windyfancy / webcontext Goto Github PK

ctx.request.data = Url.parse("url?" + result, true)["query"];
^

ReferenceError: Url is not defined

this file in node_modules_webcontext@1.0.8@webcontext\lib\request_body.js:46

There is a prototype pollution in file lib/session.js, line 46.
data[key]=params[key];

The code uses key as the index for the data object. If key is "proto", prototype pollution occurs.

To reproduce, see it('5.test read and write session ', function(done) {}. Since the key of v is supplied by users, attackers can change the key of variable v to be __proto__ to conduct attacks.

Suggestions:
To fix this vulnerability, it is recommended to blacklist prototype pollution payloads in key

set(params){
        return new Promise( (resolve)=>{
            let data= _sessionData[this.sessionId];
            for(let key in params){
+                if (key === '__proto__' or key === 'constructor') {
+                     continue;
+               }
                data[key]=params[key];
            }
            resolve(data)
            
         });
            
         
    }

可以融合其它中间件吗？
比如下面这个，来用处理 SPA 应用的 history 路由问题。

bripkens/connect-history-api-fallback: Fallback to index.html for applications that are using the HTML 5 history API