habsi/elasticsearch-js
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable prototype poisoning option (#1414)

Browse Source 
* Introduce disablePrototypePoisoningProtection option

* Updated test

* Updated docs

* Fix bundler test
This commit is contained in:
Tomas Della Vedova
2021-03-15 08:51:45 +01:00
committed by GitHub
parent 36eaed6466
commit 6a30cd9955
9 changed files with 166 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
test/unit/serializer.test.js
View File

@ -157,3 +157,75 @@ test('DeserializationError', t => {
t.ok(err instanceof DeserializationError)
}
})
test('prototype poisoning protection', t => {
t.plan(2)
const s = new Serializer()
try {
s.deserialize('{"__proto__":{"foo":"bar"}}')
t.fail('Should fail')
} catch (err) {
t.ok(err instanceof DeserializationError)
}
try {
s.deserialize('{"constructor":{"prototype":{"foo":"bar"}}}')
t.fail('Should fail')
} catch (err) {
t.ok(err instanceof DeserializationError)
}
})
test('disable prototype poisoning protection', t => {
t.plan(2)
const s = new Serializer({ disablePrototypePoisoningProtection: true })
try {
s.deserialize('{"__proto__":{"foo":"bar"}}')
t.pass('Should not fail')
} catch (err) {
t.fail(err)
}
try {
s.deserialize('{"constructor":{"prototype":{"foo":"bar"}}}')
t.pass('Should not fail')
} catch (err) {
t.fail(err)
}
})
test('disable prototype poisoning protection only for proto', t => {
t.plan(2)
const s = new Serializer({ disablePrototypePoisoningProtection: 'proto' })
try {
s.deserialize('{"__proto__":{"foo":"bar"}}')
t.pass('Should not fail')
} catch (err) {
t.fail(err)
}
try {
s.deserialize('{"constructor":{"prototype":{"foo":"bar"}}}')
t.fail('Should fail')
} catch (err) {
t.ok(err instanceof DeserializationError)
}
})
test('disable prototype poisoning protection only for constructor', t => {
t.plan(2)
const s = new Serializer({ disablePrototypePoisoningProtection: 'constructor' })
try {
s.deserialize('{"__proto__":{"foo":"bar"}}')
t.fail('Should fail')
} catch (err) {
t.ok(err instanceof DeserializationError)
}
try {
s.deserialize('{"constructor":{"prototype":{"foo":"bar"}}}')
t.pass('Should not fail')
} catch (err) {
t.fail(err)
}
})