-
Notifications
You must be signed in to change notification settings - Fork 1.8k
feat(NODE-6225): add property ownership check before referencing mongocryptdSpawnPath
and mongocryptdSpawnArgs
#4151
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Hi @vuusale - thanks for opening this PR. We've discussed it and would a couple of changes made here if you don't mind. 1) We'd like to change this to use |
To prevent prototype pollution gadget, added a check to ensure that 'mongocryptSpawnPath' and 'mongocryptSpawnArgs' properties exist in 'extraOptions' object before assigning them to 'this.spawnPath' and 'this.spawnArgs', which are passed to 'spawn' function in line 53. HackerOne report: https://hackerone.com/bugs?subject=user&report_id=2522466
mongocryptdSpawnPath
and mongocryptdSpawnArgs
mongocryptdSpawnPath
and mongocryptdSpawnArgs
mongocryptdSpawnPath
and mongocryptdSpawnArgs
mongocryptdSpawnPath
and mongocryptdSpawnArgs
mongocryptdSpawnPath
and mongocryptdSpawnArgs
Dear mongodb team, thanks for approving my change! |
Hi dear mongodb team, I’m in the process of requesting a CVE for this prototype pollution issue and just wanted to learn how I should proceed with this and which CNA I should contact with. Best regards, |
To prevent prototype pollution gadget, added a check to ensure that 'mongocryptSpawnPath' and 'mongocryptSpawnArgs' properties exist in 'extraOptions' object before assigning them to 'this.spawnPath' and 'this.spawnArgs', which are passed to 'spawn' function in line 53.
HackerOne report: https://hackerone.com/bugs?subject=user&report_id=2522466
Description
What is changing?
Is there new documentation needed for these changes?
What is the motivation for this change?
Release Highlight
Only permit mongocryptd spawn path and arguments to be own properties
We have added some defensive programming to the options that specify spawn path and spawn arguments for
mongocryptd
due to the sensitivity of the system resource they control, namely, launching a process. Now,mongocryptdSpawnPath
andmongocryptdSpawnArgs
must be own properties ofautoEncryption.extraOptions
. This makes it more difficult for a global prototype pollution bug related to these options to occur.Double check the following
npm run check:lint
scripttype(NODE-xxxx)[!]: description
feat(NODE-1234)!: rewriting everything in coffeescript