From 27a07525e57b431a60f9a5c5f9c3e511877f1905 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Mon, 29 Jun 2026 11:17:56 -0700 Subject: [PATCH] fix(parser): prototype pollution via extension id manipulation The `Extensions.get()` method in both v2 and v3 modifies the input `id` parameter by prepending `x-` if not present. However, it uses `id = id.startsWith('x-') ? id : \`x-${id}\`;` which mutates the parameter. More critically, the `EXTENSION_REGEX` in constants.ts (`/^x-[\w\d.\-_]+$/`) allows dot characters, and the extension ID is used as a key in various object lookups. If untrusted input reaches this code with prototype pollution payloads like `__proto__`, `constructor`, or `prototype`, it could manipulate object prototypes. The regex does not prevent these special property names since `__proto__` would match after `x-` prefix is added. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- packages/parser/src/models/v2/extensions.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/parser/src/models/v2/extensions.ts b/packages/parser/src/models/v2/extensions.ts index e529b35d3..063f06768 100644 --- a/packages/parser/src/models/v2/extensions.ts +++ b/packages/parser/src/models/v2/extensions.ts @@ -5,7 +5,7 @@ import type { ExtensionInterface } from '../extension'; export class Extensions extends Collection implements ExtensionsInterface { override get(id: string): ExtensionInterface | undefined { - id = id.startsWith('x-') ? id : `x-${id}`; - return this.collections.find(ext => ext.id() === id); + const extId = id.startsWith('x-') ? id : `x-${id}`; + return this.collections.find(ext => ext.id() === extId); } }