Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(core): Wrap safe collections' argument of primordials #18750

Merged
merged 3 commits into from
Apr 25, 2023
Merged

fix(core): Wrap safe collections' argument of primordials #18750

merged 3 commits into from
Apr 25, 2023

Conversation

petamoriken
Copy link
Contributor

Collections such as Set cause prototype pollution by treating argument as a iterable.

// prototype pollution
const original = Array.prototype[Symbol.iterator];
Array.prototype[Symbol.iterator] = function (...args) { console.log("bang!"); return original.apply(this, args); }

// current primordials
new SafeSet([1, 2, 3]); // bang!

This PR fix that situation. It affects performance, but the scope should be quite limited.

@petamoriken petamoriken force-pushed the fix/primordials-safe-collection-constructors branch from 88ff672 to 4976a16 Compare April 19, 2023 03:18
@petamoriken petamoriken marked this pull request as draft April 19, 2023 11:04
@petamoriken petamoriken force-pushed the fix/primordials-safe-collection-constructors branch from 4976a16 to c101dea Compare April 19, 2023 11:36
@petamoriken petamoriken marked this pull request as ready for review April 19, 2023 11:39
@petamoriken petamoriken force-pushed the fix/primordials-safe-collection-constructors branch from e0081d3 to a5899fe Compare April 19, 2023 12:12
@petamoriken petamoriken force-pushed the fix/primordials-safe-collection-constructors branch from a5899fe to d2a632d Compare April 25, 2023 14:11
bartlomieju
bartlomieju approved these changes Apr 25, 2023
View reviewed changes
Copy link
Member

@bartlomieju bartlomieju left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@bartlomieju bartlomieju merged commit 9b49de4 into denoland:main Apr 25, 2023
@petamoriken petamoriken deleted the fix/primordials-safe-collection-constructors branch April 26, 2023 01:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bartlomieju bartlomieju bartlomieju approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@petamoriken @bartlomieju