stdlib-js / stdlib-js/stdlib

[RFC]: should prototype pollution mitigation strategies be added to `utils/define-property`?

Ouverte
#11,420 2 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Question Security
Langage dominant
JavaScript
Étoiles
6k
Forks
1.3k
Merge moyen
1 j 3 h
PR mergées (30 j)
611

Description

### Description

A critical prototype pollution vulnerability (TP0002) has been identified in the @stdlib__utils-define-property package, specifically within the package/package/lib/polyfill.js file at line 95. This vulnerability allows an attacker to inject arbitrary properties into the global Object.prototype via direct property assignment, which can lead to widespread unintended modifications of object behavior across the application, potential data corruption, or bypass of security controls.

### Related Issues

_No response_

### Questions

Are there any existing mitigations or safeguards in the package that were intended to prevent direct writes to Object.prototype?
What is the timeline for a fix to address this prototype pollution vector?
Are there other code paths within the package that may expose similar prototype pollution risks?

### Demo

No live demo is provided, as the vulnerability can be reproduced in a local Node.js/browser environment with the steps below.

### Reproduction

```shell
a.Import the affected function from @stdlib__utils-define-property (specifically the polyfill at package/package/lib/polyfill.js).
b.Call the function with the following arguments:
First argument: Object.prototype (targeting the global prototype chain)
Second argument: An arbitrary key (e.g., 'polluted')
Third argument: A descriptor object with a controllable value (e.g., { value: true })
c.Execute the function call: lib(Object.prototype, "polluted", { value: true })
d.Check the Object.prototype for the injected polluted property.
```

### Expected Results

```shell
The function should prevent direct modification of Object.prototype and throw an error, or sanitize/validate the target object to ensure it is not the global prototype. No arbitrary properties should be added to Object.prototype.
```

### Actual Results

```shell
The function executes the assignment Object.prototype[prop] = descriptor.value without validation, resulting in the polluted property being injected into Object.prototype. Verification output confirms:
[CASE_ID=TP0002] [VULN_BOTH] Direct polluted property on Object.prototype
```

### Version

vulnerability identified in the @stdlib__utils-define-property package's polyfill implementation

### Environments

Node.js

### Browser Version

All modern browsers

### Node.js / npm Version

v10+

### Platform

macOS

### Checklist

- [x] Read and understood the [Code of Conduct](https://github.com/stdlib-js/stdlib/blob/develop/CODE_OF_CONDUCT.md).
- [x] Searched for existing issues and pull requests.

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start by reading package/package/lib/polyfill.js around line 95 and reproduce the reported call against Object.prototype in a Node.js or browser environment. Review the package for related direct-write paths and existing safeguards. Done means a mitigation strategy is agreed and the reported arbitrary Object.prototype modification is prevented or safely rejected.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
javascript
Domaine
security
Type d'issue
Bug
Difficulté
5/5
Temps estimé
Plus d'une semaine
Activité
Calme
Clarté
À clarifier
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.