fix prototype pollution (#1482)

i18next · Jul 10, 2020 · 44c2e76 · 44c2e76
1 parent 8a3b93b
commit 44c2e76
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 12 deletions.
diff --git a/src/utils.js b/src/utils.js
@@ -84,20 +84,22 @@ export function getPathWithDefaults(data, defaultData, key) {
 export function deepExtend(target, source, overwrite) {
   /* eslint no-restricted-syntax: 0 */
   for (const prop in source) {
-    if (prop in target) {
-      // If we reached a leaf string in target or source then replace with source or skip depending on the 'overwrite' switch
-      if (
-        typeof target[prop] === 'string' ||
-        target[prop] instanceof String ||
-        typeof source[prop] === 'string' ||
-        source[prop] instanceof String
-      ) {
-        if (overwrite) target[prop] = source[prop];
+    if (prop !== '__proto__') {
+      if (prop in target) {
+        // If we reached a leaf string in target or source then replace with source or skip depending on the 'overwrite' switch
+        if (
+          typeof target[prop] === 'string' ||
+          target[prop] instanceof String ||
+          typeof source[prop] === 'string' ||
+          source[prop] instanceof String
+        ) {
+          if (overwrite) target[prop] = source[prop];
+        } else {
+          deepExtend(target[prop], source[prop], overwrite);
+        }
       } else {
-        deepExtend(target[prop], source[prop], overwrite);
+        target[prop] = source[prop];
       }
-    } else {
-      target[prop] = source[prop];
     }
   }
   return target;

diff --git a/test/resourceStore.spec.js b/test/resourceStore.spec.js
@@ -141,6 +141,12 @@ describe('ResourceStore', () => {
           test: 'test',
         });
       });
+
+      it('without polluting the prototype', () => {
+        const malicious_payload = '{"__proto__":{"vulnerable":"Polluted"}}';
+        rs.addResourceBundle('en', 'translation', JSON.parse(malicious_payload), true, true);
+        expect({}.vulnerable).to.eql(undefined);
+      });
     });
 
     describe('can check resources bundle', () => {