Fix prototype pollution in Configuration.set/unset via __proto__ key traversal #6089

Author: Unitech

.gitignore

@@ -1,4 +1,5 @@
 /node_modules
+.claude
 claude
 CLAUDE.md
 *.log

CHANGELOG.md

@@ -18,6 +18,7 @@
 - Expand Docker parallel test runner to cover all internalized module tests
 - Drop auto source map file detection in Common.prepareAppConf
 - Fix HttpInterface env stripping never executing (WEB_STRIP_ENV_VARS) #6089
+- Fix prototype pollution in Configuration.set/unset via __proto__ key traversal #6089
 
 ## 6.0.14
 

lib/Configuration.js

@@ -20,6 +20,11 @@ function splitKey(key) {
   else if (key.indexOf(':') > -1)
     values = key.match(/(?:[^:"]+|"[^"]*")+/g).map(function(dt) { return dt.replace(/"/g, '') });
 
+  var dangerousKeys = ['__proto__', 'constructor', 'prototype'];
+  if (values.some(function(v) { return dangerousKeys.indexOf(v) !== -1; })) {
+    return [];
+  }
+
   return values;
 }
 

test/programmatic/issue_6089_prototype_pollution.mocha.js

@@ -0,0 +1,67 @@
+
+process.chdir(__dirname)
+
+var should = require('should')
+var PM2 = require('../..')
+var Configuration = require('../../lib/Configuration.js')
+
+describe('Issue #6089 - Configuration prototype pollution', function () {
+  this.timeout(30000)
+
+  before(function (done) {
+    PM2.list(done)
+  })
+
+  afterEach(function () {
+    delete Object.prototype.polluted
+    delete Object.prototype.rce
+  })
+
+  describe('set (async)', function () {
+    it('should reject __proto__ key', function (done) {
+      Configuration.set('__proto__.polluted', 'yes', function (err) {
+        should(({}).polluted).be.undefined()
+        done()
+      })
+    })
+
+    it('should reject constructor.prototype key', function (done) {
+      Configuration.set('constructor.prototype.polluted', 'yes', function (err) {
+        should(({}).polluted).be.undefined()
+        done()
+      })
+    })
+  })
+
+  describe('setSync', function () {
+    it('should reject __proto__ key', function () {
+      Configuration.setSync('__proto__.polluted', 'yes')
+      should(({}).polluted).be.undefined()
+    })
+
+    it('should reject prototype key', function () {
+      Configuration.setSync('constructor.prototype.polluted', 'yes')
+      should(({}).polluted).be.undefined()
+    })
+  })
+
+  describe('unset (async)', function () {
+    it('should reject __proto__ traversal', function (done) {
+      Object.prototype.rce = 'exists'
+      Configuration.unset('__proto__.rce', function (err) {
+        should(({}).rce).eql('exists')
+        delete Object.prototype.rce
+        done()
+      })
+    })
+  })
+
+  describe('unsetSync', function () {
+    it('should reject __proto__ traversal', function () {
+      Object.prototype.rce = 'exists'
+      Configuration.unsetSync('__proto__.rce')
+      should(({}).rce).eql('exists')
+      delete Object.prototype.rce
+    })
+  })
+})