mudhorn/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2025-03-05 20:50:17 -08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(Google Cloud Firestore Node): Fix potential prototype pollution vulnerability (#13035)

Browse source
This commit is contained in:
कारतोफ्फेलस्क्रिप्ट™ 2025-02-04 12:14:51 +01:00 committed by GitHub
parent 7ca6a796b9
commit f150f79ad6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
packages/nodes-base/nodes/Google/Firebase/CloudFirestore/GenericFunctions.ts
View file

@ -82,6 +82,8 @@ export async function googleApiRequestAllItems(
const isValidDate = (str: string) => const isValidDate = (str: string) =>
moment(str, ['YYYY-MM-DD HH:mm:ss Z', moment.ISO_8601], true).isValid(); moment(str, ['YYYY-MM-DD HH:mm:ss Z', moment.ISO_8601], true).isValid();
const protoKeys = ['__proto__', 'prototype', 'constructor'];
// Both functions below were taken from Stack Overflow jsonToDocument was fixed as it was unable to handle null values correctly // Both functions below were taken from Stack Overflow jsonToDocument was fixed as it was unable to handle null values correctly
// https://stackoverflow.com/questions/62246410/how-to-convert-a-firestore-document-to-plain-json-and-vice-versa // https://stackoverflow.com/questions/62246410/how-to-convert-a-firestore-document-to-plain-json-and-vice-versa
// Great thanks to https://stackoverflow.com/users/3915246/mahindar // Great thanks to https://stackoverflow.com/users/3915246/mahindar
@ -104,10 +106,11 @@ export function jsonToDocument(value: string | number | IDataObject | IDataObjec
} else if (value && value.constructor === Array) { } else if (value && value.constructor === Array) {
return { arrayValue: { values: value.map((v) => jsonToDocument(v)) } }; return { arrayValue: { values: value.map((v) => jsonToDocument(v)) } };
} else if (typeof value === 'object') { } else if (typeof value === 'object') {
const obj = {}; const obj: IDataObject = {};
for (const o of Object.keys(value)) { for (const key of Object.keys(value)) {
//@ts-ignore if (value.hasOwnProperty(key) && !protoKeys.includes(key)) {
obj[o] = jsonToDocument(value[o] as IDataObject); obj[key] = jsonToDocument((value as IDataObject)[key] as IDataObject);
}
} }
return { mapValue: { fields: obj } }; return { mapValue: { fields: obj } };
} }