Summary
The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Details
In _copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto. Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype.
PoC
const malicious = JSON.parse('{"proto": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // true
Suggested Fix
Add objHasOwnProperty check and filter proto, constructor, prototype keys.
Severity
High (CVSS ~7.5) - requires attacker-controlled input to reach objDeepCopy, but impact is global prototype pollution.
Summary
The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys (proto, constructor, prototype). This allows an attacker to pollute the prototype chain of all objects in the application.
Details
In _copyProps() (copy.ts lines 186-191), the code iterates all enumerable properties including inherited ones and dangerous keys like proto. Any object with a proto key (e.g., from untrusted JSON input) will overwrite the target's prototype.
PoC
const malicious = JSON.parse('{"proto": {"polluted": true}}');
objDeepCopy(malicious);
console.log({}.polluted); // true
Suggested Fix
Add objHasOwnProperty check and filter proto, constructor, prototype keys.
Severity
High (CVSS ~7.5) - requires attacker-controlled input to reach objDeepCopy, but impact is global prototype pollution.