Skip to content

Prevent prototype pollution security issues #67

Open
@jeanmachuca

Description

@jeanmachuca

Is your feature request related to a problem? Please describe.
According to the paper published on May 15, 2018 by Oliver Arteau - A Prototype Pollution Attack in NodeJS there is a possibility to generate a security attack by exploiting the prototype object in several ways. This is often called Prototype Pollution.

Describe the solution you'd like
QCObjects could have some built-in feature that prevents this kind of attack, specially in the back-end as it is more susceptible to suffer attack attempts. I would like to make it in the core to give some relief to application developers that are coding safe using QCObjects features.

Describe alternatives you've considered
According to the same paper, one solution is to freeze the Object.prototype and use Map() instead of Object(). This solution is very useful but it requires an accurate testing before to release the version of QCObjects that contains these changes.

Additional context
This kind of attacks are becoming popular affecting other JavaScript server frameworks like Express. There is no evidence that these frameworks are addressing the issue from the core. What makes a huge advantage for developers to use QCObjects HTTP2 Built-In Server instead of Express in terms of security.
More info about the Express vulnerability here

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions