hof 24.3.2 → 24.4.0-proto-fix-beta

package/CHANGELOG.md

@@ -1,4 +1,10 @@
-## 2026-07-01 Verseion 24.4.0 (Stable), @meganjohnHO
+## 2026-07-01, Version 24.4.0 (Stable), @vivekkumar-ho
+
+### Security
+- Added always-on prototype pollution protection to block dangerous keys and values in request body, query, and route params.
+- Prototype pollution attempts now return `400` with `PROTOTYPE_POLLUTION_DETECTED`.
+
+## 2026-07-01 Version 24.3.2 (Stable), @meganjohnHO
 
 ### Changed
 - Google Analytics domains now added into CSP on presence of `ga4TagId` or `gaTagId` (previously only on `gaTagId`).

package/controller/base-controller.js

@@ -11,6 +11,17 @@ const ErrorClass = require('./validation-error');
 const Helpers = require('../utilities').helpers;
 const sanitisationBlacklistArray = require('../config/sanitisation-rules');
 
+// Always-on protection against prototype pollution payloads before request data is used by form configuration.
+const defaultPrototypePollutionProtection = {
+  enabled: true,
+  blockedKeys: ['__proto__', 'prototype', 'constructor'],
+  blockedValues: {
+    body: ['__proto__'],
+    query: ['__proto__'],
+    params: ['__proto__', 'prototype', 'constructor']
+  }
+};
+
 module.exports = class BaseController extends EventEmitter {
   constructor(options) {
     if (!options) {
@@ -206,10 +217,140 @@ module.exports = class BaseController extends EventEmitter {
     callback();
   }
 
+  getPrototypePollutionProtectionOptions() {
+    return _.cloneDeep(defaultPrototypePollutionProtection);
+  }
+
+  hasInheritedEnumerableKey(value, seen) {
+    if (!_.isObjectLike(value)) {
+      return false;
+    }
+
+    const visited = seen || new Set();
+    if (visited.has(value)) {
+      return false;
+    }
+
+    visited.add(value);
+
+    for (const key in value) {
+      if (
+        !Object.prototype.hasOwnProperty.call(value, key) ||
+        this.hasInheritedEnumerableKey(value[key], visited)
+      ) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  hasBlockedKeyOrValue(value, blockedKeys, blockedValues, seen) {
+    if (_.isString(value)) {
+      return blockedValues.has(value);
+    }
+
+    if (!_.isObjectLike(value)) {
+      return false;
+    }
+
+    const visited = seen || new Set();
+    if (visited.has(value)) {
+      return false;
+    }
+
+    visited.add(value);
+
+    const ownKeys = Object.keys(value);
+    for (const key of ownKeys) {
+      if (blockedKeys.has(key)) {
+        return true;
+      }
+
+      if (this.hasBlockedKeyOrValue(value[key], blockedKeys, blockedValues, visited)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  logPrototypePollutionBlocked(req, details) {
+    if (req && typeof req.log === 'function') {
+      req.log('warn', 'security.prototype_pollution.blocked', details);
+      return;
+    }
+
+    const logger = _.get(this, 'options.logger');
+    if (!logger) {
+      return;
+    }
+
+    if (typeof logger.warn === 'function') {
+      logger.warn('security.prototype_pollution.blocked', details);
+      return;
+    }
+
+    if (typeof logger.log === 'function') {
+      logger.log('warn', 'security.prototype_pollution.blocked', details);
+    }
+  }
+
+  checkPrototypePollution(req) {
+    const protection = this.getPrototypePollutionProtectionOptions();
+    const blockedKeys = new Set(protection.blockedKeys);
+    const sources = {
+      body: req.body,
+      query: req.query,
+      params: req.params
+    };
+
+    for (const sourceName of Object.keys(sources)) {
+      const source = sources[sourceName];
+      if (!source) {
+        continue;
+      }
+
+      try {
+        if (this.hasInheritedEnumerableKey(source)) {
+          return {
+            reason: 'inherited_key',
+            source: sourceName
+          };
+        }
+
+        const blockedValues = new Set(_.get(protection, `blockedValues.${sourceName}`, []));
+        if (this.hasBlockedKeyOrValue(source, blockedKeys, blockedValues)) {
+          return {
+            reason: 'blocked_key_or_value',
+            source: sourceName
+          };
+        }
+      } catch (err) {
+        return {
+          reason: 'scan_error',
+          source: sourceName
+        };
+      }
+    }
+
+    return null;
+  }
+
   _configure(req, res, callback) {
     req.form = req.form || {};
     req.form.options = _.cloneDeep(this.options);
-    this.configure(req, res, callback);
+
+    const pollutionDetection = this.checkPrototypePollution(req);
+    if (pollutionDetection) {
+      this.logPrototypePollutionBlocked(req, pollutionDetection);
+      const err = new Error('Prototype pollution detected');
+      err.statusCode = 403;
+      err.code = 'PROTOTYPE_POLLUTION_DETECTED';
+      return callback(err);
+    }
+
+    return this.configure(req, res, callback);
   }
 
