1

I have a line of code that looks like

  gMapping[userName] = gMapping[userName] || [];

I see Prototype pollution vulnerability raised by Snyk. How can this be resolved ?

Relevant code:

const gMapping: { [user_name: string]: string[] } = {};

// Map records to dictionaries
dbRecs.forEach(rec => {
    const userName = rec.user_name;
    const groupId = rec.group_id;
    gMapping[userName] = gMapping[userName] || [];
    gMapping[userName].push(groupId);
  }
});
systemdebt
  • 4,589
  • 10
  • 55
  • 116
  • What is `glMapping`? Where does `userName` come from? Can you be more specific about the Snyk warning message? – Bergi May 19 '21 at 19:31
  • @Bergi : userName comes from the DB. added the details about gMapping in the question – systemdebt May 19 '21 at 22:11

1 Answers1

2

The problem is that userName could be "__proto__". I'm not certain this would be exploitable in your case, but it still causes an exception when trying to invoke .push() on Object.prototype.

To avoid this issue, either use Object.create(null) (which isn't easy with TypeScript, unfortunately) or switch to a proper ES6 Map<string, string[]>.

Bergi
  • 630,263
  • 148
  • 957
  • 1,375