fix(decode): preserve __proto__ map keys as own properties - #185
fix(decode): preserve __proto__ map keys as own properties#185spokodev wants to merge 2 commits into
Conversation
Decoding a CBOR map with a "__proto__" text key assigned the value with `obj[key] = value`, which invokes the prototype setter on the plain object rather than creating an own property. The entry was silently dropped and the decoded object's prototype was mutated, so valid input did not round-trip. `rejectDuplicateMapKeys` also failed to reject repeated "__proto__" keys because the earlier assignment never created an own property for the duplicate check to find. Assign the "__proto__" key with a data property descriptor so it becomes a normal own enumerable property and the prototype is left untouched.
| assert.strictEqual(obj.__proto__, 1) // eslint-disable-line no-proto | ||
| assert.strictEqual(Object.getPrototypeOf(obj), Object.prototype, 'prototype is unchanged') |
There was a problem hiding this comment.
You should run this without your change in decode.js, I'm pretty sure it'll pass anyway because __proto__ can only be set to an object or null, not primitives/scalars like 1.
Change the test to do something like __proto__ = {naughty:'obj'} (cborg cli tells me it would be a1695f5f70726f746f5f5fa1676e617567687479636f626a) and then I think you have a proper test.
Other than this, it's a good change @spokodev thanks!
|
Updated. The old test used |
2 participants
Decoding a CBOR map with a
"__proto__"text key assigned the value withobj[key] = value, which invokes the prototype setter on the plain object rather than creating an own property. The entry was silently dropped and the decoded object's prototype could be mutated, so valid input did not round trip.rejectDuplicateMapKeysalso failed to reject repeated"__proto__"keys because the earlier assignment never created an own property for the duplicate check to find.This assigns the key with a data property descriptor, so it becomes a normal own enumerable property and the prototype is left untouched. Adds tests for the round trip and the duplicate-key rejection.