oaiFix: prototype-polluting assignment #276
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
twilio-cli-core/src/services/open-api-client.js
Lines 163 to 166 in 4b71a56
Fix the issue need to prevent prototype-polluting keys (
__proto__
,constructor
,prototype
) from being used in theevaluateRefs
method. This can be achieved by filtering out these keys before assigning values to theschema
object. Additionally, we should use a safer data structure, such as a prototype-less object created withObject.create(null)
, to store the modifiedschema
.Steps to fix:
evaluateRefs
method to filter out dangerous keys (__proto__
,constructor
,prototype
) when iterating overObject.entries(schema)
.schema
object with a prototype-less object (Object.create(null)
) to ensure that even if dangerous keys are accidentally included, they won't affectObject.prototype
.Checklist
If you have questions, please file a support ticket, or create a GitHub Issue in this repository.