Skip to content

Commit f6f6a3b

Browse files
committedNov 2, 2021
Use a little more robust method of checking instances
1 parent ef60987 commit f6f6a3b

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed
 

‎lib/validate.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,7 @@ var validate = exports._validate = function(/*Any*/instance,/*Object*/schema,/*O
208208

209209
for(var i in objTypeDef){
210210
if(objTypeDef.hasOwnProperty(i) && i != '__proto__' && i != 'constructor'){
211-
var value = instance[i];
211+
var value = instance.hasOwnProperty(i) ? instance[i] : undefined;
212212
// skip _not_ specified properties
213213
if (value === undefined && options.existingOnly) continue;
214214
var propDef = objTypeDef[i];

5 commit comments

Comments
 (5)

JamieSlome commented on Nov 2, 2021

@JamieSlome

@kriszyp - just to confirm, does this fix the report submitted by the researcher here?

kriszyp commented on Nov 2, 2021

@kriszyp
OwnerAuthor

does this fix the report submitted by the researcher here?

Yes, along with 22f1461, that is intended to fix that security issue.

JamieSlome commented on Nov 2, 2021

@JamieSlome

@kriszyp - thanks for the heads up! Are you able to confirm this on the report, and we can go ahead and publish a CVE / make the report public?

(cc @yoshino-s)

kriszyp commented on Nov 9, 2021

@kriszyp
OwnerAuthor

Yes, I have published the updated version with the fix.

JamieSlome commented on Nov 9, 2021

@JamieSlome

@kriszyp - could you update this on the report: https://huntr.dev/bounties/bb6ccd63-f505-4e3a-b55f-cd2662c261a9/

You can also decide if you would like to keep the bounty for yourself or return it to the prize pot 👌

Please sign in to comment.