Security Fix for Prototype Pollution - huntr.dev

src/path-toolkit.js

@@ -63,6 +63,16 @@ var wildCardMatch = function(template, str){
     return match;
 };
 
+/**
+ * Returns true, if given key is included in the blacklisted
+ * keys.
+ * @param {String} key key for check, string.
+ * @returns {Boolean}.
+ */
+function isPrototypePolluted(key) {
+  return ['__proto__', 'prototype', 'constructor'].includes(key);
+}
+
 /**
  * Inspect input value and determine whether it is an Object or not.
  * Values of undefined and null will return "false", otherwise
@@ -1035,7 +1045,10 @@ var PathToolkit = function(options){
                     obj[tk[i]] = {};
                 }
             }
-            obj = obj[tk[i++]];
+            if (!isPrototypePolluted(tk[i])) {
+              obj = obj[tk[i]];
+            }
+            i++;
         }
         return obj;
     };

test/path-toolkit.js

@@ -667,6 +667,16 @@ describe( 'PathToolkit', function(){
             expect(result).to.be.true;
             expect(ary.join(',')).to.equal('NEW,NEW,NEW');
         });
+
+        it('should prevent prototype pollution', function() {
+          var str = '__proto__.polluted';
+          var obj = {};
+          var result = ptk.set(obj, str, 'Yes, its polluted.');
+          expect(result).to.be.true;
+          expect(obj.polluted).to.be.equal('Yes, its polluted.');
+          expect({}.polluted).to.not.be.equal('Yes, its polluted.');
+          expect({}.polluted).to.be.equal(undefined);
+        })
     });
 
     describe( 'find', function(){