Skip to content

Conversation

@odaysec
Copy link

@odaysec odaysec commented Oct 31, 2025

fix for #1133

To prevent security or runtime issues from unvalidated dynamic method lookup, we should ensure that:

  1. The property is an own property of parsersMap (not from the prototype chain).
  2. The value retrieved from parsersMap is a function before invoking it.

This can be addressed by replacing the direct dynamic call to parsersMap[contentType], and ensuring with two checks:

  • Use .hasOwnProperty(contentType) to confirm it is an own property,
  • Use typeof parsersMap[contentType] === 'function' to confirm it resolves to a function.

Alternatively, if parsersMap is never reassigned, it would be even safer to create it as an object without a prototype (e.g., Object.create(null)) or as a Map (but we cannot edit that from the current context). The best minimal fix given the context is to update the code inside the 'end' handler function, from the assignment and use of parseData, to ensure these checks are made before calling parseData. If validation fails, we can fall back to unknownParser as it currently does.

@odaysec odaysec requested a review from a team as a code owner October 31, 2025 12:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant