console: fix prototype pollution via console.table

CVE-ID: CVE-2022-21824 PR-URL: nodejs-private/node-private#307 Refs: https://hackerone.com/reports/1431042 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Сковорода Никита Андреевич <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>
nodejs · Jan 7, 2022 · 2a0515f · 2a0515f
1 parent d8a59e0
commit 2a0515f
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/lib/internal/console/constructor.js b/lib/internal/console/constructor.js
@@ -15,6 +15,7 @@ const {
   MathFloor,
   Number,
   NumberPrototypeToFixed,
+  ObjectCreate,
   ObjectDefineProperties,
   ObjectDefineProperty,
   ObjectKeys,
@@ -554,7 +555,7 @@ const consoleMethods = {
       return final([iterKey, valuesKey], [getIndexArray(length), values]);
     }
 
-    const map = {};
+    const map = ObjectCreate(null);
     let hasPrimitives = false;
     const valuesKeyArray = [];
     const indexKeyArray = ObjectKeys(tabularData);

diff --git a/test/parallel/test-console-table.js b/test/parallel/test-console-table.js
@@ -276,3 +276,18 @@ test({ foo: '你好', bar: 'hello' }, `
 │   bar   │ 'hello' │
 └─────────┴─────────┘
 `);
+
+// Regression test for prototype pollution via console.table. Earlier versions
+// of Node.js created an object with a non-null prototype within console.table
+// and then wrote to object[column][index], which lead to an error as well as
+// modifications to Object.prototype.
+test([{ foo: 10 }, { foo: 20 }], ['__proto__'], `
+┌─────────┬───────────┐
+│ (index) │ __proto__ │
+├─────────┼───────────┤
+│    0    │           │
+│    1    │           │
+└─────────┴───────────┘
+`);
+assert.strictEqual('0' in Object.prototype, false);
+assert.strictEqual('1' in Object.prototype, false);