Fix __proto__ breakage in context validation

master
Sven Slootweg 3 years ago
parent 93be20f9c1
commit d30fce96a8

@ -6,12 +6,13 @@ const syncpipe = require("syncpipe");
const wrapError = require("@validatem/wrap-error");
const forbidden = require("@validatem/forbidden");
const allowExtraProperties = require("@validatem/allow-extra-properties");
const ValidationError = require("@validatem/error");
const reservedProperties = require("../../reserved-properties");
let forbidSpecialProperty = wrapError("Reserved property name cannot be used", forbidden);
module.exports = syncpipe(reservedProperties, [
let baseChecks = syncpipe(reservedProperties, [
(_) => _.filter((property) => property !== "constructor"),
(_) => _.map((property) => {
// NOTE: It is very important that `forbidSpecialProperty` below is wrapped in an array. Otherwise, for the `__proto__` property, it will actually treat the entire rules object as a validatem-special object due to its __proto__ being set directly to an object with the validatem-special marker... We're hacking around this by wrapping it in an array instead, which will not register as such. It's really a hack, though.
@ -20,3 +21,12 @@ module.exports = syncpipe(reservedProperties, [
(_) => fromEntries(_),
(_) => allowExtraProperties(_)
]);
module.exports = [
baseChecks,
(value) => {
if (value.__proto__ != null) {
return new ValidationError("Reserved property name __proto__ cannot be used");
}
}
];

@ -7,6 +7,5 @@ module.exports = [
"message",
"stack",
"cause",
"__proto__",
"constructor"
];

Loading…
Cancel
Save