   configure(req, res, callback) {

package/frontend/govuk-template/govuk_template_generated.html

@@ -0,0 +1,118 @@
+
+<!DOCTYPE html>
+<!--[if lt IE 9]><html class="lte-ie8" lang="{{htmlLang}}"><![endif]-->
+<!--[if gt IE 8]><!--><html lang="{{htmlLang}}" class="govuk-template--rebranded"><!--<![endif]-->
+  <head>
+    <meta charset="utf-8" />
+    <title>{{$pageTitle}}{{/pageTitle}}</title>
+    {{$head}}{{/head}}
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+    <meta name="theme-color" content="#1d70b8">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <link rel="icon" sizes="48x48" href="{{govukAssetPath}}rebrand/images/favicon.ico">
+    <link rel="icon" sizes="any" href="{{govukAssetPath}}rebrand/images/favicon.svg" type="image/svg+xml">
+    <link rel="mask-icon" href="{{govukAssetPath}}rebrand/images/govuk-icon-mask.svg" color="#1d70b8">
+    <link rel="apple-touch-icon" href="{{govukAssetPath}}rebrand/images/govuk-icon-180.png">
+    <link rel="manifest" href="{{govukAssetPath}}rebrand/manifest.json">
+    <meta property="og:image" content="{{govukAssetPath}}rebrand/images/govuk-opengraph-image.png">
+  </head>
+
+  <body class="{{$bodyClasses}}{{/bodyClasses}} govuk-template__body  js-enabled" >
+    <script {{#nonce}}nonce="{{nonce}}"{{/nonce}}>document.body.className += ' js-enabled' + ('noModule' in HTMLScriptElement.prototype ? ' govuk-frontend-supported' : '');</script>
+
+
+    <div id="global-cookie-message" class="gem-c-cookie-banner govuk-clearfix" data-module="cookie-banner" role="region" aria-label="cookie banner" data-nosnippet="">
+       {{$cookieMessage}}{{/cookieMessage}}
+    </div>
+
+	{{$bodyStart}}{{/bodyStart}}
+
+    <header role="banner" id="govuk-header" class="{{$headerClass}}{{/headerClass}}">
+      <div class="govuk-header__container govuk-width-container">
+
+          <div class="govuk-header__logo">
+            <a href="{{$homepageUrl}}https://www.gov.uk{{/homepageUrl}}" title="{{$logoLinkTitle}}Go to the GOV.UK homepage{{/logoLinkTitle}}" id="logo" class="govuk-header__link govuk-header__link--homepage" target="_blank" data-module="track-click" data-track-category="homeLinkClicked" data-track-action="homeHeader">
+                <!--[if gt IE 8]><!-->
+                <div id="govuk-header__logo"></div>
+                <img src="/public/images/govuk-logo.svg" id="govuk-header__logo" alt="Logo" loading="lazy" />
+                  <!--<![endif]-->
+                  <!--[if IE 8]>
+                  <img src="{{govukAssetPath}}rebrand/images/govuk-logotype-tudor-crown.png" class="govuk-header__logotype-crown-fallback-image" width="32" height="30" alt="">
+                  <![endif]-->
+            </a>
+          </div>
+          {{$insideHeader}}{{/insideHeader}}
+
+        {{$propositionHeader}}{{/propositionHeader}}
+      </div>
+    </header>
+
+
+    {{$afterHeader}}{{/afterHeader}}
+
+
+    {{$main}}{{/main}}
+
+    <footer class="govuk-footer">
+      <div class="govuk-width-container">
+        <svg
+          focusable="false"
+          role="presentation"
+          xmlns="http://www.w3.org/2000/svg"
+          viewBox="0 0 64 60"
+          height="30"
+          width="32"
+          fill="currentcolor" class="govuk-footer__crown">
+          <g>
+            <circle cx="20" cy="17.6" r="3.7" />
+            <circle cx="10.2" cy="23.5" r="3.7" />
+            <circle cx="3.7" cy="33.2" r="3.7" />
+            <circle cx="31.7" cy="30.6" r="3.7" />
+            <circle cx="43.3" cy="17.6" r="3.7" />
