Skip to content

Commit

Permalink
child_process: fix incomplete prototype pollution hardening
Browse files Browse the repository at this point in the history
Prior pull request (nodejs#48726) hardened against prototype pollution
vulnerabilities but effectively missed some use-cases which
opened a window for prototype pollution for some child_process
functions such as spawn(), spawnSync(), and execFileSync().
  • Loading branch information
lirantal committed Jul 9, 2024
1 parent cbd2c38 commit 7f270ee
Showing 1 changed file with 34 additions and 1 deletion.
35 changes: 34 additions & 1 deletion test/parallel/test-child-process-prototype-tampering.mjs
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import * as common from '../common/index.mjs';
import * as fixtures from '../common/fixtures.mjs';
import { EOL } from 'node:os';
import { strictEqual } from 'node:assert';
import { strictEqual, notStrictEqual, throws } from 'node:assert';
import cp from 'node:child_process';

// TODO(LiviaMedeiros): test on different platforms
Expand Down Expand Up @@ -57,3 +57,36 @@ for (const tamperedUID of [0, 1, 999, 1000, 0n, 'gwak']) {

delete Object.prototype.execPath;
}

for (const shellCommandArgument of ['-L && echo "tampered"']) {
Object.prototype.shell = true;
const cmd = 'pwd';
let cmdExitCode = '';


const program = cp.spawn(cmd, [shellCommandArgument], { cwd: expectedCWD });
program.stderr.on('data', common.mustCall());
program.stdout.on('data', common.mustNotCall());

program.on('exit', common.mustCall((code) => {
notStrictEqual(code, 0);
}));

cp.execFile(cmd, [shellCommandArgument], { cwd: expectedCWD },
common.mustCall((err) => {
notStrictEqual(err.code, 0);
})
);

throws(() => {
cp.execFileSync(cmd, [shellCommandArgument], { cwd: expectedCWD });
}, (e) => {
notStrictEqual(e.status, 0);
return true;
});

cmdExitCode = cp.spawnSync(cmd, [shellCommandArgument], { cwd: expectedCWD }).status;
notStrictEqual(cmdExitCode, 0);

delete Object.prototype.shell;
}

0 comments on commit 7f270ee

Please sign in to comment.