fix(security): prevent prototype pollution in memory store (#397)

indexzero · Apr 10, 2022 · feaba56 · feaba56
1 parent 218059e
commit feaba56
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/lib/nconf/stores/memory.js b/lib/nconf/stores/memory.js
@@ -92,7 +92,7 @@ Memory.prototype.set = function (key, value) {
   //
   while (path.length > 1) {
     key = path.shift();
-    if (!target[key] || typeof target[key] !== 'object') {
+    if (!target[key] || typeof target[key] !== 'object' || !Object.hasOwnProperty.call(target, key)) {
       target[key] = {};
     }
 

diff --git a/test/stores/memory-store-test.js b/test/stores/memory-store-test.js
@@ -121,5 +121,12 @@ vows.describe('nconf/stores/memory').addBatch({
         assert.equal(store.get('foo').bar.bazz, 'buzz');
       }
     }
+  },
+  "When attempting prototype pollution": {
+    topic: new nconf.Memory(),
+    "should not be able to pollute the prototype": function (store) {
+      store.set('__proto__:polluted', 'yes');
+      assert.equal({}.polluted, undefined);
+    }
   }
 }).export(module);