

All occurrences of new object creation in `memstore.js` have been changed from `{}` (i.e.; `Object.create(Object.prototype)` to `Object.create(null)` so that we are using object instances that do not have a prototype property that can be polluted.

@fixes #282
@colincasey colincasey requested review from awaterma and wjhsf June 3, 2023 19:14
@colincasey colincasey self-assigned this Jun 3, 2023
Copy link
Member

@awaterma awaterma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for jumping on this Colin. LGTM.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Security Risk
2 participants