ueberdb2 3.0.1 → 3.0.2

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Notable Changes
 
+## v3.0.2
+
+Security fix:
+
+  * `getSub()` now returns `null` when it encounters a non-"own" property
+    (including `__proto__`) or any non-object while walking the given property
+    path. This should make it easier to avoid accidental prototype pollution
+    vulnerabilities.
+
 ## v3.0.1
 
 Bug fixes:
@@ -33,6 +42,15 @@ Updated database dependencies:
   * `postgres`: Updated `pg` to 8.7.3.
   * `sqlite`: Updated `sqlite3` to 5.0.6.
 
+## v2.2.4
+
+Security fix:
+
+  * `getSub()` now returns `null` when it encounters a non-"own" property
+    (including `__proto__`) or any non-object while walking the given property
+    path. This should make it easier to avoid accidental prototype pollution
+    vulnerabilities.
+
 ## v2.2.0
 
 Compatibility changes:

package/lib/CacheAndBufferLayer.js

@@ -508,33 +508,27 @@ exports.Database = class {
    *     "bla"]
    */
   async getSub(key, sub) {
-    let subvalue;
     await this._lock(key);
     try {
-      // get the full value
-      const value = await this._getLocked(key);
-
-      // everything is correct, navigate to the subvalue and return it
-      subvalue = value;
-
-      for (let i = 0; i < sub.length; i++) {
-        // test if the subvalue exist
-        if (subvalue != null && subvalue[sub[i]] !== undefined) {
-          subvalue = subvalue[sub[i]];
-        } else {
-          // the subvalue doesn't exist, break the loop and return null
-          subvalue = null;
-          break;
+      let v = await this._getLocked(key);
+      for (const k of sub) {
+        if (typeof v !== 'object' || (v != null && !Object.prototype.hasOwnProperty.call(v, k)) ||
+            // __proto__ is not an "own" property but we check for it explicitly for added safety,
+            // to improve readability, and to help static code analysis tools rule out prototype
+            // pollution vulnerabilities.
+            k === '__proto__') {
+          v = null;
         }
+        if (v == null) break;
+        v = v[k];
       }
-
       if (this.logger.isDebugEnabled()) {
-        this.logger.debug(`GETSUB - ${key}${JSON.stringify(sub)} - ${JSON.stringify(subvalue)}`);
+        this.logger.debug(`GETSUB - ${key}${JSON.stringify(sub)} - ${JSON.stringify(v)}`);
       }
+      return clone(v);
     } finally {
       this._unlock(key);
     }
-    return clone(subvalue);
   }
 
   /**

package/package.json

@@ -51,7 +51,7 @@
     "url": "https://github.com/ether/ueberDB.git"
   },
   "main": "./index",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "bugs": {
     "url": "https://github.com/ether/ueberDB/issues"
   },

package/test/test_getSub.js

@@ -0,0 +1,31 @@
+'use strict';
+
+const assert = require('assert').strict;
+const ueberdb = require('../index');
+
+describe(__filename, function () {
+  let db;
+
+  beforeEach(async function () {
+    db = new ueberdb.Database('memory', {}, {});
+    await db.init();
+    await db.set('k', {s: 'v'});
+  });
+
+  afterEach(async function () {
+    if (db != null) await db.close();
+    db = null;
+  });
+
+  it('getSub stops at non-objects', async function () {
+    assert(await db.getSub('k', ['s', 'length']) == null);
+  });
+
+  it('getSub ignores non-own properties', async function () {
+    assert(await db.getSub('k', ['toString']) == null);
+  });
+
+  it('getSub ignores __proto__', async function () {
+    assert(await db.getSub('k', ['__proto__']) == null);
+  });
+});

package/test/test_setSub.js

@@ -4,9 +4,19 @@ const assert = require('assert').strict;
 const ueberdb = require('../index');
 
 describe(__filename, function () {
-  it('setSub rejects __proto__', async function () {
-    const db = new ueberdb.Database('memory', {}, {});
+  let db;
+
+  beforeEach(async function () {
+    db = new ueberdb.Database('memory', {}, {});
     await db.init();
+  });
+
+  afterEach(async function () {
+    if (db != null) await db.close();
+    db = null;
+  });
+
+  it('setSub rejects __proto__', async function () {
     await db.set('k', {});
     await assert.rejects(db.setSub('k', ['__proto__'], 'v'));
   });