TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Exploiting prototype pollution

53 pointsby xtacyover 5 years ago

5 comments

BiteCode_devover 5 years ago
The problem here is not prototyping, it's the service accepting executable code from the user.
评论 #21621396 未加载
ec109685over 5 years ago
Prototype pollution is nasty. You can get into a state where your Node.js server is "poisoned" and all subsequent requests are owned by the attacker, depending on which object is polluted.
eternalbanover 5 years ago
&quot;Prototype pollution is a vulnerability that is specific to programming languages with prototype-based inheritance (the most common one being JavaScript).&quot;<p>Naming is a difficult but critical aspect of conceptualizing a solution [1]. Programming, even when ad-hoc, relies on an internal conceptual model to guide the programmer. It pays to be pedantic with language.<p>A &quot;prototype&quot; per common understanding and dictionary definition strongly implies the act of &quot;copying&quot;. Per that sense, the &quot;prototype&quot; of an Object is distinct object with its own distinct life-cycle and state space trajectory.<p>So it should be clarified here that the OP exploit is not an inherent weakness of prototype based OO approach, in principle. The Javascript &quot;prototype&quot; is really a &quot;parent delegate&quot;. It is a <i>Delegated-Parent Inheritance</i> language, and the OP exploit <i>is</i> a feature&#x2F;bug of delegate based composition approaches, by definition.<p>This inability by otherwise (obviously) intelligent people in naming things is an unfortunate pattern in computer science and software development. A historic favorite is &quot;dynamic programming&quot;.<p>[1]: <a href="https:&#x2F;&#x2F;martinfowler.com&#x2F;bliki&#x2F;TwoHardThings.html" rel="nofollow">https:&#x2F;&#x2F;martinfowler.com&#x2F;bliki&#x2F;TwoHardThings.html</a>
评论 #21621676 未加载
评论 #21620601 未加载
sbr464over 5 years ago
one thing to note:<p><pre><code> for (key in obj) &#x2F;&#x2F; do </code></pre> It’s better to use the first method below (when initializing):<p><pre><code> obj = Object.create(null) obj = {} </code></pre> So you don’t inherit random keys from the chain, unless you intend to. Or use:<p><pre><code> Object.keys(obj).forEach(k </code></pre> Which doesn’t have this issue like the for-in loop version does.
评论 #21619094 未加载
评论 #21619064 未加载
pwdisswordfish2over 5 years ago
<p><pre><code> delete Object.prototype.__proto__; </code></pre> Fixed.
评论 #21620155 未加载