[system] Prevent prototype pollution in cssVarsParser

packages/mui-system/src/cssVars/cssVarsParser.test.ts

@@ -57,6 +57,22 @@ describe('cssVarsParser', () => {
         keys: ['xs', 'sm', 'md'],
       });
     });
+
+    ['__proto__', 'constructor', 'prototype'].forEach((key) => {
+      it(`does not pollute Object.prototype via \`${key}\``, () => {
+        try {
+          const result = {};
+          assignNestedKeys(result, ['a', key, 'polluted'], 'yes');
+          expect((result as Record<string, unknown>).polluted).to.equal(undefined);
+          expect(({} as Record<string, unknown>).polluted).to.equal(undefined);
+          expect(Object.prototype.hasOwnProperty.call(Object.prototype, 'polluted')).to.equal(
+            false,
+          );
+        } finally {
+          delete (Object.prototype as Record<string, unknown>).polluted;
+        }
+      });
+    });
   });
 
   describe('walkObjectDeep', () => {
@@ -396,6 +412,20 @@ describe('cssVarsParser', () => {
     });
   });
 
+  it('does not pollute Object.prototype from a `__proto__` token path', () => {
+    try {
+      // `JSON.parse` produces a real own-enumerable `__proto__` key, which is the attack vector.
+      const theme = JSON.parse('{"palette":{"__proto__":{"polluted":"yes"}}}');
+      const { vars } = cssVarsParser(theme, { prefix: 'mui' });
+      // The malicious leaf must not pollute Object.prototype nor leak into the generated vars.
+      expect(({} as Record<string, unknown>).polluted).to.equal(undefined);
+      expect(Object.prototype.hasOwnProperty.call(Object.prototype, 'polluted')).to.equal(false);
+      expect((vars as { palette?: Record<string, unknown> }).palette?.polluted).to.equal(undefined);
+    } finally {
+      delete (Object.prototype as Record<string, unknown>).polluted;
+    }
+  });
+
   it('does nothing if deep value is not string or number', () => {
     const { css, vars } = cssVarsParser({
       fooBar: () => '',

packages/mui-system/src/cssVars/cssVarsParser.ts

@@ -2,6 +2,8 @@ type NestedRecord<V = any> = {
   [k: string | number]: NestedRecord<V> | V;
 };
 
+const prototypePollutingKeys = new Set(['__proto__', 'constructor', 'prototype']);
+
 /**
  * This function create an object from keys, value and then assign to target
  *
@@ -29,7 +31,13 @@ export const assignNestedKeys = <
   arrayKeys: Array<string> = [],
 ) => {
   let temp: T = obj;
-  keys.forEach((k, index) => {
+  for (let index = 0; index < keys.length; index += 1) {
+    const k = keys[index];
+    // Prevent prototype pollution: never traverse or write through
+    // `__proto__` / `constructor` / `prototype` (e.g. a theme parsed from untrusted JSON).
+    if (prototypePollutingKeys.has(k)) {
+      break;
+    }
     if (index === keys.length - 1) {
       if (Array.isArray(temp)) {
         temp[Number(k)] = value;
@@ -42,7 +50,7 @@ export const assignNestedKeys = <
       }
       temp = temp[k];
     }
-  });
+  }
 };
 
 /**