+            <circle cx="53.2" cy="23.5" r="3.7" />
+            <circle cx="59.7" cy="33.2" r="3.7" />
+            <circle cx="31.7" cy="30.6" r="3.7" />
+            <path d="M33.1,9.8c.2-.1.3-.3.5-.5l4.6,2.4v-6.8l-4.6,1.5c-.1-.2-.3-.3-.5-.5l1.9-5.9h-6.7l1.9,5.9c-.2.1-.3.3-.5.5l-4.6-1.5v6.8l4.6-2.4c.1.2.3.3.5.5l-2.6,8c-.9,2.8,1.2,5.7,4.1,5.7h0c3,0,5.1-2.9,4.1-5.7l-2.6-8ZM37,37.9s-3.4,3.8-4.1,6.1c2.2,0,4.2-.5,6.4-2.8l-.7,8.5c-2-2.8-4.4-4.1-5.7-3.8.1,3.1.5,6.7,5.8,7.2,3.7.3,6.7-1.5,7-3.8.4-2.6-2-4.3-3.7-1.6-1.4-4.5,2.4-6.1,4.9-3.2-1.9-4.5-1.8-7.7,2.4-10.9,3,4,2.6,7.3-1.2,11.1,2.4-1.3,6.2,0,4,4.6-1.2-2.8-3.7-2.2-4.2.2-.3,1.7.7,3.7,3,4.2,1.9.3,4.7-.9,7-5.9-1.3,0-2.4.7-3.9,1.7l2.4-8c.6,2.3,1.4,3.7,2.2,4.5.6-1.6.5-2.8,0-5.3l5,1.8c-2.6,3.6-5.2,8.7-7.3,17.5-7.4-1.1-15.7-1.7-24.5-1.7h0c-8.8,0-17.1.6-24.5,1.7-2.1-8.9-4.7-13.9-7.3-17.5l5-1.8c-.5,2.5-.6,3.7,0,5.3.8-.8,1.6-2.3,2.2-4.5l2.4,8c-1.5-1-2.6-1.7-3.9-1.7,2.3,5,5.2,6.2,7,5.9,2.3-.4,3.3-2.4,3-4.2-.5-2.4-3-3.1-4.2-.2-2.2-4.6,1.6-6,4-4.6-3.7-3.7-4.2-7.1-1.2-11.1,4.2,3.2,4.3,6.4,2.4,10.9,2.5-2.8,6.3-1.3,4.9,3.2-1.8-2.7-4.1-1-3.7,1.6.3,2.3,3.3,4.1,7,3.8,5.4-.5,5.7-4.2,5.8-7.2-1.3-.2-3.7,1-5.7,3.8l-.7-8.5c2.2,2.3,4.2,2.7,6.4,2.8-.7-2.3-4.1-6.1-4.1-6.1h10.6,0Z" />
+          </g>
+        </svg>
+        <div class="govuk-footer__meta">
+          <div class="govuk-footer__meta-item govuk-footer__meta-item--grow">
+            <h2 class="govuk-visually-hidden">Support links</h2>
+            {{$footerSupportLinks}}{{/footerSupportLinks}}
+            <svg
+              aria-hidden="true"
+              focusable="false"
+              class="govuk-footer__licence-logo"
+              xmlns="http://www.w3.org/2000/svg"
+              viewBox="0 0 483.2 195.7"
+              height="17"
+              width="41">
+              <path
+                fill="currentColor"
+                d="M421.5 142.8V.1l-50.7 32.3v161.1h112.4v-50.7zm-122.3-9.6A47.12 47.12 0 0 1 221 97.8c0-26 21.1-47.1 47.1-47.1 16.7 0 31.4 8.7 39.7 21.8l42.7-27.2A97.63 97.63 0 0 0 268.1 0c-36.5 0-68.3 20.1-85.1 49.7A98 98 0 0 0 97.8 0C43.9 0 0 43.9 0 97.8s43.9 97.8 97.8 97.8c36.5 0 68.3-20.1 85.1-49.7a97.76 97.76 0 0 0 149.6 25.4l19.4 22.2h3v-87.8h-80l24.3 27.5zM97.8 145c-26 0-47.1-21.1-47.1-47.1s21.1-47.1 47.1-47.1 47.2 21 47.2 47S123.8 145 97.8 145" />
+            </svg>
+            <span class="govuk-footer__licence-description">
+                {{$licenceMessage}}All content is available under the <a href="https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/" id="open-government-licence" class="govuk-footer__link" target="_blank" rel="license">Open Government Licence v3.0</a>, except where otherwise stated{{/licenceMessage}}
+            </span>
+          </div>
+          <div class="govuk-footer__meta-item">
+            <a
+              class="govuk-footer__link govuk-footer__copyright-logo"
+              href="https://www.nationalarchives.gov.uk/information-management/re-using-public-sector-information/uk-government-licensing-framework/crown-copyright/">
+              {{$crownCopyrightMessage}}© Crown copyright{{/crownCopyrightMessage}}
+            </a>
+          </div>
+        </div>
+      </div>
+    </footer>
+
+    <div id="global-app-error" class="app-error hidden"></div>
+
+
+    {{$bodyEnd}}{{/bodyEnd}}
+
+
+    <script  {{#nonce}}nonce="{{nonce}}"{{/nonce}}>if (typeof window.GOVUK === 'undefined') document.body.className = document.body.className.replace('js-enabled', '');</script>
+
+  </body>
+</html>

