Node.js v14.9.0 Native Extension API
github.com1 pointsby redmorphium0 comments
let state = getState(); // returns empty {} if user not authenticated
if (!state.userIsAuthenticated) {
respond(401);
}
showBankAccount();
If the hacker is able to set `Object.prototype.userIsAuthenticated` then the auth check is now bypassed. const myData = {};
myData[rawUserInput()].key = value;
This is vulnerable if rawUserInput() returns `__proto__`: `key` on the prototype may be set to value if `myData` had `__proto__` set. If the hacker controls `key` and `value` then they can effectively modify `key` field on all objects.