Fix prototype pollution

Author: tolyo

src/services/wasm/wasm.spec.ts

@@ -128,6 +128,54 @@ describe("WasmScopeAbi", () => {
     expect(rootScope.filters.status).toBeUndefined();
   });
 
+  it("rejects prototype-polluting write paths", () => {
+    const scope = abi.createScope(rootScope, { name: "todoList:main" });
+    const value = guest.writeJson("polluted");
+    const poisoned = [
+      "__proto__.wasmPolluted",
+      "safe.constructor.prototype.wasmPolluted",
+      "safe.prototype.wasmPolluted",
+    ];
+
+    for (const pathValue of poisoned) {
+      const path = guest.write(pathValue);
+
+      expect(
+        imports.scope_set(
+          scope.handle,
+          path.ptr,
+          path.len,
+          value.ptr,
+          value.len,
+        ),
+      ).toBe(0);
+    }
+
+    expect(rootScope.safe).toBeUndefined();
+    expect(({} as Record<string, unknown>).wasmPolluted).toBeUndefined();
+  });
+
+  it("rejects prototype-polluting read and delete paths", () => {
+    const scope = abi.createScope(rootScope, { name: "todoList:main" });
+    const path = guest.write("__proto__.wasmPolluted");
+
+    (Object.prototype as Record<string, unknown>).wasmPolluted = "inherited";
+
+    try {
+      const result = imports.scope_get(scope.handle, path.ptr, path.len);
+
+      expect(
+        guest.readJson(imports.buffer_ptr(result), imports.buffer_len(result)),
+      ).toBeNull();
+      expect(imports.scope_delete(scope.handle, path.ptr, path.len)).toBe(0);
+      expect(({} as Record<string, unknown>).wasmPolluted).toBe("inherited");
+
+      imports.buffer_free(result);
+    } finally {
+      delete (Object.prototype as Record<string, unknown>).wasmPolluted;
+    }
+  });
+
   it("runs bridge sync callbacks asynchronously", async () => {
     const scope = abi.createScope(rootScope, { name: "todoList:main" });
     const name = guest.write("todoList:main");

src/services/wasm/wasm.ts

@@ -6,6 +6,12 @@ const textEncoder = new TextEncoder();
 
 const textDecoder = new TextDecoder();
 
+const UNSAFE_SCOPE_PATH_KEYS = new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+]);
+
 /** Options for loading a WebAssembly module through `$wasm`. */
 export interface WasmOptions {
   /**
@@ -895,6 +901,11 @@ function readScopePath(scope: ng.Scope, path: string): unknown {
   }
 
   const keys = scopePathKeys(path);
+
+  if (!isSafeScopePath(keys)) {
+    return undefined;
+  }
+
   let current: unknown = scope;
 
   for (let i = 0, l = keys.length; i < l; i++) {
@@ -915,7 +926,7 @@ function writeScopePath(
 ): boolean {
   const keys = scopePathKeys(path);
 
-  if (keys.length === 0) {
+  if (keys.length === 0 || !isSafeScopePath(keys)) {
     return false;
   }
 
@@ -944,7 +955,7 @@ function writeScopePath(
 function deleteScopePath(scope: ng.Scope, path: string): boolean {
   const keys = scopePathKeys(path);
 
-  if (keys.length === 0) {
+  if (keys.length === 0 || !isSafeScopePath(keys)) {
     return false;
   }
 
@@ -966,3 +977,7 @@ function deleteScopePath(scope: ng.Scope, path: string): boolean {
 function scopePathKeys(path: string): string[] {
   return path.split(".").filter(Boolean);
 }
+
+function isSafeScopePath(keys: string[]): boolean {
+  return keys.every((key) => !UNSAFE_SCOPE_PATH_KEYS.has(key));
+}