CVE-2020-28461 (TypeScript, published 2022-07-25T14:15Z)
Description: value: This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/Sdju/js-ini
Files changed:
package-lock.json
package.json
src/errors/errors-symbol.ts
src/errors/index.ts
src/errors/parsing-error.ts
src/errors/proto-error.ts
src/index.ts
src/interfaces/custom-typing.ts
src/interfaces/ini-object.ts
src/parse.ts
src/proto.ts
test/tests.ts
Commit message: refactoring and new functional


Vulnerable code:
  "version": "1.1.5",
      "version": "3.4.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.4.3.tgz",
      "integrity": "sha512-FFgHdPt4T/duxx6Ndf7hwgMZZjZpB+U0nMNGVCYPq0rEzWKjEDobm4J6yb3CS7naZ0yURFqdw9Gwc7UOh/P9oQ==",
    "typescript": "3.4.3"
      "**/test/*.+(ts|tsx|js)"
export const $Errors: unique symbol = Symbol('Errors of parsing');

    super(`Unsupported type of line: [${lineNumber}]"${line}"`);
  (val: string, section: string, key: string): any
import { $Errors, ParsingError } from './errors';
          result[currentSection] = (isDataSection) ? [] : {};
import { parse, stringify } from '../src';
v2 = what 
v2 : what 

Fixed code:
  "version": "1.2.0",
      "version": "4.1.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.1.3.tgz",
      "integrity": "sha512-B3ZIOf1IKeH2ixgHhj6la6xdwR9QrLC5d1VKeCSY4tvkqhF2eqd9O7txNlS0PO3GrBAFIdr3L1ndNwteUbZLYg==",
    "typescript": "^4.1.3"
      "**/test/**/*.+(ts|tsx|js)"
export const $Errors: unique symbol = Symbol('Errors of parsing');
export * from './parsing-error';
export * from './proto-error';
export * from './errors-symbol';
    super(`Unsupported type of line: [${lineNumber}] "${line}"`);
export class ProtoError extends Error {
  constructor(lineNumber: number) {
    super(`Unsupported section name "__proto__": [${lineNumber}]"`);
    this.lineNumber = lineNumber;
  }

  public lineNumber: number;
}
export * from './proto';
  (val: string, section: string | symbol, key: string): any
import { $Proto } from '../proto';
  [$Proto]?: IIniObjectSection;
import {
  $Errors,
  ParsingError,
  ProtoError,
} from './errors';
import { $Proto } from './proto';
  protoSymbol?: boolean;
    protoSymbol = false,
        if (currentSection === '__proto__') {
          if (protoSymbol) {
            currentSection = <string><any> $Proto;
          } else {
            throw new ProtoError(lineNumber);
          }
        }
          result[currentSection] = (isDataSection) ? [] : Object.create(null);
export const $Proto: unique symbol = Symbol('__proto__');
import {
  parse,
  stringify,
  $Proto,
  $Errors,
  ParsingError,
} from '../src';
v2 = what

v2 : what




const ini6 = `
[ __proto__  ]
polluted = "polluted"`;

const ini7 = `
[scope with trash]
ok = value
trash

[scope with only trash]
only trash

[empty scope]
[normal scope]
ok = value
`;


test('ini parsing: proto', () => {
  expect(() => parse(ini6))
    .toThrow('Unsupported section name "__proto__": [2]"');

  expect(parse(ini6, { protoSymbol: true }))
    .toEqual({
      [$Proto]: {
        polluted: '"polluted"',
      },
    });
});

test('ini parsing: errors', () => {
  expect(() => parse(ini7))
    .toThrow('Unsupported type of line: [4] "trash"');

  expect(parse(ini7, { nothrow: true }))
    .toEqual({
      'scope with trash': {
        ok: 'value',
      },
      'scope with only trash': {},
      'empty scope': {},
      'normal scope': {
        ok: 'value',
      },
      [$Errors]: [
        new ParsingError('trash', 4),
        new ParsingError('only trash', 7),
      ],
    });
});