Skip to content

Commit

Permalink
Update src/plainer.ts
Browse files Browse the repository at this point in the history
Co-authored-by: Simon Knott <[email protected]>
  • Loading branch information
tmcw and Skn0tt committed Oct 23, 2023
1 parent 5f7b33b commit bade223
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 18 deletions.
28 changes: 11 additions & 17 deletions src/index.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -686,23 +686,6 @@ describe('stringify & parse', () => {
},
},
},
'strips constructor, __proto__, and prototype properties': {
input: {
a: {
z: 10,
constructor: undefined,
__proto__: null,
prototype: null,
},
},
output: {
a: {
z: 10,
},
},
outputAnnotations: undefined,
dontExpectEquality: true,
},
};

function deepFreeze(object: any, alreadySeenObjects = new Set()) {
Expand Down Expand Up @@ -1071,6 +1054,17 @@ test('regression: `Object.create(null)` / object without prototype', () => {
expect(parsed.date).toBeInstanceOf(Date);
});

test.each(['__proto__', 'prototype', 'constructor'])(
'serialize prototype pollution: %s',
forbidden => {
expect(() => {
SuperJSON.serialize({
[forbidden]: 1,
});
}).toThrowError(/This is a prototype pollution risk/);
}
);

test('prototype pollution - __proto__', () => {
expect(() => {
SuperJSON.parse(
Expand Down
4 changes: 3 additions & 1 deletion src/plainer.ts
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,9 @@ export const walker = (
index === 'constructor' ||
index === 'prototype'
) {
return;
throw new Error(
`Detected property ${index}. This is a prototype pollution risk, please remove it from your object.`
);
}

const recursiveResult = walker(
Expand Down

0 comments on commit bade223

Please sign in to comment.