ACAgentCode
返回题库
006ReviewseniorJavaScript / Node Security真实来源改编 tough-cookie

tough-cookie：修复 cookie domain 的原型污染

审查一个声称修复 tough-cookie CookieJar 原型污染 PoC（Domain=__proto__）的补丁：它在写入 cookie 前拦截 __proto__ 这个 domain。

ai-pr.diffdiff · 40 lines
diff --git a/lib/memstore.js b/lib/memstore.jsindex 793efb42..bad00061 100644--- a/lib/memstore.js+++ b/lib/memstore.js@@ -41,7 +41,11 @@ MemoryCookieStore.prototype.findCookies = function (domain, path, cb) {   cb(null, results) }  MemoryCookieStore.prototype.putCookie = function (cookie, cb) {+  // A cookie with Domain=__proto__ walks the prototype chain when we build+  // the domain index below and pollutes Object.prototype+  // (GHSA-72xf-g2v4-qvf3). Drop it before it is ever stored.+  if (cookie.domain === '__proto__') return cb(null)   if (!this.idx[cookie.domain]) this.idx[cookie.domain] = {}   if (!this.idx[cookie.domain][cookie.path]) this.idx[cookie.domain][cookie.path] = {}   this.idx[cookie.domain][cookie.path][cookie.key] = cookie   cb(null) }diff --git a/test/prototype_pollution_test.js b/test/prototype_pollution_test.jsindex 15406a25..8c93f421 100644--- a/test/prototype_pollution_test.js+++ b/test/prototype_pollution_test.js@@ -10,6 +10,16 @@ vows       },     },   }) +  .addBatch({+    'ignores __proto__ cookie domains': {+      topic: function () {+        const jar = new CookieJar()+        jar.setCookie('a=b; Domain=__proto__; Path=/', 'https://__proto__/', this.callback)+      },+      'does not pollute Object.prototype': function () {+        assert.equal({}.a, undefined)+      },+    },+  })   .export(module)