Skip to content

Commit f34cabc

Browse files
addaleaxaddaleax
authored
fix(NODE-3153): correctly deserialize __proto__ properties (#431)
1 parent 4613763 commit f34cabc

File tree

2 files changed

+63
-36
lines changed

2 files changed

+63
-36
lines changed

‎src/parser/deserializer.ts

+46-36
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ function deserializeObject(
152152
// If are at the end of the buffer there is a problem with the document
153153
if (i >= buffer.byteLength) throw new Error('Bad BSON Document: illegal CString');
154154
const name = isArray ? arrayIndex++ : buffer.toString('utf8', index, i);
155+
let value;
155156

156157
index = i + 1;
157158

@@ -172,30 +173,29 @@ function deserializeObject(
172173
throw new Error('Invalid UTF-8 string in BSON document');
173174
}
174175

175-
const s = buffer.toString('utf8', index, index + stringSize - 1);
176+
value = buffer.toString('utf8', index, index + stringSize - 1);
176177

177-
object[name] = s;
178178
index = index + stringSize;
179179
} else if (elementType === constants.BSON_DATA_OID) {
180180
const oid = Buffer.alloc(12);
181181
buffer.copy(oid, 0, index, index + 12);
182-
object[name] = new ObjectId(oid);
182+
value = new ObjectId(oid);
183183
index = index + 12;
184184
} else if (elementType === constants.BSON_DATA_INT && promoteValues === false) {
185-
object[name] = new Int32(
185+
value = new Int32(
186186
buffer[index++] | (buffer[index++] << 8) | (buffer[index++] << 16) | (buffer[index++] << 24)
187187
);
188188
} else if (elementType === constants.BSON_DATA_INT) {
189-
object[name] =
189+
value =
190190
buffer[index++] |
191191
(buffer[index++] << 8) |
192192
(buffer[index++] << 16) |
193193
(buffer[index++] << 24);
194194
} else if (elementType === constants.BSON_DATA_NUMBER && promoteValues === false) {
195-
object[name] = new Double(buffer.readDoubleLE(index));
195+
value = new Double(buffer.readDoubleLE(index));
196196
index = index + 8;
197197
} else if (elementType === constants.BSON_DATA_NUMBER) {
198-
object[name] = buffer.readDoubleLE(index);
198+
value = buffer.readDoubleLE(index);
199199
index = index + 8;
200200
} else if (elementType === constants.BSON_DATA_DATE) {
201201
const lowBits =
@@ -208,10 +208,10 @@ function deserializeObject(
208208
(buffer[index++] << 8) |
209209
(buffer[index++] << 16) |
210210
(buffer[index++] << 24);
211-
object[name] = new Date(new Long(lowBits, highBits).toNumber());
211+
value = new Date(new Long(lowBits, highBits).toNumber());
212212
} else if (elementType === constants.BSON_DATA_BOOLEAN) {
213213
if (buffer[index] !== 0 && buffer[index] !== 1) throw new Error('illegal boolean type value');
214-
object[name] = buffer[index++] === 1;
214+
value = buffer[index++] === 1;
215215
} else if (elementType === constants.BSON_DATA_OBJECT) {
216216
const _index = index;
217217
const objectSize =
@@ -224,9 +224,9 @@ function deserializeObject(
224224

225225
// We have a raw value
226226
if (raw) {
227-
object[name] = buffer.slice(index, index + objectSize);
227+
value = buffer.slice(index, index + objectSize);
228228
} else {
229-
object[name] = deserializeObject(buffer, _index, options, false);
229+
value = deserializeObject(buffer, _index, options, false);
230230
}
231231

232232
index = index + objectSize;
@@ -253,15 +253,15 @@ function deserializeObject(
253253
arrayOptions['raw'] = true;
254254
}
255255

256-
object[name] = deserializeObject(buffer, _index, arrayOptions, true);
256+
value = deserializeObject(buffer, _index, arrayOptions, true);
257257
index = index + objectSize;
258258

