CVE-2019-10792: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 6.3
Published: 2020-02-18T16:15Z
Repository: https://github.com/diegohaz/bodymen
Language: JavaScript
Files changed: .travis.yml, src/index.js, test/index.js
Commit date: 2020-02-16 19:10:48 -0300
Commit message: Fix prototype pollution vulnerability (#23)

* Fix prototype pollution vulnerability

* Update .travis.yml

Diff: diff --git a/.travis.yml b/.travis.yml
index c47f2b0..02b2987 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,7 +1,5 @@
 language: node_js
 node_js:
   - v6
-  - v5
-  - v4
 after_script:
   - 'npm run coveralls'
diff --git a/src/index.js b/src/index.js
index c57cc60..91d10c9 100644
--- a/src/index.js
+++ b/src/index.js
@@ -16,10 +16,18 @@ export const handlers = {
  * @param {string} type - Handler type.
  * @param {string} name - Handler name.
  * @param {Function} [fn] - Set the handler method.
  */
 export function handler (type, name, fn) {
+  if (
+    type === 'constructor' ||
+    type === '__proto__' ||
+    name === 'constructor' ||
+    name === '__proto__'
+  ) {
+    return
+  }
   if (arguments.length > 2) {
     handlers[type][name] = fn
   }
 
   return handlers[type][name]
diff --git a/test/index.js b/test/index.js
index 841a4eb..5b97aa5 100644
--- a/test/index.js
+++ b/test/index.js
@@ -114,5 +114,20 @@ test('Bodymen middleware', (t) => {
     .end((err, res) => {
       if (err) throw err
       t.same(res.body, {links: [{icon: 'path to icon'}]}, 'should respond with correct object')
     })
 })
+
+test('Prototype pollution', (t) => {
+  const { toString } = {}
+
+  bodymen.handler('__proto__', 'toString', 'JHU')
+  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')
+
+  bodymen.handler('formatters', '__proto__', { toString: 'JHU' })
+  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')
+
+  bodymen.handler('validators', '__proto__', { toString: 'JHU' })
+  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')
+
+  t.end()
+})

Vulnerable code:   - v5
  - v4
Fixed code:   if (
    type === 'constructor' ||
    type === '__proto__' ||
    name === 'constructor' ||
    name === '__proto__'
  ) {
    return
  }

test('Prototype pollution', (t) => {
  const { toString } = {}

  bodymen.handler('__proto__', 'toString', 'JHU')
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  bodymen.handler('formatters', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  bodymen.handler('validators', '__proto__', { toString: 'JHU' })
  t.ok({}.toString === toString, 'should not be vulnerable to prototype pollution')

  t.end()
})