CVE-2020-7639 (JavaScript, published 2020-04-06T13:15Z)
Description: value: eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/eivindfjeldstad/dot
Files changed:
index.js
package.json
test/index.js
Commit message: Prevent prototype pollution


Vulnerable code:
exports.set = function (obj, path, val) {
  obj[attr] = val;
exports.get = function (obj, path) {
exports.delete = function (obj, path) {
    obj.splice(path, 1);
  "version": "1.0.2",
var tests = module.exports = {
  'test set': function () {
  'test get': function () {
  'test delete': function () {
    assert(!obj.cool.hasOwnProperty('aid'))
}

Fixed code:
exports.set = function(obj, path, val) {
    if (!isSafe(obj, seg)) return src;
  if (isSafe(obj, attr)) {
    obj[attr] = val;
  }
exports.get = function(obj, path) {
exports.delete = function(obj, path) {
    if (!isSafe(obj, seg)) return;
  if (!isSafe(obj, attr)) return;

    obj.splice(attr, 1);

function isSafe(obj, prop) {
  if (isObject(obj)) {
    return obj[prop] === undefined || hasOwnProperty(obj, prop);
  }

  if (Array.isArray(obj)) {
    return !isNaN(parseInt(prop, 10));
  }

  return false;
}

function hasOwnProperty(obj, prop) {
  return Object.prototype.hasOwnProperty.call(obj, prop);
}

function isObject(obj) {
  return Object.prototype.toString.call(obj) === '[object Object]';
}
  "version": "1.0.3",
var tests = (module.exports = {
  'test set': function() {
  'test get': function() {
  'test delete': function() {
    assert(!obj.cool.hasOwnProperty('aid'));
  },

  'test prototype pollution': function() {
    var obj = {};
    obj.cool = {};
    obj.cool.aid = 'rocks';
    obj.cool.hello = ['world'];
    dot.set(obj, '__proto__', 'test');
    dot.set(obj, '__proto__.toString', 'test');
    dot.set(obj, 'toString', 'test');
    dot.set(obj, 'cool.hello.__proto__', 'test');
    dot.set(obj, 'cool.hello.__proto__.toString', 'test');
    dot.set(obj, 'cool.hello.toString', 'test');
    assert(obj.__proto__ === {}.__proto__);
    assert(obj.toString === Object.prototype.toString);
    assert(obj.cool.hello.__proto__ === [].__proto__);
    assert(obj.cool.hello.toString === Array.prototype.toString);
    dot.delete(obj, '__proto__.toString', 'test');
    dot.delete(obj, '__proto__', 'test');
    dot.delete(obj, 'toString', 'test');
    dot.delete(obj, 'cool.hello.__proto__.toString', 'test');
    dot.delete(obj, 'cool.hello.__proto__', 'test');
    dot.delete(obj, 'cool.hello.toString', 'test');
    assert(obj.__proto__ === {}.__proto__);
    assert(obj.toString === Object.prototype.toString);
    assert(obj.cool.hello.__proto__ === [].__proto__);
    assert(obj.cool.hello.toString === Array.prototype.toString);
});