windyfancy / webcontext Goto Github PK
View Code? Open in Web Editor NEWwebcontext is a web framework and web application server based on node.js
License: MIT License
webcontext is a web framework and web application server based on node.js
License: MIT License
There is a prototype pollution in file lib/session.js, line 46.
data[key]=params[key];
The code uses key
as the index for the data object. If key
is "proto", prototype pollution occurs.
To reproduce, see it('5.test read and write session ', function(done) {}
. Since the key of v
is supplied by users, attackers can change the key of variable v
to be __proto__
to conduct attacks.
Suggestions:
To fix this vulnerability, it is recommended to blacklist prototype pollution payloads in key
set(params){
return new Promise( (resolve)=>{
let data= _sessionData[this.sessionId];
for(let key in params){
+ if (key === '__proto__' or key === 'constructor') {
+ continue;
+ }
data[key]=params[key];
}
resolve(data)
});
}
ctx.request.data = Url.parse("url?" + result, true)["query"];
^
ReferenceError: Url is not defined
this file in node_modules_webcontext@1.0.8@webcontext\lib\request_body.js:46
可以融合其它中间件吗?
比如下面这个,来用处理 SPA 应用的 history 路由问题。
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.