expressjs / expressjs/body-parser

Implement a __proto__ check option

Open
#347 17 comments 2 reactions 0 assignees View on GitHub
discuss ideas
Dominant language
JavaScript
Stars
5.5k
Forks
767
Avg merge
13h 53m
Merged PRs (30d)
10

Description

Eran Hammer posted an article on __proto__ poisoning and his solution in joi/hapi: https://hueniverse.com/a-tale-of-prototype-poisoning-2610fa170061

@rgrove posted a simple implementation of a fix for this: https://gist.github.com/rgrove/3ea9421b3912235e978f55e291f19d5d

However the fix requires a custom reviver that might slow down the default/valid parsing case, Eran prevented this by using an initial check for `__proto__`. It might be good to add this as a default to be checked for in body-parser in general that can be switched off... if someone wants to do so.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.