cloudflare / cloudflare/workers-sdk

🐛 BUG: Prototype pollution leads to crash in wrangler

Open
#5,111 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
4.5k
Forks
1.5k
Avg merge
3d 8h
Merged PRs (30d)
186

Description

### Which Cloudflare product(s) does this pertain to?

Wrangler core

### What version(s) of the tool(s) are you using?

3.29.0

### What version of Node are you using?

20.11.1

### What operating system and version are you using?

Windows

### Describe the Bug

### Observed behavior
By using the `__proto__` key in certain conditions, you can crash the wrangler process. A smarter actor than myself may be able to exploit this for deeper prototype pollution.

### Steps to reproduce
- `wrangler.toml`:
```toml
compatibility_date = "2022-01-12"
name = "test"
main = "./src/index.ts"

[vars]
__proto__ = {evil = true}
```
Or:
```toml
compatibility_date = "2022-01-12"
name = "test"
main = "./src/index.ts"

[[kv_namespaces]]
id = "test-namespace"
binding = "__proto__"
```
(etc);.

`src/index.ts`:
```typescript
export interface Env {}
export default {
async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise {
return Response.json(env)
},
};
```
- run `npx wrangler dev`
- Observe process crashing with deep internal error:
```
✘ [ERROR] bindingsGroupedByName[bindingName].push is not a function
```

Or full stack trace (observed when editing the `wrangler.toml` of a previously functional worker:
```
TypeError: bindingsGroupedByName[bindingName].push is not a function
at validateBindingsHaveUniqueNames (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:123686:42)
at normalizeAndValidateConfig (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:121861:3)
at readConfig (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:124003:35)
at FSWatcher. (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:167867:18)
at FSWatcher.emit (node:events:518:28)
at FSWatcher.emit (node:domain:488:12)
at FSWatcher.emitWithAll (E:\GitHub\white-water-2a7c\node_modules\chokidar\index.js:540:8)
at FSWatcher._emit (E:\GitHub\white-water-2a7c\node_modules\chokidar\index.js:632:8)
at listener (E:\GitHub\white-water-2a7c\node_modules\chokidar\lib\nodefs-handler.js:370:20)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.