stdlib-js / stdlib-js/stdlib

[RFC]: should prototype pollution mitigation strategies be added to `utils/define-property`?

Abierto
#11,420 2 comentarios 0 reacciones 0 asignados Ver en GitHub
Question Security
Lenguaje dominante
JavaScript
Estrellas
6k
Forks
1.3k
Merge medio
1 d 3 h
PR fusionados (30 d)
611

Descripción

### Description

A critical prototype pollution vulnerability (TP0002) has been identified in the @stdlib__utils-define-property package, specifically within the package/package/lib/polyfill.js file at line 95. This vulnerability allows an attacker to inject arbitrary properties into the global Object.prototype via direct property assignment, which can lead to widespread unintended modifications of object behavior across the application, potential data corruption, or bypass of security controls.

### Related Issues

_No response_

### Questions

Are there any existing mitigations or safeguards in the package that were intended to prevent direct writes to Object.prototype?
What is the timeline for a fix to address this prototype pollution vector?
Are there other code paths within the package that may expose similar prototype pollution risks?

### Demo

No live demo is provided, as the vulnerability can be reproduced in a local Node.js/browser environment with the steps below.

### Reproduction

```shell
a.Import the affected function from @stdlib__utils-define-property (specifically the polyfill at package/package/lib/polyfill.js).
b.Call the function with the following arguments:
First argument: Object.prototype (targeting the global prototype chain)
Second argument: An arbitrary key (e.g., 'polluted')
Third argument: A descriptor object with a controllable value (e.g., { value: true })
c.Execute the function call: lib(Object.prototype, "polluted", { value: true })
d.Check the Object.prototype for the injected polluted property.
```

### Expected Results

```shell
The function should prevent direct modification of Object.prototype and throw an error, or sanitize/validate the target object to ensure it is not the global prototype. No arbitrary properties should be added to Object.prototype.
```

### Actual Results

```shell
The function executes the assignment Object.prototype[prop] = descriptor.value without validation, resulting in the polluted property being injected into Object.prototype. Verification output confirms:
[CASE_ID=TP0002] [VULN_BOTH] Direct polluted property on Object.prototype
```

### Version

vulnerability identified in the @stdlib__utils-define-property package's polyfill implementation

### Environments

Node.js

### Browser Version

All modern browsers

### Node.js / npm Version

v10+

### Platform

macOS

### Checklist

- [x] Read and understood the [Code of Conduct](https://github.com/stdlib-js/stdlib/blob/develop/CODE_OF_CONDUCT.md).
- [x] Searched for existing issues and pull requests.

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start by reading package/package/lib/polyfill.js around line 95 and reproduce the reported call against Object.prototype in a Node.js or browser environment. Review the package for related direct-write paths and existing safeguards. Done means a mitigation strategy is agreed and the reported arbitrary Object.prototype modification is prevented or safely rejected.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
javascript
Área
security
Tipo de issue
Error
Dificultad
5/5
Tiempo estimado
Más de una semana
Estado de actividad
Tranquilo
Claridad
Necesita aclaración
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.