stdlib-js / stdlib-js/stdlib

[RFC]: should prototype pollution mitigation strategies be added to `utils/define-property`?

Open
#11,420 2 comments 0 reactions 0 assignees View on GitHub
Question Security
Dominant language
JavaScript
Stars
6k
Forks
1.3k
Avg merge
1d 3h
Merged PRs (30d)
611

Description

### Description

A critical prototype pollution vulnerability (TP0002) has been identified in the @stdlib__utils-define-property package, specifically within the package/package/lib/polyfill.js file at line 95. This vulnerability allows an attacker to inject arbitrary properties into the global Object.prototype via direct property assignment, which can lead to widespread unintended modifications of object behavior across the application, potential data corruption, or bypass of security controls.

### Related Issues

_No response_

### Questions

Are there any existing mitigations or safeguards in the package that were intended to prevent direct writes to Object.prototype?
What is the timeline for a fix to address this prototype pollution vector?
Are there other code paths within the package that may expose similar prototype pollution risks?

### Demo

No live demo is provided, as the vulnerability can be reproduced in a local Node.js/browser environment with the steps below.

### Reproduction

```shell
a.Import the affected function from @stdlib__utils-define-property (specifically the polyfill at package/package/lib/polyfill.js).
b.Call the function with the following arguments:
First argument: Object.prototype (targeting the global prototype chain)
Second argument: An arbitrary key (e.g., 'polluted')
Third argument: A descriptor object with a controllable value (e.g., { value: true })
c.Execute the function call: lib(Object.prototype, "polluted", { value: true })
d.Check the Object.prototype for the injected polluted property.
```

### Expected Results

```shell
The function should prevent direct modification of Object.prototype and throw an error, or sanitize/validate the target object to ensure it is not the global prototype. No arbitrary properties should be added to Object.prototype.
```

### Actual Results

```shell
The function executes the assignment Object.prototype[prop] = descriptor.value without validation, resulting in the polluted property being injected into Object.prototype. Verification output confirms:
[CASE_ID=TP0002] [VULN_BOTH] Direct polluted property on Object.prototype
```

### Version

vulnerability identified in the @stdlib__utils-define-property package's polyfill implementation

### Environments

Node.js

### Browser Version

All modern browsers

### Node.js / npm Version

v10+

### Platform

macOS

### Checklist

- [x] Read and understood the [Code of Conduct](https://github.com/stdlib-js/stdlib/blob/develop/CODE_OF_CONDUCT.md).
- [x] Searched for existing issues and pull requests.

Contributor guide

Open the contributing guide

Research direction

Start by reading package/package/lib/polyfill.js around line 95 and reproduce the reported call against Object.prototype in a Node.js or browser environment. Review the package for related direct-write paths and existing safeguards. Done means a mitigation strategy is agreed and the reported arbitrary Object.prototype modification is prevented or safely rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.