hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

JS: Proto pollution: Add is-plain-object sanitizer

Browse Source
This commit is contained in:
Asger Feldthaus
2020-02-21 14:38:33 +00:00
parent ee5cf95f5b
commit d1df251b92
2 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
javascript/ql/test/query-tests/Security/CWE-400/PrototypePollutionUtility/tests.js
View File

@@ -462,3 +462,14 @@ function copyUsingUnderscoreOrLodash(dst, src) {
}
});
}
let isPlainObject = require('is-plain-object');
function copyPlainObject(dst, src) {
for (let key in src) {
if (dst[key] && isPlainObject(src)) {
copyPlainObject(dst[key], src[key]);
} else {
dst[key] = src[key]; // OK
}
}
}