Skip to content

Commit

Permalink
fix: __proto__ will now be replaced with ___proto___ in parse (#258)
Browse files Browse the repository at this point in the history
  • Loading branch information
bcoe authored Mar 16, 2020
1 parent 48b6d9c commit 63810ca
Show file tree
Hide file tree
Showing 3 changed files with 70 additions and 2 deletions.
16 changes: 15 additions & 1 deletion index.js
Original file line number Diff line number Diff line change
Expand Up @@ -697,6 +697,10 @@ function parse (args, opts) {
if (!configuration['dot-notation']) keys = [keys.join('.')]

keys.slice(0, -1).forEach(function (key, index) {
// TODO(bcoe): in the next major version of yargs, switch to
// Object.create(null) for dot notation:
key = sanitizeKey(key)

if (typeof o === 'object' && o[key] === undefined) {
o[key] = {}
}
Expand All @@ -716,7 +720,10 @@ function parse (args, opts) {
}
})

const key = keys[keys.length - 1]
// TODO(bcoe): in the next major version of yargs, switch to
// Object.create(null) for dot notation:
const key = sanitizeKey(keys[keys.length - 1])

const isTypeArray = checkAllAliases(keys.join('.'), flags.arrays)
const isValueArray = Array.isArray(value)
let duplicate = configuration['duplicate-arguments-array']
Expand Down Expand Up @@ -1001,4 +1008,11 @@ Parser.detailed = function (args, opts) {
return parse(args.slice(), opts)
}

// TODO(bcoe): in the next major version of yargs, switch to
// Object.create(null) for dot notation:
function sanitizeKey (key) {
if (key === '__proto__') return '___proto___'
return key
}

module.exports = Parser
10 changes: 9 additions & 1 deletion test/fixtures/config.json
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,13 @@
"foo": "baz",
"version": "1.0.2",
"truthy": true,
"toString": "method name"
"toString": "method name",
"__proto__": {
"aaa": 99
},
"bar": {
"__proto__": {
"bbb": 100
}
}
}
46 changes: 46 additions & 0 deletions test/yargs-parser.js
Original file line number Diff line number Diff line change
Expand Up @@ -727,6 +727,25 @@ describe('yargs-parser', function () {

argv.error.message.should.equal('someone set us up the bomb')
})

it('should not pollute the prototype', function () {
const argv = parser(['--foo', 'bar'], {
alias: {
z: 'zoom'
},
default: {
settings: jsonPath
},
config: 'settings'
})

argv.should.have.property('herp', 'derp')
argv.should.have.property('zoom', 55)
argv.should.have.property('foo').and.deep.equal('bar')

expect({}.bbb).to.equal(undefined)
expect({}.aaa).to.equal(undefined)
})
})

describe('config objects', function () {
Expand Down Expand Up @@ -974,6 +993,13 @@ describe('yargs-parser', function () {
argv.f.foo.should.eql(99)
argv.f.bar.should.eql(true)
})

it('should not pollute the prototype', function () {
parser(['-f.__proto__.foo', '99', '-x.y.__proto__.bar', '100', '--__proto__', '200'])
Object.keys({}.__proto__).length.should.equal(0) // eslint-disable-line
expect({}.foo).to.equal(undefined)
expect({}.bar).to.equal(undefined)
})
})

it('should set boolean and alias using explicit true', function () {
Expand Down Expand Up @@ -3702,4 +3728,24 @@ describe('yargs-parser', function () {
argv._.should.eql([101, 102])
})
})

it('should replace the key __proto__ with the key ___proto___', function () {
const argv = parser(['-f.__proto__.foo', '99', '-x.y.__proto__.bar', '100', '--__proto__', '200'])
argv.should.eql({
_: [],
___proto___: 200,
f: {
___proto___: {
foo: 99
}
},
x: {
y: {
___proto___: {
bar: 100
}
}
}
})
})
})

3 comments on commit 63810ca

@MMohanty2
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi I am trying to install protractor framework and facing the following issue
prototype_pollution_issue

@RoadRomeo1
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does anybody knows how do i upgrade it....

@bcoe
Copy link
Member Author

@bcoe bcoe commented on 63810ca Jul 16, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@RoadRomeo1 @MMohanty2 you will need to talk to the upstream library that is pinning to an older version of yargs-parser, and get them to upgrade.

Please sign in to comment.