fix: prototype pollution in deserializer

denoland / fresh

The next-gen web framework.

https://fresh.deno.dev

MIT License

12.17k stars 623 forks source link

fix: prototype pollution in deserializer #2255

Closed lucacasonato closed 8 months ago

lucacasonato commented 8 months ago

This is not exploitable in practice unless a user maliciously crafts serialized values in __FRSH_STATE, because serializer() never outputs serialized representation that would be vulnerable to prototype pollution. But hey, defense in depth.

marvinhagemeister commented 8 months ago

Just commenting to link issues https://github.com/denoland/fresh/issues/2254