Skip to content

javascript: guard against __proto__ path components - #258

Merged
linkdata merged 2 commits into
mainfrom
fix/jsvar-proto-path-guard
Aug 7, 2026
Merged

javascript: guard against __proto__ path components#258
linkdata merged 2 commits into
mainfrom
fix/jsvar-proto-path-guard

Conversation

@linkdata

@linkdata linkdata commented Aug 7, 2026

Copy link
Copy Markdown
Owner

Summary

  • reject exact, case-sensitive proto components before browser path traversal
  • cover browser reads/writes, Set, request- and element-scoped Call, normalized paths, and batch continuation
  • document that paths are application-controlled while JSON values remain opaque data

Testing

  • go generate ./...
  • go vet ./...
  • staticcheck ./...
  • golangci-lint run
  • gosec ./...
  • JAWS_REQUIRE_NODE=1 go test -race ./...
  • JAWS_REQUIRE_NODE=1 go test ./...
  • go build ./...

Fixes #247

@linkdata
linkdata merged commit 54330bb into main Aug 7, 2026
7 checks passed
@linkdata
linkdata deleted the fix/jsvar-proto-path-guard branch August 7, 2026 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

javascript: guard against __proto__ path components

1 participant