// `<div id="test" ><a href="https://www.google.com" __proto__="polluted=true>test</a></div>`;
const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="polluted=true">test</a></div>`;
const documentRoot = parse(test, {
lowerCaseTagName: true,
comment: false,
blockTextElements: {
script: false,
noscript: false,
style: true,
},
});
const childElement = documentRoot.querySelector(`#test`);
const rootElement = <HTMLElement>(<unknown>childElement.childNodes[0]);
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore
console.log('attributes.polluted = ', rootElement.attributes.polluted);
// output :
// attributes.polluted = true"
I`m don't think it can lead to a remote code execution, but I think that you should prevent this.
Other examples :
const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="toString()=global.process.exit)>test</a></div>`;
console.log('attributes = ', rootElement.attributes);
// attributes = {
href: 'https://www.google.com',
toString: '',
global: '',
process: '',
exit: ''
}
const test = `<div id="test" __proto__="true><a href="https://www.google.com" __proto__="__proto__.href=http://www.example.com/>test</a></div>`;
console.log('attributes = ', rootElement.attributes);
// attributes = { href: 'http://www.example.com' }
I`m don't think it can lead to a remote code execution, but I think that you should prevent this.
Other examples :