From b561d43aafbf1a1bc7e77541be91b741357edaa6 Mon Sep 17 00:00:00 2001 From: alexpolo1 Date: Sun, 20 Oct 2024 10:59:14 +0200 Subject: [PATCH] Fix code scanning alert no. 2: Prototype-polluting assignment Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .../urllib3/contrib/emscripten/emscripten_fetch_worker.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/myenv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js b/myenv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js index 243b862..0feac23 100644 --- a/myenv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js +++ b/myenv/lib/python3.12/site-packages/urllib3/contrib/emscripten/emscripten_fetch_worker.js @@ -12,10 +12,18 @@ const encoder = new TextEncoder(); self.addEventListener("message", async function (event) { if (event.data.close) { let connectionID = event.data.close; + if (connectionID === '__proto__' || connectionID === 'constructor' || connectionID === 'prototype') { + console.error("Invalid connectionID"); + return; + } delete connections[connectionID]; return; } else if (event.data.getMore) { let connectionID = event.data.getMore; + if (connectionID === '__proto__' || connectionID === 'constructor' || connectionID === 'prototype') { + console.error("Invalid connectionID"); + return; + } let { curOffset, value, reader, intBuffer, byteBuffer } = connections[connectionID]; // if we still have some in buffer, then just send it back straight away