-
Notifications
You must be signed in to change notification settings - Fork 30.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
tools: add
avoid-prototype-pollution lint rule
PR-URL: #43308 Reviewed-By: Rich Trott <rtrott@gmail.com>
- Loading branch information
1 parent
3b2f7ee
commit cf8a115
Showing
4 changed files
with
245 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| 'use strict'; | ||
|
|
||
| const common = require('../common'); | ||
| if ((!common.hasCrypto) || (!common.hasIntl)) { | ||
| common.skip('ESLint tests require crypto and Intl'); | ||
| } | ||
|
|
||
| common.skipIfEslintMissing(); | ||
|
|
||
| const RuleTester = require('../../tools/node_modules/eslint').RuleTester; | ||
| const rule = require('../../tools/eslint-rules/avoid-prototype-pollution'); | ||
|
|
||
| new RuleTester({ | ||
| parserOptions: { ecmaVersion: 2022 }, | ||
| }) | ||
| .run('property-descriptor-no-prototype-pollution', rule, { | ||
| valid: [ | ||
| 'ObjectDefineProperties({}, {})', | ||
| 'ObjectCreate(null, {})', | ||
| 'ObjectDefineProperties({}, { key })', | ||
| 'ObjectCreate(null, { key })', | ||
| 'ObjectDefineProperties({}, { ...spread })', | ||
| 'ObjectCreate(null, { ...spread })', | ||
| 'ObjectDefineProperties({}, { key: valueDescriptor })', | ||
| 'ObjectCreate(null, { key: valueDescriptor })', | ||
| 'ObjectDefineProperties({}, { key: { ...{}, __proto__: null } })', | ||
| 'ObjectCreate(null, { key: { ...{}, __proto__: null } })', | ||
| 'ObjectDefineProperties({}, { key: { __proto__: null } })', | ||
| 'ObjectCreate(null, { key: { __proto__: null } })', | ||
| 'ObjectDefineProperties({}, { key: { __proto__: null, enumerable: true } })', | ||
| 'ObjectCreate(null, { key: { __proto__: null, enumerable: true } })', | ||
| 'ObjectDefineProperties({}, { key: { "__proto__": null } })', | ||
| 'ObjectCreate(null, { key: { "__proto__": null } })', | ||
| 'ObjectDefineProperties({}, { key: { \'__proto__\': null } })', | ||
| 'ObjectCreate(null, { key: { \'__proto__\': null } })', | ||
| 'ObjectDefineProperty({}, "key", ObjectCreate(null))', | ||
| 'ReflectDefineProperty({}, "key", ObjectCreate(null))', | ||
| 'ObjectDefineProperty({}, "key", valueDescriptor)', | ||
| 'ReflectDefineProperty({}, "key", valueDescriptor)', | ||
| 'ObjectDefineProperty({}, "key", { __proto__: null })', | ||
| 'ReflectDefineProperty({}, "key", { __proto__: null })', | ||
| 'ObjectDefineProperty({}, "key", { __proto__: null, enumerable: true })', | ||
| 'ReflectDefineProperty({}, "key", { __proto__: null, enumerable: true })', | ||
| 'ObjectDefineProperty({}, "key", { "__proto__": null })', | ||
| 'ReflectDefineProperty({}, "key", { "__proto__": null })', | ||
| 'ObjectDefineProperty({}, "key", { \'__proto__\': null })', | ||
| 'ReflectDefineProperty({}, "key", { \'__proto__\': null })', | ||
| ], | ||
| invalid: [ | ||
| { | ||
| code: 'ObjectDefineProperties({}, ObjectGetOwnPropertyDescriptors({}))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, ObjectGetOwnPropertyDescriptors({}))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperties({}, { key: {} })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, { key: {} })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperties({}, { key: { [void 0]: { ...{ __proto__: null } } } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, { key: { [void 0]: { ...{ __proto__: null } } } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperties({}, { key: { __proto__: Object.prototype } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, { key: { __proto__: Object.prototype } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperties({}, { key: { [`__proto__`]: null } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, { key: { [`__proto__`]: null } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperties({}, { key: { enumerable: true } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectCreate(null, { key: { enumerable: true } })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", {})', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", {})', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", ObjectGetOwnPropertyDescriptor({}, "key"))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", ObjectGetOwnPropertyDescriptor({}, "key"))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", ReflectGetOwnPropertyDescriptor({}, "key"))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", ReflectGetOwnPropertyDescriptor({}, "key"))', | ||
