fix: backport __proto__ prototype pollution fix to v7.x#2140
fix: backport __proto__ prototype pollution fix to v7.x#2140vasiliiperfilev wants to merge 1 commit into
Conversation
…s#2126) When a properties object passed to Message constructor contains __proto__, such as in const properties = JSON.parse('{"__proto__": {"polluted": "yes"}}'); const message = new protobuf.Message(properties); the resulting message object will have message.polluted defined which is not intended. Filter out __proto__ when iterating over the keys of the properties.
|
@alexander-fenster could you please take a look? |
|
Hi @vasiliiperfilev, I will backport it, no problem, I just believe it's not the right branch you're sending this PR against. It's probably some older development branch. The latest 7.x tag is https://github.com/protobufjs/protobuf.js/tree/protobufjs-v7.5.4. I won't be able to change your pull request to point to the right branch, so I'll just commit the fix directly :) Hope you don't mind. |
|
I published https://www.npmjs.com/package/protobufjs/v/7.5.5 and tagged it here as https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5. |
|
Thanks a lot! |
|
The release 7.5.5 doesn't appear in the CHANGELOG.md file. This means that dependabot can't show the changes either. Could you please add it there @alexander-fenster? |
|
@thomas-bw I will whenever I merge any of the subsequent releases. As I said, with |
3 participants
Summary
Cherry-pick of #2126 (commit f05e3c3) onto the
ProtoBuf7branch.The fix filters out
__proto__keys in theMessageconstructor to prevent prototype pollution (AIKIDO-2026-10467). This was merged tomasterand released in 8.0.1-experimental, but the 7.x line (latest 7.5.4) remains unpatched.Many consumers are pinned to protobufjs ^7 via
google-gaxand the broader Google Cloud SDK ecosystem, and cannot upgrade to 8.x until those SDKs migrate. A 7.5.5 patch release would resolve the vulnerability for the entire ^7 ecosystem.Changes
Single file:
src/message.js— skip__proto__key when iterating over properties in the Message constructor. Identical to #2126.Request
Would it be possible to publish a
7.5.5release from the ProtoBuf7 branch with this fix included?