A prototype pollution in derby can crash the application, if the application author has atypical HTML templates that feed user input into an object key.
Attribute keys are almost always developer-controlled, not end-user-controlled, so this shouldn’t be an issue in practice for most applications.
emit(context: Context, target: T) {
const node = traverseAndCreate(context.controller, this.segments);
node[this.lastSegment] = target;
this.addListeners(target, node, this.lastSegment);
}
The emit() function in src/templates/templates.ts is called without sanitizing the variable this.lastSegment
. The variable this.lastSegment
can be set to __proto__
, and this will pollute the prototype of Javascipt Object (node['__proto__'] = target
).
To reproduce this vulnerability, you can adjust the test case ignores DOM mutations in components\' create()
in test/dom/ComponentHarness.mocha.js
.
it('ignores DOM mutations in components\' create()', function() {
function Box() {}
Box.view = {
is: 'box',
- source: '<index:><div></div>'
+ source: '<index:><div></div>'
};
Box.prototype.create = function() {
this.boxElement.className = 'box-changed-in-create';
};
var harness = runner.createHarness('<view is="box" />', Box);
expect(harness).to.render('<div></div>');
});
When as
attribute is controlled by attackers, the variable in this.lastSegment
will exactly take value __proto__
and prototype pollution happens.
Add a check on this.lastSegment
can prevent this attack.
emit(context: Context, target: T) {
const node = traverseAndCreate(context.controller, this.segments);
+ if (this.lastSegment.includes('__proto__') || this.lastSegment.includes('prototype')) {
+ throw new Error('Unsafe code detected');
+ }
node[this.lastSegment] = target;
this.addListeners(target, node, this.lastSegment);
}
CPE | Name | Operator | Version |
---|---|---|---|
derby | lt | 4.0.0-beta.11 | |
derby | lt | 3.0.2 | |
derby | ge | 3.0.0 | |
derby | lt | 2.3.2 | |
derby | ge | 4.0.0-beta1 |