[Auto release] release 2.0.0#4026
Conversation
refactor: graphic animation state
refactor: add mark api `hasAnimationByState`
fix: merge 1.13.11 to 2.0.0
Fix/upgrade vrender 1.0.3
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // eslint-disable-next-line @typescript-eslint/ban-ts-comment | ||
| // @ts-ignore | ||
| stateStyle[state][attr] = { | ||
| this.stateStyle[state][attr] = { |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, we need to prevent the state parameter from being used as a key if it contains a value that could lead to prototype pollution. This can be achieved by validating the state parameter before using it. Specifically:
- Reject keys such as
__proto__,constructor, andprototypethat could lead to prototype pollution. - Add a check at the beginning of the
setAttributemethod to ensurestateis valid.
This fix ensures that malicious input cannot exploit the vulnerability while preserving the existing functionality of the code.
| @@ -724,2 +724,7 @@ | ||
| ) { | ||
| // Validate the state parameter to prevent prototype pollution | ||
| if (state === '__proto__' || state === 'constructor' || state === 'prototype') { | ||
| throw new Error(`Invalid state key: ${state}`); | ||
| } | ||
|
|
||
| if (this.stateStyle[state] === undefined) { |
| // eslint-disable-next-line @typescript-eslint/ban-ts-comment | ||
| // @ts-ignore | ||
| stateStyle[state][key as keyof T] = stateStyle.normal[key]; | ||
| this.stateStyle[state][key as keyof T] = this.stateStyle.normal[key]; |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 11 months ago
To fix the issue, we need to ensure that the state parameter cannot be used to modify Object.prototype. This can be achieved by validating the state parameter before using it as a key in the this.stateStyle object. Specifically, we can check if state is one of the expected values and reject any unexpected or malicious values such as __proto__, constructor, or prototype.
The best way to fix this issue is to add a validation step for the state parameter at the beginning of the setAttribute method. If state contains a disallowed value, the method should throw an error or return early.
| @@ -724,2 +724,7 @@ | ||
| ) { | ||
| // Validate the state parameter to prevent prototype pollution | ||
| if (state === '__proto__' || state === 'constructor' || state === 'prototype') { | ||
| throw new Error(`Invalid state value: ${state}`); | ||
| } | ||
|
|
||
| if (this.stateStyle[state] === undefined) { |
8 participants
🆕 feat
🐛 fix
🔨 refactor