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hof",
   "description": "A bootstrap for HOF projects",
-  "version": "24.3.2",
+  "version": "24.4.0-proto-fix-beta",
   "license": "MIT",
   "main": "index.js",
   "author": "HomeOffice",

package/sandbox/apps/config-driven-navigation/translations/en/default.json

@@ -0,0 +1,168 @@
+{
+  "buttons": {
+    "start": "Start Now",
+    "add-another": "Add another"
+  },
+  "fields": {
+    "selected-updates": {
+      "legend": "What do you need to change?",
+      "hint": "Select all that apply",
+      "options": {
+        "name": {
+          "label": "Name"
+        },
+        "surname": {
+          "label": "Surname"
+        },
+        "dob": {
+          "label": "Date of birth"
+        },
+        "address": {
+          "label": "Address"
+        },
+        "email": {
+          "label": "Email"
+        },
+        "phone": {
+          "label": "Phone"
+        }
+      }
+    },
+    "name": {
+      "label": "Name"
+    },
+    "surname": {
+      "label": "Surname"
+    },
+    "current-house-number": {
+      "label": "House number or name"
+    },
+    "current-street": {
+      "label": "Street"
+    },
+    "current-townOrCity": {
+      "label": "Town or city"
+    },
+    "current-county": {
+      "label": "County (optional)"
+    },
+    "has-postcode": {
+      "legend": "Do you have a postcode for this address?",
+      "options": {
+        "yes": {
+          "label": "Yes"
+        },
+        "no": {
+          "label": "No"
+        }
+      }
+    },
+    "postcode": {
+      "label": "Postcode"
+    },
+    "dob": {
+      "label": "Date of birth"
+    },
+    "email": {
+      "label": "Email address"
+    },
+    "phone": {
+      "label": "Phone number"
+    },
+    "change-anything-else": {
+      "legend": "Do you need to change anything else?",
+      "options": {
+        "yes": {
+          "label": "Yes"
+        },
+        "no": {
+          "label": "No"
+        }
+      }
+    }
+  },
+  "journey": {
+    "header": "POC - Config driven navigation",
+    "phase": "beta"
+  },
+  "pages": {
+    "surname-summary": {
+      "header": "Your previous surnames"
+    },
+    "address": {
+      "header": "What is your home address?"
+    },
+    "dob": {
+      "header": "What is your date of birth?"
+    },
+    "change-anything-else": {},
+    "confirm": {
+      "header": "Check your answers",
+      "sections": {
+        "personalDetails": {
+          "header": "Personal details"
+        },
+        "contactDetails": {
+          "header": "Contact details"
+        }
+      },
+      "fields": {
+        "previoussurnames": {
+          "label": "Previous surnames"
+        }
+      }
+    },
+    "submitted": {
+      "header": "Demo complete. If anything looked too smooth, just assume it was highly engineeing luck!",
+      "title": "Demo complete"
+    }
+  },
+  "validation": {
+    "selected-updates": {
+      "required": "Select at least one page to continue"
+    },
+    "name": {
+      "required": "Enter a name",
+      "maxlength": "Name must be 99 characters or less"
+    },
+    "surname": {
+      "required": "Enter a surname",
+      "maxlength": "Surname must be 99 characters or less"
+    },
+    "current-house-number": {
+      "required": "Enter the house number or name",
+      "maxlength": "House number or name must be 50 characters or less"
+    },
+    "current-street": {
+      "required": "Enter the street",
+      "maxlength": "Street must be 100 characters or less"
+    },
+    "current-townOrCity": {
+      "required": "Enter the town or city",
+      "maxlength": "Town or city must be 100 characters or less"
+    },
+    "current-county": {
+      "maxlength": "County must be 100 characters or less"
+    },
+    "has-postcode": {
+      "required": "Select yes if you have a postcode, or no if you do not"
+    },
+    "postcode": {
+      "required": "Enter a UK postcode",
+      "postcode": "Enter a real UK postcode"
+    },
+    "dob": {
+      "required": "Enter a date of birth",
+      "date": "Enter a date of birth in the correct format",
+      "after": "Date of birth must be after 1 January 1900"
+    },
+    "email": {
+      "required": "Enter an email address",
+      "email": "Enter an email address in the correct format"
+    },
+    "phone": {
+      "required": "Enter a phone number",
+      "internationalPhoneNumber": "Enter a valid phone number"
+    }
+  }
+}