Skip to content

Instantly share code, notes, and snippets.

@yjaaidi

yjaaidi/prototype-pollution.js

Created October 2, 2019 13:24
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save yjaaidi/0136a9dbea62f0efd6fbead32d261da4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save yjaaidi/0136a9dbea62f0efd6fbead32d261da4 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. yjaaidi created this gist Oct 2, 2019.
    23 changes: 23 additions & 0 deletions prototype-pollution.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    const u1 = {firstName: 'Foo'}
    const u2 = {firstName: 'John'}

    const body = JSON.parse('{"__proto__": {"admin": true}}')

    function vulnerableExtend(dst, src) {
    Object.entries(src)
    .forEach(([k, v]) => {
    if (k in dst) {
    vulnerableExtend(dst[k], src[k]);
    } else {
    dst[k] = src[k];
    }
    })
    }

    console.log(u1.admin)
    console.log(u2.admin)

    vulnerableExtend(u1, body);

    console.log(u1.admin)
    console.log(u2.admin)