thomaspoignant / scim-patch / 28115727548

99%

push

github

fix: prevent prototype pollution via inherited properties (GHSA-2mhw-wcx5-v3xj) (#1127)

* fix: prevent prototype pollution via inherited properties (GHSA-2mhw-wcx5-v3xj)

The denylist added in GHSA-9m6g-wc8r-q59c only blocked the literal segments
__proto__, constructor, and prototype. Path traversal still followed inherited
properties, so a patch path segment such as `toString` resolved to the shared
Object.prototype.toString built-in and a child key was assigned onto it,
mutating a process-global object.

Two vectors were affected:
  - dotted path:        { op: "add", path: "toString.x", value: "polluted" }
  - no-path value key:  { op: "add", value: { "toString.y": "polluted" } }

navigate() and assign() now treat only own properties as existing
(Object.prototype.hasOwnProperty.call), so an inherited key is handled as a
missing attribute: a fresh own container is created on the resource (shadowing
the built-in on that instance only) and the shared built-in is never touched.
navigate() keeps the original "||" semantics for own keys so a falsy own
intermediate (e.g. a null attribute, issue #186) is still replaced with a
container. The existing denylist is retained as defense in depth.

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: ignore .gstack/ and .context/ workspace dirs

* test: assert patched value lands on resource's own property

The prototype-pollution regression cases only asserted the negative (the shared
built-in stays clean). Add a positive assertion that the value is routed to the
resource's own property so the tests cannot pass on a silent no-op.

* test: use chai's .to.be.undefined assertion (SonarCloud S5906)

Prefer the specific .to.be.undefined property assertion over the generic
.to.equal(undefined), matching the style already used in scimPatch.test.ts.

---------

Co-authored-by: Claude <noreply@anthropic.com>

108 of 109 branches covered (99.08%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 1 file covered. (100.0%)

226 of 227 relevant lines covered (99.56%)

25.46 hits per line