fix: proto could be set during parse - #328320
Conversation
There was a problem hiding this comment.
Pull request overview
Hardens the shared JSON parser against __proto__ prototype mutation.
Changes:
- Skips
__proto__during object construction. - Adds a regression test verifying the prototype remains unchanged.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
src/vs/base/common/json.ts |
Guards object property assignment. |
src/vs/base/test/common/json.test.ts |
Tests __proto__ handling. |
| } else if (currentProperty !== null && currentProperty !== '__proto__') { | ||
| currentParent[currentProperty] = value; |
There was a problem hiding this comment.
Done. The safe write is now isolated in an exported setObjectProperty helper in json.ts (using Object.defineProperty for __proto__, a plain assignment otherwise). Both json.parse and ConfigurationModelParser.doParseContent (lines 368-373) now call that helper, so the configuration-parser path no longer allows prototype pollution. A regression test was added to configurationModels.test.ts asserting that {"__proto__":{"editor.fontSize":100}} does not pollute Object.prototype and that the own property is still retrievable.
Co-authored-by: rzhao271 <7199958+rzhao271@users.noreply.github.com>
…Parser Co-authored-by: rzhao271 <7199958+rzhao271@users.noreply.github.com>
No description provided.