Skip to content

Commit f1efabf

Browse files
committed
fix: avoid prototype pollution on init
1 parent 98e0762 commit f1efabf

File tree

2 files changed

+24
-0
lines changed

2 files changed

+24
-0
lines changed

lib/document.js

+4
Original file line numberDiff line numberDiff line change
@@ -689,6 +689,10 @@ function init(self, obj, doc, opts, prefix) {
689689

690690
function _init(index) {
691691
i = keys[index];
692+
// avoid prototype pollution
693+
if (i === '__proto__' || i === 'constructor') {
694+
return;
695+
}
692696
path = prefix + i;
693697
schema = self.$__schema.path(path);
694698

test/document.test.js

+20
Original file line numberDiff line numberDiff line change
@@ -10528,4 +10528,24 @@ describe('document', function() {
1052810528
assert.ok(!band.embeddedMembers[0].member.name);
1052910529
});
1053010530
});
10531+
10532+
it('avoids prototype pollution on init', function() {
10533+
const Example = db.model('Example', new Schema({ hello: String }));
10534+
10535+
return co(function*() {
10536+
const example = yield new Example({ hello: 'world!' }).save();
10537+
yield Example.findByIdAndUpdate(example._id, {
10538+
$rename: {
10539+
hello: '__proto__.polluted'
10540+
}
10541+
});
10542+
10543+
// this is what causes the pollution
10544+
yield Example.find();
10545+
10546+
const test = {};
10547+
assert.strictEqual(test.polluted, undefined);
10548+
assert.strictEqual(Object.prototype.polluted, undefined);
10549+
});
10550+
});
1053110551
});

0 commit comments

Comments
 (0)