| errors: [{ message: /prototype pollution/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", { __proto__: Object.prototype })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", { __proto__: Object.prototype })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", { [`__proto__`]: null })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", { [`__proto__`]: null })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ObjectDefineProperty({}, "key", { enumerable: true })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| { | ||
| code: 'ReflectDefineProperty({}, "key", { enumerable: true })', | ||
| errors: [{ message: /null-prototype/ }], | ||
| }, | ||
| ] | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| 'use strict'; | ||
|
|
||
| function checkProperties(context, node) { | ||
| if ( | ||
| node.type === 'CallExpression' && | ||
| node.callee.name === 'ObjectGetOwnPropertyDescriptors' | ||
| ) { | ||
| context.report({ | ||
| node, | ||
| message: | ||
| 'Property descriptors inherits from the Object prototype, therefore are subject to prototype pollution', | ||
| }); | ||
| } | ||
| if (node.type !== 'ObjectExpression') return; | ||
| for (const { key, value } of node.properties) { | ||
| if ( | ||
| key != null && value != null && | ||
| !(key.type === 'Identifier' && key.name === '__proto__') && | ||
| !(key.type === 'Literal' && key.value === '__proto__') | ||
| ) { | ||
| checkPropertyDescriptor(context, value); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| function checkPropertyDescriptor(context, node) { | ||
| if ( | ||
| node.type === 'CallExpression' && | ||
| (node.callee.name === 'ObjectGetOwnPropertyDescriptor' || | ||
| node.callee.name === 'ReflectGetOwnPropertyDescriptor') | ||
| ) { | ||
| context.report({ | ||
| node, | ||
| message: | ||
| 'Property descriptors inherits from the Object prototype, therefore are subject to prototype pollution', | ||
| suggest: [{ | ||
| desc: 'Wrap the property descriptor in a null-prototype object', | ||
| fix(fixer) { | ||
| return [ | ||
| fixer.insertTextBefore(node, '{ __proto__: null,...'), | ||
| fixer.insertTextAfter(node, ' }'), | ||
| ]; | ||
| }, | ||
| }], | ||
| }); | ||
| } | ||
| if (node.type !== 'ObjectExpression') return; | ||
|
|
||
| for (const { key, value } of node.properties) { | ||
| if ( | ||
| key != null && value != null && | ||
| ((key.type === 'Identifier' && key.name === '__proto__') || | ||
| (key.type === 'Literal' && key.value === '__proto__')) && | ||
| value.type === 'Literal' && value.value === null | ||
| ) { | ||
| return true; | ||
| } | ||
| } | ||
|
|
||
| context.report({ | ||
| node, | ||
| message: 'Must use null-prototype object for property descriptors', | ||
| }); | ||
| } | ||
|
|
||
| const CallExpression = 'ExpressionStatement[expression.type="CallExpression"]'; | ||
| module.exports = { | ||
| meta: { hasSuggestions: true }, | ||
| create(context) { | ||
| return { | ||
| [`${CallExpression}[expression.callee.name=${/^(Object|Reflect)DefinePropert(ies|y)$/}]`]( | ||
| node | ||
| ) { | ||
| switch (node.expression.callee.name) { | ||
| case 'ObjectDefineProperties': | ||
| checkProperties(context, node.expression.arguments[1]); | ||
| break; | ||
| case 'ReflectDefineProperty': | ||
| case 'ObjectDefineProperty': | ||
| checkPropertyDescriptor(context, node.expression.arguments[2]); | ||
| break; | ||
| default: | ||
| throw new Error('Unreachable'); | ||
| } | ||
| }, | ||
|
|
||
| [`${CallExpression}[expression.callee.name="ObjectCreate"][expression.arguments.length=2]`](node) { | ||
| checkProperties(context, node.expression.arguments[1]); | ||
| }, | ||
| }; | ||
| }, | ||
| }; |