Merge pull request #8168 from plotly/bugfix/inherited-property-protect-prototype

Bugfix: fix potential prototype pollution when expanding/merging object paths

Author: KoolADE85

draftlogs/8168_fix.md

@@ -0,0 +1 @@
+- Fix potential prototype pollution from inherited properties in plot API calls [[#8168](https://github.com/plotly/plotly.js/pull/8168)]

src/lib/extend.js

@@ -72,7 +72,7 @@ function _extend(inputs, isDeep, keepAllKeys, noArrayCopies) {
         input = inputs[i];
 
         for(key in input) {
-            src = target[key];
+            src = Object.prototype.hasOwnProperty.call(target, key) ? target[key] : undefined;
             copy = input[key];
 
             if(noArrayCopies && isArray(copy)) {

src/lib/index.js

@@ -887,9 +887,9 @@ lib.objectFromPath = function (path, value) {
 var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
 var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
 
-function notValid(prop) {
+function notValid(obj, prop) {
     // guard against polluting __proto__ and other internals getters and setters
-    return prop.slice(0, 2) === '__';
+    return prop in obj && !Object.prototype.hasOwnProperty.call(obj, prop);
 }
 
 lib.expandObjectPaths = function (data) {
@@ -900,7 +900,7 @@ lib.expandObjectPaths = function (data) {
                 if ((match = key.match(dottedPropertyRegex))) {
                     datum = data[key];
                     prop = match[1];
-                    if (notValid(prop)) continue;
+                    if (notValid(data, prop)) continue;
 
                     delete data[key];
 
@@ -912,7 +912,7 @@ lib.expandObjectPaths = function (data) {
                     datum = data[key];
 
                     prop = match[1];
-                    if (notValid(prop)) continue;
+                    if (notValid(data, prop)) continue;
 
                     idx = parseInt(match[2]);
 
@@ -943,11 +943,11 @@ lib.expandObjectPaths = function (data) {
                         // This is the case where this property is the end of the line,
                         // e.g. xaxis.range[0]
 
-                        if (notValid(prop)) continue;
+                        if (notValid(data, prop)) continue;
                         data[prop][idx] = lib.expandObjectPaths(datum);
                     }
                 } else {
-                    if (notValid(key)) continue;
+                    if (notValid(data, key)) continue;
                     data[key] = lib.expandObjectPaths(data[key]);
                 }
             }

test/jasmine/tests/lib_test.js

@@ -728,6 +728,49 @@ describe('Test lib.js:', function () {
             expect(computed).toEqual(expected);
         });
         */
+
+        it('does not modify inherited objects or the prototype chain', () => {
+            const payloads = [
+                '{"toString.call": 1}',
+                '{"hasOwnProperty.call": 1}',
+                '{"toString.marker": 1}',
+                '{"constructor[0].x": 1}',
+                '{"constructor.prototype.polluted": 1}',
+                '{"__proto__.polluted": 1}',
+                '{"x.__proto__.polluted": 1}',
+                '{"__proto__": {"polluted": 1}}'
+            ];
+            const targets = [Object.prototype, Object, Object.prototype.toString, Object.prototype.hasOwnProperty];
+            const ownNames = () => targets.map((target) => Object.getOwnPropertyNames(target));
+            const before = ownNames();
+            const originalProcess = window.process;
+            let after;
+            let prototypesKept = true;
+
+            try {
+                [undefined, { versions: {} }].forEach((process) => {
+                    window.process = process;
+                    [Lib.expandObjectPaths, (obj) => Lib.extendDeepNoArrays({}, obj)].forEach((fn) => {
+                        payloads.forEach((payload) => {
+                            const input = JSON.parse(payload);
+                            fn(input);
+                            prototypesKept = prototypesKept && Object.getPrototypeOf(input) === Object.prototype;
+                        });
+                    });
+                });
+                after = ownNames();
+            } finally {
+                window.process = originalProcess;
+                targets.forEach((target, i) => {
+                    Object.getOwnPropertyNames(target)
+                        .filter((name) => !before[i].includes(name))
+                        .forEach((name) => delete target[name]);
+                });
+            }
+
+            expect(after).toEqual(before);
+            expect(prototypesKept).toBe(true);
+        });
     });
 
     describe('coerce', function () {