Security Fix for Prototype Pollution

ready-research · web-flow · commit 383b72d47c74 · 2021-08-30T15:17:34.000+05:30
Fix prototype pollution when path components are not strings
diff --git a/index.js b/index.js
@@ -18,6 +18,9 @@ const isUnsafeKey = key => {
 };
 
 const validateKey = key => {
+  if (typeof key !== 'string' && typeof key !== 'number') {
+    key = String(key)
+  }
   if (isUnsafeKey(key)) {
     throw new Error(`Cannot set unsafe key: "${key}"`);
   }

Original file line number	Diff line number	Diff line change
`@@ -18,6 +18,9 @@ const isUnsafeKey = key => {`
`18`	`18`	`};`
`19`	`19`
`20`	`20`	`const validateKey = key => {`
	`21`	`+ if (typeof key !== 'string' && typeof key !== 'number') {`
	`22`	`+ key = String(key)`
	`23`	`+ }`
`21`	`24`	`if (isUnsafeKey(key)) {`
`22`	`25`	throw new Error(`Cannot set unsafe key: "${key}"`);
`23`	`26`	`}`