stdlib-js / stdlib-js/stdlib

[RFC]: should prototype pollution mitigation strategies be added to `utils/define-property`?

Offen
#11,420 2 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Question Security
Vorherrschende Sprache
JavaScript
Sterne
6k
Forks
1.3k
Ø Merge
1 T. 3 Std.
Gemergte PRs (30 T.)
611

Beschreibung

### Description

A critical prototype pollution vulnerability (TP0002) has been identified in the @stdlib__utils-define-property package, specifically within the package/package/lib/polyfill.js file at line 95. This vulnerability allows an attacker to inject arbitrary properties into the global Object.prototype via direct property assignment, which can lead to widespread unintended modifications of object behavior across the application, potential data corruption, or bypass of security controls.

### Related Issues

_No response_

### Questions

Are there any existing mitigations or safeguards in the package that were intended to prevent direct writes to Object.prototype?
What is the timeline for a fix to address this prototype pollution vector?
Are there other code paths within the package that may expose similar prototype pollution risks?

### Demo

No live demo is provided, as the vulnerability can be reproduced in a local Node.js/browser environment with the steps below.

### Reproduction

```shell
a.Import the affected function from @stdlib__utils-define-property (specifically the polyfill at package/package/lib/polyfill.js).
b.Call the function with the following arguments:
First argument: Object.prototype (targeting the global prototype chain)
Second argument: An arbitrary key (e.g., 'polluted')
Third argument: A descriptor object with a controllable value (e.g., { value: true })
c.Execute the function call: lib(Object.prototype, "polluted", { value: true })
d.Check the Object.prototype for the injected polluted property.
```

### Expected Results

```shell
The function should prevent direct modification of Object.prototype and throw an error, or sanitize/validate the target object to ensure it is not the global prototype. No arbitrary properties should be added to Object.prototype.
```

### Actual Results

```shell
The function executes the assignment Object.prototype[prop] = descriptor.value without validation, resulting in the polluted property being injected into Object.prototype. Verification output confirms:
[CASE_ID=TP0002] [VULN_BOTH] Direct polluted property on Object.prototype
```

### Version

vulnerability identified in the @stdlib__utils-define-property package's polyfill implementation

### Environments

Node.js

### Browser Version

All modern browsers

### Node.js / npm Version

v10+

### Platform

macOS

### Checklist

- [x] Read and understood the [Code of Conduct](https://github.com/stdlib-js/stdlib/blob/develop/CODE_OF_CONDUCT.md).
- [x] Searched for existing issues and pull requests.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start by reading package/package/lib/polyfill.js around line 95 and reproduce the reported call against Object.prototype in a Node.js or browser environment. Review the package for related direct-write paths and existing safeguards. Done means a mitigation strategy is agreed and the reported arbitrary Object.prototype modification is prevented or safely rejected.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
javascript
Bereich
security
Issue-Typ
Bug
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Ruhig
Klarheit
Muss geklärt werden
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.