Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 1: Prototype-polluting function #3920

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

alex-w
Copy link
Member

@alex-w alex-w commented Sep 28, 2024

Fixes https://github.com/Stellarium/stellarium/security/code-scanning/1

To fix the prototype pollution vulnerability in the extend function, we need to add checks to prevent the merging of special properties like __proto__ and constructor. This can be done by adding a condition to skip these properties during the merge process.

  • General Fix: Add a condition to skip properties named __proto__ and constructor during the merge process.
  • Detailed Fix: Modify the extend function to include a check that skips the properties __proto__ and constructor when copying properties from the source object to the target object.
  • Specific Changes: Update the extend function in the file plugins/RemoteControl/webroot/js/globalize.js to include the necessary checks.
  • Requirements: No additional methods or imports are needed. The changes will be made directly within the extend function.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@alex-w alex-w marked this pull request as ready for review September 28, 2024 16:36
@alex-w alex-w added this to the 24.4 milestone Sep 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant