Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make prototype pollution attacks harder in most Bun APIs that accept objects #14119

Merged
merged 5 commits into from
Sep 25, 2024

Conversation

Jarred-Sumner
Copy link
Collaborator

What does this PR do?

Fixes GHSA-5jqh-3v22-8jgj

This makes it so that in most natively-implemented APIs, we ignore prototype chains when calling getters on objects. We deliberately continue to consult prototype chains for Web APIs and node APIs because that would be a clearly breaking change.

This might be a breaking change as-is.

There are probably a few more spots in Bun APIs where we should do this that we aren't, like the shell (which has a JS wrapper).

Let's see if this causes any non-flaky test failures

How did you verify your code works?

There is a test for GHSA-5jqh-3v22-8jgj

@Jarred-Sumner Jarred-Sumner merged commit 5722ae8 into main Sep 25, 2024
40 of 43 checks passed
@Jarred-Sumner Jarred-Sumner deleted the jarred/get-own branch September 25, 2024 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants