Merge pull request #3139 from hapijs/chore/backport-messages-proto

fix: prevent messages proto injection

Author: Marsup

lib/messages.js

@@ -51,20 +51,24 @@ exports.compile = function (messages, target) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Don't reuse an inherited object, otherwise a language named __proto__ or constructor writes on the prototype
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 
@@ -157,20 +161,24 @@ exports.merge = function (base, extended) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Same as in compile(), don't reuse an inherited object
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 

test/base.js

@@ -2027,6 +2027,30 @@ describe('any', () => {
             Helper.validate(schema, [[{ a: 1 }, false, '"a" angustus']]);
         });
 
+        it('does not pollute the prototype with a language named __proto__', () => {
+
+            try {
+                Joi.any().messages({ ['__proto__']: { isAdmin: 'true' } });
+                Joi.any().prefs({ messages: { ['__proto__']: { isAdmin: 'true' } } });
+
+                expect({}.isAdmin).to.not.exist();
+            }
+            finally {
+                delete Object.prototype.isAdmin;
+            }
+        });
+
+        it('does not pollute Object with a language named constructor', () => {
+
+            try {
+                Joi.any().messages({ constructor: { 'number.min': 'too small' } });
+                expect(Object['number.min']).to.not.exist();
+            }
+            finally {
+                delete Object['number.min'];
+            }
+        });
+
         it('errors on invalid message value', () => {
 
             expect(() => Joi.number().min(10).message(12)).to.throw('Invalid message options');

test/extend.js

@@ -566,6 +566,24 @@ describe('extension', () => {
         expect(special.validate(1).error).to.be.an.error('shit happens');
     });
 
+    it('does not pollute the prototype with a language named __proto__', () => {
+
+        try {
+            Joi.extend({
+                type: 'special',
+                base: Joi.string(),
+                messages: {
+                    ['__proto__']: { isAdmin: 'true' }
+                }
+            });
+
+            expect({}.isAdmin).to.not.exist();
+        }
+        finally {
+            delete Object.prototype.isAdmin;
+        }
+    });
+
     it('overrides specific error messages with template', () => {
 
         const custom = Joi.extend({