JavaScript prototype pollution & Object properties

[radex]

I added two new sections:

JavaScript prototype pollution

This is an attack where properties are added onto Object prototype, making them part of ALL objects, e.g.:

object.__proto__.isAdmin = true
({}).isAdmin // == true

In essence, any code containing obj[a][b] = value where at least a and value are user controlled are vulnerable, and many popular libraries have had this vulnerability found. More info: https://github.com/HoLyVieR/prototype-pollution-nsec18

my two naughty strings contain the standard naughty JSON with a proto property, and a less likely but still possible attack where obj[a][b][c] = value is needed. the JSON keys are common names that are likely to break any application (items, data, attributes)

JavaScript Object properties

those are properties on the default Object prototype that will cause issues in two cases:

1. Programmer writes obj.<obj-method>() on a user-controlled object (can crash if user supplies this method) -- the correct thing to do is Object.prototype.<name>.call(obj, ...)
2. Programmer uses obj[key] on a user-controlled object to check if a key exists - this will always be truthy for Object properties, but incorrect. This logic error can be a security vulnerability in some cases.

[radex]

JavaScript Object properties

I've already found one bug using this :) techfort/LokiJS#839

[radex]

@minimaxir Hey! What can I do to help get this PR merged? Do you need help with maintaining this repo?