259259
if (buffer[index - 1] !== 0) throw new Error('invalid array terminator byte');
260260
if (index !== stopIndex) throw new Error('corrupted array bson');
261261
} else if (elementType === constants.BSON_DATA_UNDEFINED) {
262-
object[name] = undefined;
262+
value = undefined;
263263
} else if (elementType === constants.BSON_DATA_NULL) {
264-
object[name] = null;
264+
value = null;
265265
} else if (elementType === constants.BSON_DATA_LONG) {
266266
// Unpack the low and high bits
267267
const lowBits =
@@ -277,12 +277,12 @@ function deserializeObject(
277277
const long = new Long(lowBits, highBits);
278278
// Promote the long if possible
279279
if (promoteLongs && promoteValues === true) {
280-
object[name] =
280+
value =
281281
long.lessThanOrEqual(JS_INT_MAX_LONG) && long.greaterThanOrEqual(JS_INT_MIN_LONG)
282282
? long.toNumber()
283283
: long;
284284
} else {
285-
object[name] = long;
285+
value = long;
286286
}
287287
} else if (elementType === constants.BSON_DATA_DECIMAL128) {
288288
// Buffer to contain the decimal bytes
@@ -295,9 +295,9 @@ function deserializeObject(
295295
const decimal128 = new Decimal128(bytes) as Decimal128 | { toObject(): unknown };
296296
// If we have an alternative mapper use that
297297
if ('toObject' in decimal128 && typeof decimal128.toObject === 'function') {
298-
object[name] = decimal128.toObject();
298+
value = decimal128.toObject();
299299
} else {
300-
object[name] = decimal128;
300+
value = decimal128;
301301
}
302302
} else if (elementType === constants.BSON_DATA_BINARY) {
303303
let binarySize =
@@ -333,9 +333,9 @@ function deserializeObject(
333333
}
334334

335335
if (promoteBuffers && promoteValues) {
336-
object[name] = buffer.slice(index, index + binarySize);
336+
value = buffer.slice(index, index + binarySize);
337337
} else {
338-
object[name] = new Binary(buffer.slice(index, index + binarySize), subType);
338+
value = new Binary(buffer.slice(index, index + binarySize), subType);
339339
}
340340
} else {
341341
const _buffer = Buffer.alloc(binarySize);
@@ -360,9 +360,9 @@ function deserializeObject(
360360
}
361361

362362
if (promoteBuffers && promoteValues) {
363-
object[name] = _buffer;
363+
value = _buffer;
364364
} else {
365-
object[name] = new Binary(_buffer, subType);
365+
value = new Binary(_buffer, subType);
366366
}
367367
}
368368

@@ -412,7 +412,7 @@ function deserializeObject(
412412
}
413413
}
414414

415-
object[name] = new RegExp(source, optionsArray.join(''));
415+
value = new RegExp(source, optionsArray.join(''));
416416
} else if (elementType === constants.BSON_DATA_REGEXP && bsonRegExp === true) {
417417
// Get the start search index
418418
i = index;
@@ -439,7 +439,7 @@ function deserializeObject(
439439
index = i + 1;
440440

441441
// Set the object
442-
object[name] = new BSONRegExp(source, regExpOptions);
442+
value = new BSONRegExp(source, regExpOptions);
443443
} else if (elementType === constants.BSON_DATA_SYMBOL) {
444444
const stringSize =
445445
buffer[index++] |
@@ -453,7 +453,7 @@ function deserializeObject(
453453
)
454454
throw new Error('bad string length in bson');
455455
const symbol = buffer.toString('utf8', index, index + stringSize - 1);
456-
object[name] = promoteValues ? symbol : new BSONSymbol(symbol);
456+
value = promoteValues ? symbol : new BSONSymbol(symbol);
457457
index = index + stringSize;
458458
} else if (elementType === constants.BSON_DATA_TIMESTAMP) {
459459
const lowBits =
@@ -467,11 +467,11 @@ function deserializeObject(
467467
(buffer[index++] << 16) |
468468
(buffer[index++] << 24);
469469

