ueberdb2 2.1.0 → 2.1.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Notable Changes
 
+## v2.1.1
+
+Security fix:
+
+  * Fix `setSub()` prototype pollution vulnerability.
+
 ## v2.1.0
 
   * `memory`: New `data` setting that allows users to supply the backing Map

package/lib/CacheAndBufferLayer.js

@@ -419,6 +419,9 @@ exports.Database = class {
         // Emulate a pointer to the property that should be set to `value`.
         const ptr = {obj: base, prop: 'fullValue'};
         for (let i = 0; i < sub.length; i++) {
+          if (sub[i] === '__proto__') {
+            throw new Error('Modifying object prototype is not supported for security reasons');
+          }
           let o = ptr.obj[ptr.prop];
           if (o == null) ptr.obj[ptr.prop] = o = {};
           // If o is a primitive (string, number, etc.), then setting `o.foo` has no effect because

package/package.json

@@ -57,7 +57,7 @@
     "url": "https://github.com/ether/ueberDB.git"
   },
   "main": "./index",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "bugs": {
     "url": "https://github.com/ether/ueberDB/issues"
   },

package/test/test_setSub.js

@@ -0,0 +1,14 @@
+'use strict';
+
+const assert = require('assert').strict;
+const ueberdb = require('../index');
+const util = require('util');
+
+describe(__filename, function () {
+  it('setSub rejects __proto__', async function () {
+    const db = new ueberdb.Database('memory', {}, {});
+    await util.promisify(db.init).call(db);
+    await util.promisify(db.set).call(db, 'k', {});
+    await assert.rejects(util.promisify(db.setSub).call(db, 'k', ['__proto__'], 'v'));
+  });
+});