Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 2: Prototype-polluting function #3919

Closed
wants to merge 1 commit into from

Conversation

alex-w
Copy link
Member

@alex-w alex-w commented Sep 28, 2024

Fixes https://github.com/Stellarium/stellarium/security/code-scanning/2

To fix the prototype pollution vulnerability in the mixin function, we need to add checks to block the special properties __proto__ and constructor. This will prevent these properties from being copied from the source object to the target object, thereby mitigating the risk of prototype pollution.

  • Modify the mixin function to include checks for __proto__ and constructor properties.
  • Ensure these checks are applied before any properties are copied from the source to the target object.
  • The changes will be made in the file plugins/RemoteControl/webroot/js/require.js within the mixin function.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@alex-w alex-w marked this pull request as ready for review September 28, 2024 16:36
@alex-w alex-w added this to the 24.4 milestone Sep 28, 2024
@alex-w
Copy link
Member Author

alex-w commented Sep 29, 2024

Should be replaced by PR #3923 - a new version of RequireJS has this security fix.

@alex-w alex-w closed this Sep 29, 2024
@alex-w alex-w deleted the autofix/alert-2-a12ef76c44 branch September 29, 2024 16:20
@alex-w alex-w added the state: published The fix has been published for testing in weekly binary package label Oct 7, 2024
Copy link

github-actions bot commented Oct 7, 2024

Hello @alex-w!

Please check the fresh version (development snapshot) of Stellarium:
https://github.com/Stellarium/stellarium-data/releases/tag/weekly-snapshot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
state: published The fix has been published for testing in weekly binary package
Development

Successfully merging this pull request may close these issues.

1 participant