Merge pull request #252 from 418sec/1-npm-expr-eval

Security Fix for Prototype Pollution - huntr.dev
silentmatt · Oct 11, 2021 · 6e889e0 · 6e889e0 · ds-albans · Nov 19, 2022
2 parents a556e27 + 3679a4d
commit 6e889e0
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/evaluate.js b/src/evaluate.js
@@ -41,6 +41,9 @@ export default function evaluate(tokens, expr, values) {
         nstack.push(f(resolveExpression(n1, values), resolveExpression(n2, values), resolveExpression(n3, values)));
       }
     } else if (type === IVAR) {
+      if (/^__proto__|prototype|constructor$/.test(item.value)) {
+        throw new Error('prototype access detected');
+      }
       if (item.value in expr.functions) {
         nstack.push(expr.functions[item.value]);
       } else if (item.value in expr.unaryOps && expr.parser.isOperatorEnabled(item.value)) {