mfncooper / mockery

Simplifying the use of mocks with Node.js
Other
1.1k stars 60 forks source link

CVE-2022-37614 - resolve prototype pollution vuln #81

Open chris-tuncap opened 1 year ago

chris-tuncap commented 1 year ago

CVE-2022-37614/Prototype pollution found in mockery.js

Resolve prototype pollution vulnerability by only mapping fields that exist in the defaultOptions object from the user provided opts object.

Default:

defaultOptions = {
    useCleanCache: false,
    warnOnReplace: true,
    warnOnUnregistered: true
}

User provided:

opts = {
    other1: 2,
    other2: 5,
    warnOnUnregistered: false
}

Result:

effectiveOptions = {
    useCleanCache: false,
    warnOnReplace: true,
    warnOnUnregistered: false  // <-- updated
}