CVE-2021-23518: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-01-21T20:15Z
Repository: https://github.com/ashaffer/cached-path-relative
Language: JavaScript
Files changed: .gitignore, Makefile, Readme.md, lib/index.js, package.json, shim.js, test/index.js
Commit date: 2022-01-19 11:12:34 -0800
Commit message: Fix other instances of prototype pollution vulnerability

Diff: diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..eb03e3e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+node_modules
+*.log
diff --git a/History.md b/History.md
new file mode 100644
index 0000000..e69de29
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..5a8f21d
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,20 @@
+#
+# Vars
+#
+
+BIN = ./node_modules/.bin
+
+#
+# Tasks
+# 
+
+node_modules: package.json
+	@npm install
+
+test: node_modules
+	@${BIN}/tape test/*
+
+validate: node_modules
+	@${BIN}/standard
+
+.PHONY: test validate
diff --git a/Readme.md b/Readme.md
new file mode 100644
index 0000000..7b3d4c4
--- /dev/null
+++ b/Readme.md
@@ -0,0 +1,41 @@
+
+# cached-path-relative
+
+[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://github.com/feross/standard)
+
+Memoize the results of the path.relative function. `path.relative` can be an expensive operation if it happens a lot, and its results shouldn't change for the same arguments.
+
+## Installation
+
+    $ npm install cached-path-relative
+
+## Usage
+
+Use it just like your normal path.relative, but it's memoized:
+
+```javascript
+var relative = require('cached-path-relative')
+
+
+relative('test/index.js', '.') === '../..'
+```
+
+## Shim
+
+If you want to shim path.relative globally so that you can optimize things that don't know about this module (browserify rebuild times are a good use-case here), you can just import the shim:
+
+`require('cached-path-relative/shim')`
+
+This will globally shim `path.relative` so that its results are cached.
+
+## License
+
+The MIT License
+
+Copyright &copy; 2016, Weo.io &lt;info@weo.io&gt;
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/lib/index.js b/lib/index.js
new file mode 100644
index 0000000..cb74bec
--- /dev/null
+++ b/lib/index.js
@@ -0,0 +1,43 @@
+/**
+ * Modules
+ */
+
+var path = require('path')
+
+/**
+ * Vars
+ */
+
+var relative = path.relative
+var lastCwd = process.cwd()
+var cache = Object.create(null)
+
+/**
+ * Expose cachedPathRelative
+ */
+
+module.exports = cachedPathRelative
+
+/**
+ * cachedPathRelative
+ */
+
+function cachedPathRelative (from, to) {
+  // If the current working directory changes, we need
+  // to invalidate the cache
+  var cwd = process.cwd()
+  if (cwd !== lastCwd) {
+    cache = Object.create(null)
+    lastCwd = cwd
+  }
+
+  if (cache[from] && cache[from][to]) return cache[from][to]
+
+  var result = relative.call(path, from, to)
+
+  cache[from] = cache[from] || Object.create(null)
+  cache[from][to] = result
+
+  return result
+
+}
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..4bdf018
--- /dev/null
+++ b/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "cached-path-relative",
+  "description": "Memoize the results of the path.relative function",
+  "repository": "git://github.com/ashaffer/cached-path-relative.git",
+  "version": "1.0.2",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "dependencies": {},
+  "devDependencies": {
+    "tape": "^4.2.0",
+    "standard": "^4.0.0"
+  }
+}
diff --git a/shim.js b/shim.js
new file mode 100644
index 0000000..3d3b67a
--- /dev/null
+++ b/shim.js
@@ -0,0 +1,12 @@
+/**
+ * Modules
+ */
+
+var path = require('path')
+var cachedPathRelative = require('.')
+
+/**
+ * Install shim
+ */
+
+path.relative = cachedPathRelative
diff --git a/test/index.js b/test/index.js
new file mode 100644
index 0000000..c0258f9
--- /dev/null
+++ b/test/index.js
@@ -0,0 +1,17 @@
+/**
+ * Imports
+ */
+
+var relative = require('..')
+var path = require('path')
+var test = require('tape')
+
+/**
+ * Tests
+ */
+
+test('should work', function (t) {
+  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
+  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
+  t.end()
+})

Fixed code: node_modules
*.log
#
# Vars
#

BIN = ./node_modules/.bin

#
# Tasks
# 

node_modules: package.json
	@npm install

test: node_modules
	@${BIN}/tape test/*

validate: node_modules
	@${BIN}/standard

.PHONY: test validate

# cached-path-relative

[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg?style=flat)](https://github.com/feross/standard)

Memoize the results of the path.relative function. `path.relative` can be an expensive operation if it happens a lot, and its results shouldn't change for the same arguments.

## Installation

    $ npm install cached-path-relative

## Usage

Use it just like your normal path.relative, but it's memoized:

```javascript
var relative = require('cached-path-relative')


relative('test/index.js', '.') === '../..'
```

## Shim

If you want to shim path.relative globally so that you can optimize things that don't know about this module (browserify rebuild times are a good use-case here), you can just import the shim:

`require('cached-path-relative/shim')`

This will globally shim `path.relative` so that its results are cached.

## License

The MIT License

Copyright &copy; 2016, Weo.io &lt;info@weo.io&gt;

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
/**
 * Modules
 */

var path = require('path')

/**
 * Vars
 */

var relative = path.relative
var lastCwd = process.cwd()
var cache = Object.create(null)

/**
 * Expose cachedPathRelative
 */

module.exports = cachedPathRelative

/**
 * cachedPathRelative
 */

function cachedPathRelative (from, to) {
  // If the current working directory changes, we need
  // to invalidate the cache
  var cwd = process.cwd()
  if (cwd !== lastCwd) {
    cache = Object.create(null)
    lastCwd = cwd
  }

  if (cache[from] && cache[from][to]) return cache[from][to]

  var result = relative.call(path, from, to)

  cache[from] = cache[from] || Object.create(null)
  cache[from][to] = result

  return result

}
{
  "name": "cached-path-relative",
  "description": "Memoize the results of the path.relative function",
  "repository": "git://github.com/ashaffer/cached-path-relative.git",
  "version": "1.0.2",
  "license": "MIT",
  "main": "lib/index.js",
  "dependencies": {},
  "devDependencies": {
    "tape": "^4.2.0",
    "standard": "^4.0.0"
  }
}
/**
 * Modules
 */

var path = require('path')
var cachedPathRelative = require('.')

/**
 * Install shim
 */

path.relative = cachedPathRelative
/**
 * Imports
 */

var relative = require('..')
var path = require('path')
var test = require('tape')

/**
 * Tests
 */

test('should work', function (t) {
  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
  t.equal(relative('test/index.js', '.'), path.relative('test/index.js', '.'))
  t.end()
})