fix-prototype-pollution

Author: dellalibera

jsonpointer.js

@@ -17,10 +17,9 @@ function setter (obj, pointer, value) {
   var part
   var hasNextPart
 
-  if (pointer[1] === 'constructor' && pointer[2] === 'prototype') return obj
-  if (pointer[1] === '__proto__') return obj
-
   for (var p = 1, len = pointer.length; p < len;) {
+    if (pointer[p] === 'constructor' || pointer[p] === 'prototype' || pointer[p] === '__proto__') return obj
+
     part = untilde(pointer[p++])
     hasNextPart = len > p
 
@@ -53,6 +52,11 @@ function compilePointer (pointer) {
     if (pointer[0] === '') return pointer
     throw new Error('Invalid JSON pointer.')
   } else if (Array.isArray(pointer)) {
+    pointer.forEach(function (part, i) {
+      if (typeof part !== 'string' && typeof part !== 'number') {
+        pointer[i] = '' + part
+      }
+    })
     return pointer
   }
 

test.js

@@ -136,4 +136,49 @@ var c = {}
 jsonpointer.set({}, '/__proto__/boo', 'polluted')
 assert(!c.boo, 'should not boo')
 
+var d = {}
+jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
+assert(!d.boo, 'should not boo')
+
+jsonpointer.set({}, '/foo/__proto__/__proto__/boo', 'polluted')
+assert(!d.boo, 'should not boo')
+
+var e = {}
+jsonpointer.set({}, '/constructor/prototype/boo', 'polluted')
+assert(!e.boo, 'should not boo')
+
+jsonpointer.set({}, '/foo/constructor/prototype/boo', 'polluted')
+assert(!e.boo, 'should not boo')
+
+jsonpointer.set({}, '/foo/constructor/constructor/prototype/boo', 'polluted')
+assert(!e.boo, 'should not boo')
+
+var f = {}
+jsonpointer.set({}, [['__proto__'], 'boo'], 'polluted')
+assert(!f.boo, 'should not f.boo')
+
+jsonpointer.set({}, [[['__proto__']], 'boo'], 'polluted')
+assert(!f.boo, 'should not f.boo')
+
+jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')
+assert(!f.boo, 'should not f.boo')
+
+jsonpointer.set({}, [[['__proto__']], [['__proto__']], 'boo'], 'polluted')
+assert(!f.boo, 'should not f.boo')
+
+jsonpointer.set({}, [['__proto__'], ['__proto__'], ['__proto__'], 'boo'], 'polluted')
+assert(!f.boo, 'should not f.boo')
+
+jsonpointer.set({}, [['foo'], ['__proto__'], 'boo'], 'polluted')
+assert(!f.boo, 'should not boo')
+
+jsonpointer.set({}, [['foo'], ['__proto__'], ['__proto__'], 'boo'], 'polluted')
+assert(!f.boo, 'should not boo')
+
+jsonpointer.set({}, [['constructor'], ['prototype'], 'boo'], 'polluted')
+assert(!f.boo, 'should not boo')
+
+jsonpointer.set({}, [['constructor'], ['constructor'], ['prototype'], 'boo'], 'polluted')
+assert(!f.boo, 'should not boo')
+
 console.log('All tests pass.')