Skip to content

Commit

Permalink
fix: use null prototype for LayoutAnimationRepository config (softwar…
Browse files Browse the repository at this point in the history
…e-mansion#3383)

## Description

Prevent the `configs` object from having properties inherited from `Object.prototype`, such as `toString` or `__proto__`. Otherwise, using these properties could potentially have a security impact.

## Changes

Changed the prototype of the `configs` object so it doesn't inherit from `Object.prototype`, as regular JS objects do by default.


## Test code and steps to reproduce

Couldn't find a test case that I could base on to demonstrate how this could present a risk.

An example of the problem caused by using an object inheriting from `Object.prototype` can be demonstrated by the following line (corresponding to the `startAnimationForTag` function):

```js
const style = configs[tag][type](yogaValues);
```

If both `tag` and `type` had the value `constructor`, style would have the result of evaluating `configs.constructor.constructor(yogaValues)`, which in many platforms would be the same as `new Function(yogaValues)`. This could potentially be used to create functions with malicious code. Although I suspect the conditions to make this work would be hard to achieve, it's probably better to get rid of this potential threat by using null prototypes.

## Checklist

- [ ] Included code example that can be used to test this change
- [ ] Updated TS types
- [ ] Added TS types tests
- [ ] Added unit / integration tests
- [ ] Updated documentation
- [ ] Ensured that CI passes
  • Loading branch information
matias-la authored and fluiddot committed Jun 5, 2023
1 parent 9c523ad commit 6e8e7eb
Showing 1 changed file with 1 addition and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import { processColor } from '../Colors';
runOnUI(() => {
'worklet';

const configs: Record<string, any> = {};
const configs: Record<string, any> = Object.create(null);
const enteringAnimationForTag: Record<string, any> = {};

global.LayoutAnimationRepository = {
Expand Down

0 comments on commit 6e8e7eb

Please sign in to comment.