Closed shadowspawn closed 2 years ago
As mentioned here, the result
object should be created as { __proto__: null }
rather than {}
: otherwise code like
let { values } = parseArgs({ toString: { type: 'boolean' }, args: [] });
if (values.toString) {
// etc
}
is broken.
On line 88:
const optionConfig = hasOptionConfig ? options[longOption] : {};
should be
const optionConfig = hasOptionConfig ? options[longOption] : { __proto__: null };
because it is used unguarded on line 113:
if (optionConfig.multiple) {
which would be tripped up if someone did Object.prototype.multiple = true
.
Though it's probably better to change the optionConfig.multiple
bit to if (ObjectGetOwn(optionConfig, 'multiple')
, so that it's consistent with the other hasOwn
checks.
In addition to @bakkot's callout we should update the strict conditionals to use the get own util.
const hasOptionConfig = ObjectHasOwn(options, longOption);
const optionConfig = hasOptionConfig ? options[longOption] : { __proto__: null };
if (strict) {
if (!hasOptionConfig) {
...
}
const shortOptionErr = getOwn(optionConfig, 'short') ? `-${optionConfig.short}, ` : '';
if (getOwn(optionConfig, 'type') === 'string' && optionValue == null) {
...
}
if (getOwn(optionConfig, 'type') === 'boolean' && optionValue != null) {
...
}
}
Thanks for transferring comment @bakkot : https://github.com/pkgjs/parseargs/pull/106#issuecomment-1098172983
I have hidden as spun up new issue for just that: #108
Is it ok to set Object prototype properties in tests? (And delete them afterwards.)
Is it ok to set Object prototype properties in tests? (And delete them afterwards).
@shadowspawn this seems reasonable to me in our own prototype-pollution.js
test file. I think I'd avoid upstreaming these into the Node.js codebase (out of concern for side-effects).
I tried separate routines for checkOptionUsage
and storeOption
. I like the separation of concerns, but it wasn't a big win for number of arguments. Opinions welcome. (I am wondering about recombining.)
https://github.com/pkgjs/parseargs/pull/106/commits/6d2351a60c175b951546022d4e20fe8c07b3d6d4
Finished full run-through adopting paranoid access wrappers to get own properties. 🤞
Covered:
some brief JSDocs for the
checkOptionUsage
andstoreOption
utils
Good suggestion. The long argument lists and few subtle arguments (like shortOrLong
) have been irking me.
Addressed feedback. Added tests. Moved out of Draft.
Thanks for the early comments reviewers, much appreciated commenting on the draft!
Hopefully we do not cause prototype pollution, but we have two patterns which are affected by existing prototype pollution:
optionConfig.type
Closes: #104
Refactor:
??
and null prototypesBefore:
After: