From 3a2e7abbd30ad6794497ea7b54373a93c8157965 Mon Sep 17 00:00:00 2001 From: Valera V Harseko Date: Mon, 20 Jul 2026 19:31:09 +0300 Subject: [PATCH 1/5] Guard query-param parsing against prototype pollution oauthReturn.html and mockOAuthAuthorization.html built a queryParams object by writing map[name] = value for every URL parameter, where the name is user-controlled. A parameter named __proto__ (or constructor / prototype) could therefore pollute Object.prototype (CodeQL js/remote-property-injection, CWE-1321). Skip those reserved names when populating the map. Legitimate parameters (state, code, redirect_uri) are unaffected. --- ui/commons/src/main/resources/oauthReturn.html | 9 ++++++++- ui/mock/src/main/resources/mockOAuthAuthorization.html | 9 ++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/ui/commons/src/main/resources/oauthReturn.html b/ui/commons/src/main/resources/oauthReturn.html index 0b7c4d66ec..571c08df60 100644 --- a/ui/commons/src/main/resources/oauthReturn.html +++ b/ui/commons/src/main/resources/oauthReturn.html @@ -1,3 +1,6 @@ + diff --git a/ui/mock/src/main/resources/mockOAuthAuthorization.html b/ui/mock/src/main/resources/mockOAuthAuthorization.html index 41513352d5..8206828d83 100644 --- a/ui/mock/src/main/resources/mockOAuthAuthorization.html +++ b/ui/mock/src/main/resources/mockOAuthAuthorization.html @@ -12,22 +12,26 @@