Prototype Pollution in Dojox

Type github
Reporter GitHub Advisory Database
Modified 2020-03-12T20:29:31


The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution.

Affected Area: // var tobj = {}; for(var x in props){ // the "tobj" condition avoid copying properties in "props" // inherited from Object.prototype. For example, if obj has a custom // toString() method, don't overwrite it with the toString() method // that props inherited from Object.prototype if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){ if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){ if(dojo.isArray(props[x])){ obj[x] = props[x]; }else{ obj[x] = jqMix(obj[x], props[x]); } }else{ obj[x] = props[x]; }