470-
object[name] = new Timestamp(lowBits, highBits);
470+
value = new Timestamp(lowBits, highBits);
471471
} else if (elementType === constants.BSON_DATA_MIN_KEY) {
472-
object[name] = new MinKey();
472+
value = new MinKey();
473473
} else if (elementType === constants.BSON_DATA_MAX_KEY) {
474-
object[name] = new MaxKey();
474+
value = new MaxKey();
475475
} else if (elementType === constants.BSON_DATA_CODE) {
476476
const stringSize =
477477
buffer[index++] |
@@ -491,12 +491,12 @@ function deserializeObject(
491491
// If we have cache enabled let's look for the md5 of the function in the cache
492492
if (cacheFunctions) {
493493
// Got to do this to avoid V8 deoptimizing the call due to finding eval
494-
object[name] = isolateEval(functionString, functionCache, object);
494+
value = isolateEval(functionString, functionCache, object);
495495
} else {
496-
object[name] = isolateEval(functionString);
496+
value = isolateEval(functionString);
497497
}
498498
} else {
499-
object[name] = new Code(functionString);
499+
value = new Code(functionString);
500500
}
501501

502502
// Update parse index position
@@ -559,14 +559,14 @@ function deserializeObject(
559559
// If we have cache enabled let's look for the md5 of the function in the cache
560560
if (cacheFunctions) {
561561
// Got to do this to avoid V8 deoptimizing the call due to finding eval
562-
object[name] = isolateEval(functionString, functionCache, object);
562+
value = isolateEval(functionString, functionCache, object);
563563
} else {
564-
object[name] = isolateEval(functionString);
564+
value = isolateEval(functionString);
565565
}
566566

567-
object[name].scope = scopeObject;
567+
value.scope = scopeObject;
568568
} else {
569-
object[name] = new Code(functionString, scopeObject);
569+
value = new Code(functionString, scopeObject);
570570
}
571571
} else if (elementType === constants.BSON_DATA_DBPOINTER) {
572572
// Get the code string size
@@ -599,12 +599,22 @@ function deserializeObject(
599599
index = index + 12;
600600

601601
// Upgrade to DBRef type
602-
object[name] = new DBRef(namespace, oid);
602+
value = new DBRef(namespace, oid);
603603
} else {
604604
throw new Error(
605605
'Detected unknown BSON type ' + elementType.toString(16) + ' for fieldname "' + name + '"'
606606
);
607607
}
608+
if (name === '__proto__') {
609+
Object.defineProperty(object, name, {
610+
value,
611+
writable: true,
612+
enumerable: true,
613+
configurable: true
614+
});
615+
} else {
616+
object[name] = value;
617+
}
608618
}
609619

610620
// Check if the deserialization was against a valid array/object

‎test/node/bson_test.js

+17
Original file line numberDiff line numberDiff line change
@@ -2164,6 +2164,23 @@ describe('BSON', function () {
21642164
done();
21652165
});
21662166

2167+
/**
2168+
* @ignore
2169+
*/
2170+
it('Should correctly deserialize objects containing __proto__ keys', function (done) {
2171+
var doc = { ['__proto__']: { a: 42 } };
2172+
var serialized_data = BSON.serialize(doc);
2173+
2174+
var serialized_data2 = Buffer.alloc(BSON.calculateObjectSize(doc));
2175+
BSON.serializeWithBufferAndIndex(doc, serialized_data2);
2176+
assertBuffersEqual(done, serialized_data, serialized_data2, 0);
2177+
2178+
var doc1 = BSON.deserialize(serialized_data);
2179+
expect(Object.getOwnPropertyDescriptor(doc1, '__proto__').enumerable).to.equal(true);
2180+
expect(doc1.__proto__.a).to.equal(42);
2181+
done();
2182+
});
2183+
21672184
/**
21682185
* @ignore
21692186
*/

0 commit comments

Comments
 (0)