Security Fix for Prototype Pollution in mquery

[zpbrent]

📊 Metadata *

mquery is aware of the risk of prototype pollution in its exported functions cloneObject() and merge() and readily present protection by checking the key in var specialProperties = ['__proto__', 'constructor', 'prototype']. However, the current protection misses to protect another exported function mergeClone(). As a result, the latest version 3.2.4 is still vulnerable to prototype pollution.

Bounty URL: https://www.huntr.dev/bounties/1-npm-mquery/

⚙️ Description *

Filter out specialProperties = ['__proto__', 'constructor', 'prototype'] .

💻 Technical Description *

Place the protection code in mergeClone():
if (specialProperties.indexOf(key) !== -1) { continue; }

🐛 Proof of Concept (PoC) *

// PoC.js version of mquery is 3.2.4
mquery = require('mquery');
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mquery.utils.mergeClone({}, JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // HACKED

🔥 Proof of Fix (PoF) *

// PoC.js version of mquery is 3.2.4
mquery = require('mquery');
var malicious_payload = '{"__proto__":{"polluted":"HACKED"}}';
console.log('Before:', {}.polluted); // undefined
mquery.utils.mergeClone({}, JSON.parse(malicious_payload));
console.log('After:', {}.polluted); // undefined

👍 User Acceptance Testing (UAT)

N/A

🔗 Relates to...

https://www.huntr.dev/bounties/1-npm-mquery/

[huntr-helper]

👋 Hello, @aheckmann. @zpbrent has opened a PR to us with a fix for a potential vulnerability in your repository. To view the vulnerability, please refer to the bounty URL in the first comment, above. If you want this fix in your repository, a PR will automatically open once you comment:

@huntr-helper - LGTM

---

☎️ Need further support?

Come and join us on our community Discord!

---

❓@aheckmann - want more fixes like this?

Copy this snippet into your README.md for more vulnerability fixes in the future:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

[vkarpov15]

@huntr-helper - LGTM

[JamieSlome]

@huntr-helper - LGTM

Working on a way for multi-maintainer approval - cheers! 🍰