cloudflare / cloudflare/workers-sdk
🐛 BUG: Prototype pollution leads to crash in wrangler
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.5k
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 186
Description
### Which Cloudflare product(s) does this pertain to?
Wrangler core
### What version(s) of the tool(s) are you using?
3.29.0
### What version of Node are you using?
20.11.1
### What operating system and version are you using?
Windows
### Describe the Bug
### Observed behavior
By using the `__proto__` key in certain conditions, you can crash the wrangler process. A smarter actor than myself may be able to exploit this for deeper prototype pollution.
### Steps to reproduce
- `wrangler.toml`:
```toml
compatibility_date = "2022-01-12"
name = "test"
main = "./src/index.ts"
[vars]
__proto__ = {evil = true}
```
Or:
```toml
compatibility_date = "2022-01-12"
name = "test"
main = "./src/index.ts"
[[kv_namespaces]]
id = "test-namespace"
binding = "__proto__"
```
(etc);.
`src/index.ts`:
```typescript
export interface Env {}
export default {
async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise {
return Response.json(env)
},
};
```
- run `npx wrangler dev`
- Observe process crashing with deep internal error:
```
✘ [ERROR] bindingsGroupedByName[bindingName].push is not a function
```
Or full stack trace (observed when editing the `wrangler.toml` of a previously functional worker:
```
TypeError: bindingsGroupedByName[bindingName].push is not a function
at validateBindingsHaveUniqueNames (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:123686:42)
at normalizeAndValidateConfig (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:121861:3)
at readConfig (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:124003:35)
at FSWatcher. (E:\GitHub\white-water-2a7c\node_modules\wrangler\wrangler-dist\cli.js:167867:18)
at FSWatcher.emit (node:events:518:28)
at FSWatcher.emit (node:domain:488:12)
at FSWatcher.emitWithAll (E:\GitHub\white-water-2a7c\node_modules\chokidar\index.js:540:8)
at FSWatcher._emit (E:\GitHub\white-water-2a7c\node_modules\chokidar\index.js:632:8)
at listener (E:\GitHub\white-water-2a7c\node_modules\chokidar\lib\nodefs-handler.js:370:20)
```
Contributor guide
Assessment
This issue has not been assessed yet.