From 4ab5468fb8c842bae4a8dd53476463ee6a1b6bbe Mon Sep 17 00:00:00 2001 From: Sasan Farrokh Date: Sat, 8 Feb 2025 17:21:17 +0100 Subject: [PATCH 1/2] fix: Object.prototype pollution XSS vulnerability --- lib/css.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/css.js b/lib/css.js index 49e9707..d4c09c8 100644 --- a/lib/css.js +++ b/lib/css.js @@ -26,9 +26,11 @@ function isNull (obj) { * @return {Object} */ function shallowCopyObject (obj) { - var ret = {}; + var ret = Object.create(null); for (var i in obj) { - ret[i] = obj[i]; + if (obj.hasOwnProperty(i)) { + ret[i] = obj[i]; + } } return ret; } From 02dea5fcb89921785b03f59de247b92bacf1a49d Mon Sep 17 00:00:00 2001 From: Sasan Farrokh Date: Sat, 8 Feb 2025 17:23:25 +0100 Subject: [PATCH 2/2] chore: update build outputs --- dist/cssfilter.js | 6 ++++-- dist/cssfilter.min.js | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/dist/cssfilter.js b/dist/cssfilter.js index b2b430a..c17fa5b 100644 --- a/dist/cssfilter.js +++ b/dist/cssfilter.js @@ -27,9 +27,11 @@ function isNull (obj) { * @return {Object} */ function shallowCopyObject (obj) { - var ret = {}; + var ret = Object.create(null); for (var i in obj) { - ret[i] = obj[i]; + if (obj.hasOwnProperty(i)) { + ret[i] = obj[i]; + } } return ret; } diff --git a/dist/cssfilter.min.js b/dist/cssfilter.min.js index be53d4e..90389a7 100644 --- a/dist/cssfilter.min.js +++ b/dist/cssfilter.min.js @@ -1 +1 @@ -(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n||r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i